[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-147":3},{"item":4,"lessons":16,"controls":38,"related":57},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-147","SP 800-147","SP 800-147: BIOS Protection Guidelines",5,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidelines for preventing unauthorised modification of BIOS firmware on PC client systems. They describe an authenticated update mechanism, optional secure local update and protections against bypassing these controls. A related publication, SP 800-147B, applies similar principles to servers.\n\n**In practice.** Organisations specify in procurement that systems support authenticated BIOS updates, deploy firmware updates through managed processes and protect BIOS configuration with administrator passwords. Firmware is included in vulnerability management. Evidence includes procurement requirements, firmware update records and configuration baselines. Where systems use UEFI secure boot, it is enabled and its keys are managed.\n\n**Common gaps.** Typical gaps are firmware never updated after deployment and BIOS settings left unprotected. Later guidance, such as SP 800-193, extends these ideas to broader platform firmware.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"unrevoked-uefi-shims-enable-secure-boot-bypass-via-trusted-but-vulnerable-bootloaders","Unrevoked UEFI Shims Enable Secure Boot Bypass via Trusted-but-Vulnerable Bootloaders","2026-07-16T08:20:19.874+00:00",{"slug":23,"title":24,"published_at":25},"forgotten-uefi-bootloaders-leave-secure-boot-exposed-for-years","Forgotten UEFI Bootloaders Leave Secure Boot Exposed for Years","2026-07-15T22:20:38.574+00:00",{"slug":27,"title":28,"published_at":29},"old-microsoft-signed-linux-uefi-shims-enable-secure-boot-bypass","Old Microsoft-Signed Linux UEFI Shims Enable Secure Boot Bypass","2026-07-14T14:21:54.094+00:00",{"slug":31,"title":32,"published_at":33},"expiring-secure-boot-certificates-risk-uefi-bootkit-infections","Expiring Secure Boot Certificates Risk UEFI Bootkit Infections","2026-06-21T10:20:28.374+00:00",{"slug":35,"title":36,"published_at":37},"firmware-level-bootkits-achieve-unprecedented-persistence","Firmware-Level Bootkits Achieve Unprecedented Persistence","2026-04-09T18:10:04.993+00:00",[39,43,47,52],{"slug":40,"name":41,"problem":42,"stories":9},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":44,"name":45,"problem":46,"stories":9},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":48,"name":49,"problem":50,"stories":51},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":53,"name":54,"problem":55,"stories":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",1,[58,62,67,71,77,81,86,90],{"family":59,"item":60,"code":61,"title":61,"together":51},"itil","overview","ITIL",{"family":63,"item":64,"code":65,"title":66,"together":51},"cis","7","Control 7","Continuous Vulnerability Management",{"family":63,"item":68,"code":69,"title":70,"together":51},"2","Control 2","Inventory and Control of Software Assets",{"family":72,"item":73,"code":74,"title":75,"together":76},"nist-csf","id-am","ID.AM-2","Asset Management",3,{"family":5,"item":78,"code":79,"title":80,"together":76},"800-155","SP 800-155","SP 800-155: BIOS Integrity Measurement Guidelines (Draft)",{"family":72,"item":82,"code":83,"title":84,"together":85},"pr-ip","PR.IP-12","Information Protection Processes and Procedures (CSF 1.1)",2,{"family":63,"item":87,"code":88,"title":89,"together":85},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":91,"item":92,"code":93,"title":94,"together":85},"nist-800-53","si-2","SI-2","Flaw Remediation"]