What it covers. NIST guidelines for protecting platform firmware and critical data against unauthorised change, detecting corruption, and recovering to a known good state. They apply to firmware in servers, clients and components, extending earlier BIOS protection guidance.
In practice. Organisations favour hardware with authenticated firmware update mechanisms, a root of trust and secure boot, and enable these features. Firmware is included in vulnerability and patch management, and integrity is checked where tools allow. Evidence includes procurement requirements, configuration baselines with secure boot enabled and firmware update records.
Common gaps. Typical gaps are firmware left outside patching, features available but not enabled, and no recovery path if firmware is corrupted. Recovery mechanisms are also rarely tested, so organisations do not know whether a corrupted device could be restored without replacement.