Security requirement
- a.Identify, report, and correct system flaws.
- b.Install security-relevant software and firmware updates within [Organization-defined: time period] of the release of the updates.
Discussion
Organizations identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities that result from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address the flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources (e.g., CWE or CVE databases) when remediating system flaws. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors, including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types.
Tailoring decisions required
Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.
Implementation perspective
Treat Flaw Remediation as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to flaw remediation, malicious-code protection, monitoring, integrity, and trustworthy handling of CUI.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- patch and remediation records
- malware protection configuration
- monitoring alerts and response records
- integrity validation and exception reports
Common failure patterns
- patch compliance hiding unsupported assets
- alerts generated without response ownership
- exceptions that never expire
- integrity monitoring excluding critical configurations
Assessment objectives and methods
Assessment objectives (5)
- a.
system flaws are identified.
- a.
system flaws are reported.
- a.
system flaws are corrected.
- b.
security-relevant software updates are installed within [Organization-defined: time period] of the release of the updates.
- b.
security-relevant firmware updates are installed within [Organization-defined: time period] of the release of the updates.
Examine
- system and information integrity policy and procedures
- procedures for flaw remediation
- procedures for configuration management
- list of recent security flaw remediation actions performed on the system
- list of flaws and vulnerabilities that may potentially affect the system
- test results from the installation of software and firmware updates to correct system flaws
- installation and change control records for security-relevant software and firmware updates
- system security plan
- other relevant documents or records
Interview
- personnel responsible for installing, configuring, or maintaining the system
- personnel responsible for flaw remediation
- personnel with configuration management responsibilities
- personnel with information security responsibilities
- system administrators
Test
- processes for identifying, reporting, and correcting system flaws
- processes for installing software and firmware updates
- mechanisms for supporting or implementing the reporting and correction of system flaws
- mechanisms for supporting or implementing the testing software and firmware updates
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.