Flaw Remediation SI-2
System and Information Integrity · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SI-2 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Information Integrity family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SI-2 (Flaw Remediation) requires you to identify, report, and correct system flaws — install security-relevant patches within a defined timeframe and, where practical, test them before deployment. It carries from Low into Moderate, where the status of updates is tracked.
What good looks like
- Identify newly disclosed flaws affecting your components.
- Install security-relevant updates within a defined time after release.
- Test updates for effectiveness and side effects before or during deployment where feasible.
- Automate patching where possible and track remediation status.
Framework mapping
- NIST CSF 2.0 — PR.PS-02 — Software is maintained, replaced, and removed commensurate with risk
- CIS Controls v8 — Control 7 — Continuous Vulnerability Management (patching)
How to move it toward Implemented
- SI-2 is met: the host was fully patched at build (
apt full-upgrade) and unattended-upgrades installs security updates automatically on an ongoing cadence. - Capture proof: an
unattended-upgrades --dry-runor the/var/log/unattended-upgrades/log plusapt list --upgradableshowing a clean state, saved as a dated file. - Attach that as hardening evidence naming SI-2 to reach 'Completed'.
- Optional strengthening: write down the patch timeframe so the 'install within a defined time' element is explicit rather than implied.