NIST 800-53 r5 · Controls catalogue · Family SI
SI-5Security Alerts, Advisories, and Directives
Receive system security alerts, advisories, and directives from {{ insert: param, si-05_odp.01 }} on an ongoing basis; Generate internal security alerts, advisories, and directives as deemed necessary; Disseminate security alerts, advisories, and directives to: {{ insert: param, si-05_odp.02 }} ; and Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 3 mapping(s) from 1 framework(s): CSF 2.0 3 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (4)
Weaknesses this control addresses (4)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-798 | Use of Hard-coded Credentials | 2,013 | Advisories about products containing hard-coded credentials allow organizations to apply mitigations or avoid affected components before exploitation. |
CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | 777 | Security alerts and directives routinely identify broken or risky cryptographic algorithms and require their replacement within defined time frames. |
CWE-693 | Protection Mechanism Failure | 613 | Implementing issued security directives maintains the effectiveness of existing protection mechanisms against newly discovered bypasses or failures. |
CWE-1104 | Use of Unmaintained Third Party Components | 21 | Ongoing receipt and implementation of security advisories directly enables timely replacement or mitigation of unmaintained third-party components before known vulnerabilities are exploited. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-21525 KEV | 10.0 | 6.2 | 0.0496 | partial |
CVE-2026-21513 KEV | 10.0 | 8.8 | 0.1538 | good |
CVE-2025-64446 KEV | 10.0 | 9.8 | 0.8918 | good |
CVE-2026-32202 KEV | 10.0 | 4.3 | 0.6410 | partial |
CVE-2025-24990 KEV | 10.0 | 7.8 | 0.0579 | good |
CVE-2025-32991 | 7.0 | 9.0 | 0.0034 | good |
CVE-2025-59707 | 7.0 | 9.8 | 0.0053 | good |
CVE-2025-59388 | 7.0 | 9.8 | 0.0047 | good |
CVE-2026-2761 UPD | 7.0 | 10.0 | 0.0040 | good |
CVE-2025-59245 | 7.0 | 9.8 | 0.0090 | good |
CVE-2026-4692 UPD | 7.0 | 10.0 | 0.0049 | good |
CVE-2026-6768 | 7.0 | 9.8 | 0.0029 | good |
CVE-2026-31436 | 7.0 | 9.8 | 0.0046 | partial |
CVE-2026-6771 | 7.0 | 9.8 | 0.0031 | partial |
CVE-2026-31448 | 7.0 | 9.4 | 0.0043 | good |
CVE-2026-4724 | 7.0 | 9.1 | 0.0032 | good |
CVE-2026-2764 UPD | 7.0 | 9.8 | 0.0047 | partial |
CVE-2026-2784 | 7.0 | 9.8 | 0.0043 | partial |
CVE-2026-0879 UPD | 7.0 | 9.8 | 0.0053 | partial |
CVE-2025-8031 UPD | 7.0 | 9.8 | 0.0043 | partial |
CVE-2025-13659 | 5.5 | 8.8 | 0.0162 | partial |
CVE-2025-1914 | 5.5 | 8.8 | 0.0038 | good |
CVE-2025-2787 | 5.5 | 8.8 | 0.0047 | good |
CVE-2026-5877 | 5.5 | 8.8 | 0.0030 | good |
CVE-2025-1011 | 5.5 | 8.8 | 0.0063 | partial |