NIST 800-53 r5 · Controls catalogue · Family SI

SI-5Security Alerts, Advisories, and Directives

Receive system security alerts, advisories, and directives from {{ insert: param, si-05_odp.01 }} on an ongoing basis; Generate internal security alerts, advisories, and directives as deemed necessary; Disseminate security alerts, advisories, and directives to: {{ insert: param, si-05_odp.02 }} ; and Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.

Last updated: 20 August 2026 13:14 UTC

Implementations targeting this control (0)

No implementations targeting this control yet.

ATT&CK techniques this control mitigates (4)

T1068 Exploitation for Privilege Escalation Privilege Escalation
T1210 Exploitation of Remote Services Lateral Movement
T1211 Exploitation for Stealth Stealth
T1212 Exploitation for Credential Access Credential Access

Weaknesses this control addresses (4)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-798`	Use of Hard-coded Credentials	2,000+	Advisories about products containing hard-coded credentials allow organizations to apply mitigations or avoid affected components before exploitation.
`CWE-327`	Use of a Broken or Risky Cryptographic Algorithm	700+	Security alerts and directives routinely identify broken or risky cryptographic algorithms and require their replacement within defined time frames.
`CWE-693`	Protection Mechanism Failure	700+	Implementing issued security directives maintains the effectiveness of existing protection mechanisms against newly discovered bypasses or failures.
`CWE-1104`	Use of Unmaintained Third Party Components	26	Ongoing receipt and implementation of security advisories directly enables timely replacement or mitigation of unmaintained third-party components before known vulnerabilities are exploited.

Top CVEs where this control is the strongest mitigation

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.

Other controls in family SI

SI-1 SI-10 SI-11 SI-12 SI-13 SI-14 SI-15 SI-16 SI-17 SI-18 SI-19 SI-2 SI-20 SI-21 SI-22 SI-23 SI-3 SI-4 SI-6 SI-7 SI-8 SI-9