NIST SP 800-53 SI-5 Security Alerts, Advisories, and Directives

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

The Cybersecurity and Infrastructure Security Agency (CISA) generates security alerts and advisories to maintain situational awareness throughout the Federal Government. Security directives are issued by OMB or other designated organizations with the responsibility and authority to issue such directives. Compliance with security directives is essential due to the critical nature of many of these directives and the potential (immediate) adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner. External organizations include supply chain partners, external mission or business partners, external service providers, and other peer or supporting organizations.

Enhancements NIST SOURCE

SI-5(1) Automated Alerts and Advisories LOW MODERATE ✓ HIGH

Broadcast security alert and advisory information throughout the organization using [automated mechanisms].

Discussion

The significant number of changes to organizational systems and environments of operation requires the dissemination of security-related information to a variety of organizational entities that have a direct interest in the success of organizational mission and business functions. Based on information provided by security alerts and advisories, changes may be required at one or more of the three levels related to the management of risk, including the governance level, mission and business process level, and the information system level.

Open full page for SI-5(1) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for SI-5 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

external organizations from whom system security alerts, advisories, and directives are to be received on an ongoing basis are defined;
one or more of the following PARAMETER VALUES is/are selected: { <SI-05_ODP[03] personnel or roles>; <SI-05_ODP[04] elements>; <SI-05_ODP[05] external organizations>};
personnel or roles to whom security alerts, advisories, and directives are to be disseminated is/are defined (if selected);
elements within the organization to whom security alerts, advisories, and directives are to be disseminated are defined (if selected);
external organizations to whom security alerts, advisories, and directives are to be disseminated are defined (if selected);
system security alerts, advisories, and directives are received from <SI-05_ODP[01] external organizations> on an ongoing basis;
internal security alerts, advisories, and directives are generated as deemed necessary;
security alerts, advisories, and directives are disseminated to <SI-05_ODP[02] SELECTED PARAMETER VALUES>;
security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance.

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing security alerts, advisories, and directives; records of security alerts and advisories; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with security alert and advisory responsibilities; organizational personnel implementing, operating, maintaining, and using the system; organizational personnel, organizational elements, and/or external organizations to whom alerts, advisories, and directives are to be disseminated; system/network administrators; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for defining, receiving, generating, disseminating, and complying with security alerts, advisories, and directives; mechanisms supporting and/or implementing the definition, receipt, generation, and dissemination of security alerts, advisories, and directives; mechanisms supporting and/or implementing security directives].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Base control: Included (matches standard baseline)

MODERATE

Base control: Included (matches standard baseline)

HIGH

Base control: Included (matches standard baseline)
Included: (1)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for SI-5. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

System and information integrity policy
system security plan

Testing

Organizational processes for defining, receiving, generating, disseminating, and complying with security alerts, advisories, and directives
mechanisms supporting and/or implementing the definition, receipt, generation, and dissemination of security alerts, advisories, and directives
mechanisms supporting and/or implementing security directives

Other Records

system and information integrity procedures
procedures addressing security alerts, advisories, and directives
records of security alerts and advisories
other relevant documents or records