SI-2 Flaw Remediation

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	6 (1 in a baseline)

Related controls: CA-5, CM-3, CM-4, CM-5, CM-6, CM-8, MA-2, RA-5, SA-8, SA-10, SA-11, SI-3, SI-5, SI-7, SI-11

Control statement

• a. Identify, report, and correct system flaws;
• b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
• c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and
• d. Incorporate flaw remediation into the organizational configuration management process.

NIST discussion

The need to remediate system flaws applies to all types of software and firmware. Organizations identify systems affected by software flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated organizational personnel with information security and privacy responsibilities. Organizations consider establishing a controlled patching environment for mission-critical systems. Security-relevant updates include patches, service packs, and malicious code signatures. Organizations also address flaws discovered during assessments, continuous monitoring, incident response activities, and system error handling. By incorporating flaw remediation into configuration management processes, required remediation actions can be tracked and verified.

Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of risk factors, including the security category of the system, the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw), the organizational risk tolerance, the mission supported by the system, or the threat environment. Some types of flaw remediation may require more testing than other types. Organizations determine the type of testing needed for the specific type of flaw remediation activity under consideration and the types of changes that are to be configuration-managed. Flaw remediation testing addresses both effectiveness of addressing security issues and for potential side effects on functionality, system and system component performance and operations. When implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). In some situations, organizations may determine that the testing of software or firmware updates is not necessary or practical, such as when implementing simple malicious code signature updates. In testing decisions, organizations consider whether security-relevant software or firmware updates are obtained from authorized sources with appropriate digital signatures.

When implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). Organizations verify that software and firmware updates come from authorized sources prior to downloading.

Control enhancements

SI-2(2) Automated Flaw Remediation Status

Baselines: Moderate, High

Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].

Discussion and assessment objectives for SI-2(2)

Automated mechanisms can track and determine the status of known flaws for system components.

Determine if system components have applicable security-relevant software and firmware updates installed [Assignment: organization-defined frequency] using [Assignment: organization-defined automated mechanisms].

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; automated mechanisms supporting centralized management of flaw remediation; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation.

Test: Automated mechanisms used to determine the state of system components with regard to flaw remediation.

SI-2(3) Time to Remediate Flaws and Benchmarks for Corrective Actions

Baselines: Not in a baseline

• (a) Measure the time between flaw identification and flaw remediation; and
• (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined benchmarks].

Discussion and assessment objectives for SI-2(3)

Organizations determine the time it takes on average to correct system flaws after such flaws have been identified and subsequently establish organizational benchmarks (i.e., time frames) for taking corrective actions. Benchmarks can be established by the type of flaw or the severity of the potential vulnerability if the flaw can be exploited.

Determine if:

• SI-02(03)(a) the time between flaw identification and flaw remediation is measured;
• SI-02(03)(b) [Assignment: organization-defined benchmarks] for taking corrective actions have been established.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; system design documentation; system configuration settings and associated documentation; list of benchmarks for taking corrective action on identified flaws; records that provide timestamps of flaw identification and subsequent flaw remediation activities; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation.

Test: Organizational processes for identifying, reporting, and correcting system flaws; mechanisms used to measure the time between flaw identification and flaw remediation.

SI-2(4) Automated Patch Management Tools

Baselines: Not in a baseline

Employ automated patch management tools to facilitate flaw remediation to the following system components: [Assignment: organization-defined components].

Discussion and assessment objectives for SI-2(4)

Using automated tools to support patch management helps to ensure the timeliness and completeness of system patching operations.

Determine if automated patch management tools are employed to facilitate flaw remediation to [Assignment: organization-defined components].

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; mechanisms supporting flaw remediation and automatic software/firmware updates; system design documentation; system configuration settings and associated documentation; list of system flaws; records of recent security-relevant software and firmware updates that are automatically installed to system components; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation.

Test: Automated patch management tools; mechanisms implementing automatic software/firmware updates; mechanisms facilitating flaw remediation to system components.

SI-2(5) Automatic Software and Firmware Updates

Baselines: Not in a baseline

Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].

Discussion and assessment objectives for SI-2(5)

Due to system integrity and availability concerns, organizations consider the methodology used to carry out automatic updates. Organizations balance the need to ensure that the updates are installed as soon as possible with the need to maintain configuration management and control with any mission or operational impacts that automatic updates might impose (i.e., implementing a staggered deployment strategy).

Determine if [Assignment: organization-defined security-relevant software and firmware updates] are installed automatically to [Assignment: organization-defined system components].

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; mechanisms supporting flaw remediation and automatic software/firmware updates; system design documentation; system configuration settings and associated documentation; records of recent security-relevant software and firmware updates automatically installed to system components; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation.

Test: Mechanisms implementing automatic software/firmware updates.

SI-2(6) Removal of Previous Versions of Software and Firmware

Baselines: Not in a baseline

Remove previous versions of [Assignment: organization-defined software and firmware components] after updated versions have been installed.

Discussion and assessment objectives for SI-2(6)

Previous versions of software or firmware components that are not removed from the system after updates have been installed may be exploited by adversaries. Some products may automatically remove previous versions of software and firmware from the system.

Determine if previous versions of [Assignment: organization-defined software and firmware components] are removed after updated versions have been installed.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; mechanisms supporting flaw remediation; system design documentation; system configuration settings and associated documentation; records of software and firmware component removals after updated versions are installed; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation.

Test: Mechanisms supporting and/or implementing the removal of previous versions of software/firmware.

SI-2(7) Root Cause Analysis

Baselines: Not in a baseline

• a. Conduct root cause analysis to identify underlying causes of issues or failures.
• b. Develop actions to address the root cause of the issue or failure.
• c. Implement the actions and monitor the implementation for effectiveness.

Discussion and assessment objectives for SI-2(7)

Root cause analysis includes a wide range of approaches, tools, and techniques to systematically identify the underlying cause of issues or failures to systems and systems components (hardware, software, and firmware). Organizations consider the severity of the incident to determine what root cause analysis method is used and how quickly implementation of the remediation actions. The root cause analysis includes a timeline, missed warning signs, key decisions, gaps, mitigations, and verification of effectiveness. The actions identified to address the source of the issue are implemented and integrated into applicable organizational policy, procedures, and control implementation.

Determine if Determine if:

• SI-02(07)a. Root cause analysis is conducted to identify underlying causes of issues or failures
• SI-02(07)b. Actions to address the root cause of the issue of failure are developed
• SI-02(07)c.
  • The actions (defined in SI-02(07)b.) are implemented
  • The implementation of actions is monitored for effectiveness.

Examine: System and information integrity policy;; system and information integrity procedures;; procedures addressing flaw remediation;; procedures addressing root cause analysis/process improvement;; system design documentation;; system configuration settings and associated documentation;; system audit records;; system security and privacy plan;; other relevant documents or records.

Interview: System/network administrators;; organizational personnel with information security and privacy responsibilities;; organizational personnel responsible for installing, configuring, and/or maintaining the system;; organizational personnel responsible for flaw remediation;; organizational personnel with configuration management responsibilities.

Test: Organizational processes for identifying, reporting, and correcting system flaws;; organizational process for installing software and firmware updates;; mechanisms supporting and/or implementing the reporting and correcting of system flaws;; mechanisms supporting and/or implementing testing software and firmware updates.

Withdrawn enhancements: SI-2(1).

Assessment objectives (SP 800-53A)

Objectives and methods for SI-2

Determine if:

• SI-02a.
  • SI-02a.[01] system flaws are identified;
  • SI-02a.[02] system flaws are reported;
  • SI-02a.[03] system flaws are corrected;
• SI-02b.
  • SI-02b.[01] software updates related to flaw remediation are tested for effectiveness before installation;
  • SI-02b.[02] software updates related to flaw remediation are tested for potential side effects before installation;
  • SI-02b.[03] firmware updates related to flaw remediation are tested for effectiveness before installation;
  • SI-02b.[04] firmware updates related to flaw remediation are tested for potential side effects before installation;
• SI-02c.
  • SI-02c.[01] security-relevant software updates are installed within [Assignment: organization-defined time period] of the release of the updates;
  • SI-02c.[02] security-relevant firmware updates are installed within [Assignment: organization-defined time period] of the release of the updates;
• SI-02d. flaw remediation is incorporated into the organizational configuration management process.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; procedures addressing configuration management; list of flaws and vulnerabilities potentially affecting the system; list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws); test results from the installation of software and firmware updates to correct system flaws; installation/change control records for security-relevant software and firmware updates; system security plan; privacy plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security and privacy responsibilities; organizational personnel responsible for installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation; organizational personnel with configuration management responsibilities.

Test: Organizational processes for identifying, reporting, and correcting system flaws; organizational process for installing software and firmware updates; mechanisms supporting and/or implementing the reporting and correcting of system flaws; mechanisms supporting and/or implementing testing software and firmware updates.

Policy statement

• The System owner shall identify system flaws from vulnerability scanning and monitoring, vendor security advisories, assessments and incident analysis. (SI-2a)
• The System owner shall report identified flaws that affect the system to the Security operations team and record each in the system’s flaw tracking. (SI-2a)
• The System owner shall correct identified system flaws. (SI-2a)
• The System owner shall test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installing them in production. (SI-2b)
• The System owner shall install security-relevant software and firmware updates within Fill in: time period within which to install security-relevant software updates after the release of the updates Typical: known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days of the release of the updates. (SI-2c)
• The System owner shall enter any security-relevant update that cannot be installed in time in the system’s plan of action and milestones, with a planned date and any compensating measures, before its installation time ends. (SI-2c)
• The System owner shall incorporate flaw remediation into the organization’s configuration management process, recording routine updates as standard changes and urgent updates as emergency changes. (SI-2d)

Federal systems

CISA BOD 26-04, Prioritizing Security Updates Based on Risk (June 10, 2026), sets remediation deadlines for federal civilian agencies by whether an asset is publicly exposed, whether the vulnerability is in CISA’s Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated, and its technical impact, from 3 days to “fix on system upgrade”. Its clock starts when CISA adds a vulnerability to the KEV catalog or the agency identifies it, whichever is first. It revoked BOD 22-01 and BOD 19-02. It does not apply to national security systems. As of September 2026.

• The System owner shall set the SI-2c installation times no longer than the deadlines CISA BOD 26-04 sets, and install security updates within those deadlines. (SI-2c)

SI-2(2) Automated flaw remediation status

• The System owner shall determine whether system components have applicable security-relevant software and firmware updates installed, using Fill in: automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components Typical: the patch management and vulnerability scanning tools, Fill in: the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components Typical: at least weekly. (SI-2(2))

Federal systems

CISA BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks (October 3, 2022), requires federal civilian agencies to perform automated asset discovery every 7 days and to initiate vulnerability enumeration across all discovered assets, including roaming devices such as laptops, every 14 days. As of September 2026.

• The System owner shall ensure the system’s assets are covered by automated asset discovery at least every 7 days and by vulnerability enumeration at least every 14 days, as CISA BOD 23-01 requires. (SI-2(2))

From the System and Information Integrity Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SI-2 asks you to find, report and fix flaws, test fixes before installing them, install security updates within set times, and run patching through configuration management. It pairs with RA-5: scanning finds the flaws, and SI-2 is the process that fixes them.

Common implementations. Patch management tools for operating systems and third-party software (for example Microsoft Intune, Configuration Manager, WSUS, or Linux package management through Ansible), with a test group that gets updates before production. Container images and infrastructure rebuilt from patched base images instead of patched in place. Vendor security advisories monitored for appliances and applications that the patch tools do not cover. Emergency changes for actively exploited flaws, and standard or pre-approved changes for routine monthly patching, recorded under CM-3.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Time to install security updates (c)	Known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days, from the update’s release
Automated mechanisms to check update status (SI-2(2))	The patch management and vulnerability scanning tools
How often to check update status (SI-2(2))	At least weekly

Evidence assessors ask for.

• The flaw remediation or patch management procedure, with installation times (the Patch and Flaw Remediation Standard is a starting point)
• Patch compliance reports by component
• Test records for a sample of updates
• Change records for recent patching
• A sample of vendor advisories with the date each update was installed

Inheritance. Enterprise patch management tools and operating system patching are often common controls. The system owns patching of its applications, middleware, containers and appliances.

Common findings.

• Patching measured for operating systems only, with applications and appliances left out.
• Unsupported software or firmware with no fixes available and no POA&M item.
• Remediation times in the procedure that differ from those in the policy or the scanner’s reports.
• Servers excluded from patching “temporarily” for months.

Enhancements in the Moderate baseline. SI-2(2) automated flaw remediation status, also in High.

Federal systems (as of September 2026). CISA BOD 26-04, Prioritizing Security Updates Based on Risk (June 10, 2026), sets deadlines for federal civilian agencies by exposure, KEV status, whether exploitation can be automated and technical impact, from 3 days to “fix on system upgrade”. It replaced BOD 22-01. Set the SI-2c value no weaker than its deadlines.

Artifacts

• Patch and Flaw Remediation Standard
• System and Information Integrity Decision Worksheet
• System and Information Integrity Policy