💼 SI-2 Flaw Remediation

• Contextual name: 💼 SI-2 Flaw Remediation
• ID: /frameworks/nist-sp-800-53-r5/si/02
• Located in: 💼 SI System And Information Integrity

Description

a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and d. Incorporate flaw remediation into the organizational configuration management process.

Similar

• Sections
  • /frameworks/aws-fsbp-v1.0.0/auto-scaling/01
  • /frameworks/aws-fsbp-v1.0.0/dms/06
  • /frameworks/aws-fsbp-v1.0.0/ecs/10
  • /frameworks/aws-fsbp-v1.0.0/ecs/12
  • /frameworks/aws-fsbp-v1.0.0/eks/02
  • /frameworks/aws-fsbp-v1.0.0/elastic-beanstalk/01
  • /frameworks/aws-fsbp-v1.0.0/elastic-beanstalk/02
  • /frameworks/aws-fsbp-v1.0.0/elasticache/02
  • /frameworks/aws-fsbp-v1.0.0/lambda/02
  • /frameworks/aws-fsbp-v1.0.0/mq/03
  • /frameworks/aws-fsbp-v1.0.0/opensearch/10
  • /frameworks/aws-fsbp-v1.0.0/rds/06
  • /frameworks/aws-fsbp-v1.0.0/rds/13
  • /frameworks/aws-fsbp-v1.0.0/rds/19
  • /frameworks/aws-fsbp-v1.0.0/rds/20
  • /frameworks/aws-fsbp-v1.0.0/rds/21
  • /frameworks/aws-fsbp-v1.0.0/rds/22
  • /frameworks/aws-fsbp-v1.0.0/rds/35
  • /frameworks/aws-fsbp-v1.0.0/redshift/06
  • /frameworks/aws-fsbp-v1.0.0/ssm/02
• Internal
  • ID: dec-c-92a003c3

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DMS.6] DMS replication instances should have automatic minor version upgrade enabled		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.10] ECS Fargate services should run on the latest Fargate platform version
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.12] ECS clusters should use Container Insights
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EKS.2] EKS clusters should run on a supported Kubernetes version
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Lambda.2] Lambda functions should use supported runtimes
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.10] OpenSearch domains should have the latest software update installed
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.6] Enhanced monitoring should be configured for RDS DB instances
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.13] RDS automatic minor version upgrades should be enabled		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.19] Existing RDS event notification subscriptions should be configured for critical cluster events
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.20] Existing RDS event notification subscriptions should be configured for critical database instance events
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.21] An RDS event notifications subscription should be configured for critical database parameter group events
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.22] An RDS event notifications subscription should be configured for critical database security group events
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.35] RDS DB clusters should have automatic minor version upgrade enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.6] Amazon Redshift should have automatic upgrades to major versions enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP High Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)	2	7	10
💼 FedRAMP Low Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)			10
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations			20
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties			33
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities			34

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 SI-2(1) Flaw Remediation _ Central Management
💼 SI-2(2) Flaw Remediation _ Automated Flaw Remediation Status		1	2
💼 SI-2(3) Flaw Remediation _ Time to Remediate Flaws and Benchmarks for Corrective Actions
💼 SI-2(4) Flaw Remediation _ Automated Patch Management Tools			2
💼 SI-2(5) Flaw Remediation _ Automatic Software and Firmware Updates		2	2
💼 SI-2(6) Flaw Remediation _ Removal of Previous Versions of Software and Firmware		6	6

Policies (3)

Policy	Logic Count	Flags
📝 AWS DMS Replication Instance Auto Minor Version Upgrade is not enabled 🟢	1	🟢 x6
📝 AWS EC2 Auto Scaling Group behind ELB doesn't use ELB health check 🟢	1	🟢 x6
📝 AWS RDS Instance Auto Minor Version Upgrade is not enabled 🟠🟢	1	🟠 x1, 🟢 x6