SI-2(5)

Requirement

Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].

Discussion

Due to system integrity and availability concerns, organizations consider the methodology used to carry out automatic updates. Organizations balance the need to ensure that the updates are installed as soon as possible with the need to maintain configuration management and control with any mission or operational impacts that automatic updates might impose.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; mechanisms supporting flaw remediation and automatic software/firmware updates; system design documentation; system configuration settings and associated documentation; records of recent security-relevant software and firmware updates automatically installed to system components; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation].

Test

[SELECT FROM: Mechanisms implementing automatic software/firmware updates].

ID	Assessment Objectives
SI-02(05)	<SI-02(05)_ODP[01] security-relevant software and firmware updates> are installed automatically to <SI-02(05)_ODP[02] system components>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!