safemode.space
← All techniques
EX-0009.03
ST0004Execution
sub-technique

Known Vulnerability (COTS/FOSS)

Parent: EX-0009

Description

Using knowledge of the software composition on-board, the adversary maps components and versions to publicly or privately known defects and then crafts inputs to trigger them. Typical targets include standard libraries (libc, STL), cryptographic and compression libraries, protocol stacks (CCSDS implementations, IP over space links, SpaceWire bridges), filesystems and parsers (FITS/CCSDS packetization, custom table formats), and vendor SDKs for radios, sensors, or payloads. Triggers arrive as well-formed but malicious packets, frames, or files whose edge-case fields exercise version-specific bugs, overflowing a parser, bypassing an authentication check, or causing a kernel/driver fault that reboots into a more permissive mode. Because these flaws are documented somewhere, exploitation emphasizes matching the exact build and build-time options used on the mission.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(a)
    addresses
    high
    derived

    Known-vulnerability exploitation directly engages the (2)(a) obligation that products be available without known exploitable vulnerabilities.

  • craAnnex I, Part II, (1)
    addresses
    high
    derived

    Component identification (SBOM) is what gives the manufacturer the visibility needed to map known vulnerabilities to deployed products before adversaries do.

  • craAnnex I, Part II, (2)
    addresses
    high
    derived

    Address-and-remediate-without-delay is the temporal discipline that bounds the time-to-fix metric known-vulnerability exploitation tries to outrun.

  • craAnnex I, Part II, (5)
    addresses
    high
    direct

    Exploitation of public/disclosed vulnerabilities (primary mappings: Part II, (1)+(2)+(8) + Art. 13(6)+(8)) sits squarely in the CVD lifecycle; (5) supplements the entire cluster as the inbound counterpart to the outbound disclosure obligations already in primary.

  • craAnnex I, Part II, (8)
    addresses
    high
    derived

    Manufacturer obligation to disseminate security updates without delay closes the exploit window once remediation is available.

  • craArt. 13(6)
    addresses
    high
    derived

    Manufacturer-on-component vulnerability handling (including for open-source components) is the precise obligation engaged when known-CVE-class exploitation targets COTS/FOSS components.

  • craArt. 13(8)
    addresses
    moderate
    derived

    Security-updates throughout the support period ensure the long-tail discipline that closes recon-driven exploit windows for the lifetime of deployed products.

  • eu-space-actArt. 76(5)
    addresses
    moderate
    direct

    Known-vulnerability exposure (primary: Art. 78(1)) is the canonical ISMS-managed risk; CPE/CVE registers and treatment plans live in the ISMS per 76(5).

  • eu-space-actArt. 78(1)
    addresses
    high
    direct

    78(1)(c)'s identify-vulnerabilities obligation explicitly covers components and versions whose CPE/CVE mappings expose the spacecraft — the canonical use case for 78(1)(d) risk-treatment plans.

  • eu-space-actArt. 91(4)
    addresses
    moderate
    direct

    91(4)'s address-the-root-causes-of-incidents obligation requires operators to remediate the underlying COTS/FOSS vulnerabilities exploited in known-vuln incidents.

  • eu-space-actArt. 92(1)
    addresses
    moderate
    direct

    COTS/FOSS components arrive via supply-chain pathways; 92(1)'s contractual information-security obligation governs how supplier-provided components and FOSS dependencies are tracked and remediated.

  • nis2Art. 21(2)(d)
    addresses
    high
    direct

    Standard libraries, crypto/compression libraries, protocol stacks, FITS/CCSDS parsers, and vendor SDKs ride supplier and service-provider relationships; Art. 21(2)(d)'s supplier-relationship security obligation governs the trust framework around those COTS/FOSS components.

  • nis2Art. 21(2)(e)
    addresses
    high
    direct

    Vulnerability handling and disclosure under Art. 21(2)(e) is the precise obligation that requires the entity to track CPE/CVE matches against components on-board, monitor vendor advisories, and close the disclosure-to-patch lag the technique exploits.

  • nis2Art. 21(3)
    addresses
    moderate
    direct

    Patch cadence, advisory quality, and vulnerability-disclosure practice vary dramatically by COTS/FOSS supplier; Art. 21(3) requires the entity to take those supplier-specific vulnerabilities into account when sizing its component reliance.

  • nis2-implAnnex 12.4.1
    addresses
    moderate
    derived

    Asset-inventory obligations require maintenance of accurate, up-to-date software-component inventories; without them the entity cannot match known vulnerabilities to its installed COTS/FOSS surface.

  • nis2-implAnnex 5.1.1
    addresses
    moderate
    derived

    COTS/FOSS suppliers (foundations, vendors) are direct suppliers under the supply-chain policy; their disclosure and security-quality posture shape the known-vulnerability surface the entity inherits.

  • nis2-implAnnex 6.10.1
    addresses
    high
    direct

    Known-vulnerability exploitation is precisely the threat the vulnerability-handling-and-disclosure obligation is established to bound: the entity must monitor public/private vulnerability sources for the COTS/FOSS components in its inventory and remediate before the adversary's recon-to-exploit window closes against it.

  • nis2-implAnnex 6.6.1
    addresses
    high
    derived

    Security-patch management procedures determine the cadence at which known vulnerabilities in COTS/FOSS components are closed, the metric the technique attempts to outrun.

ENISA controls

  • ENISA-STL-2025-03-sD.25-i02
    addresses
    high

    Vulnerability management is the canonical operator-side defense against publicly known defects in COTS/FOSS components — the literal subject of EX-0009.03.

  • ENISA-STL-2025-03-sD.25-i06
    mitigates
    high

    Software updates that incorporate security-relevant fixes close the matched-build/known-CVE windows EX-0009.03 exploits.

  • ENISA-STL-2025-03-sD.28-i02
    addresses
    moderate

    Adequate protection of deployed COTS and open-source version numbers hinders the cross-referencing to public CVE repositories EX-0009.03 relies on and is relevant, but it is an obscurity measure that does not actively prevent exploitation of a known defect, so addresses rather than mitigates.

  • ENISA-STL-2025-03-sD.28-i03
    addresses
    high

    SBOM cross-correlated with known vulnerabilities is the named control that surfaces the precise component-version defects EX-0009.03 targets.

Cross-reference controls

  • csf-2-0DE.AE-02Potentially adverse events are analyzed to better understand associated activities
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0009.03 against CA-7 Continuous Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.AE-02. Through SPARTA: SPARTA's catalog maps EX-0009.03 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.AE-02. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

  • csf-2-0DE.AE-03Information is correlated from multiple sources
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0009.03 against CA-7 Continuous Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.AE-03. Through SPARTA: SPARTA's catalog maps EX-0009.03 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.AE-03. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

  • csf-2-0DE.CM-01Networks and network services are monitored to find potentially adverse events
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0009.03 against CA-7 Continuous Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-01. Through SPARTA: SPARTA's catalog maps EX-0009.03 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

  • csf-2-0DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0009.03 against CA-7 Continuous Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0009.03 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • csf-2-0ID.RA-01Vulnerabilities in assets are identified, validated, and recorded
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0009.03 against CA-7 Continuous Monitoring, and CSF 2.0's own crosswalk names that control as an informative reference for ID.RA-01. Through SPARTA: SPARTA's catalog maps EX-0009.03 to countermeasure CM0008 Security Testing Results; CM0011 Vulnerability Scanning; CM0012 Software Bill of Materials, and that countermeasure's own CSF references include ID.RA-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

  • d3fendD3-MBTMemory Boundary Tracking
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Memory Boundary Tracking counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Call-stack return-address checking is a compile-and-runtime property of the software, so it applies to flight software built with the same protections. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-PCSVProcess Code Segment Verification
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Process Code Segment Verification counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Comparing the executing code segment against a known-good source is the on-board image-verification check as much as a ground endpoint control. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-PSEPProcess Segment Execution Prevention
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Process Segment Execution Prevention counters T1190 Exploit Public-Facing Application; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Marking non-code memory non-executable is a processor feature available on flight hardware, so the control applies on-board. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SAORSegment Address Offset Randomization
    addresses
    low

    Derived by composition, not from a source that names this pair. D3FEND publishes that Segment Address Offset Randomization counters T1190 Exploit Public-Facing Application; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Address-space randomisation is a software build property, though deterministic real-time flight builds often forgo it; the transfer is real but weaker than the other memory-safety controls. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SFCVStack Frame Canary Validation
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Stack Frame Canary Validation counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Stack canaries are a compile-time property of the software, so they apply to flight software built with the same protections. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SSCShadow Stack Comparisons
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Shadow Stack Comparisons counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Shadow-stack comparison is a processor and toolchain feature, so it applies to flight software on hardware that supports it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • mitre-attack-enterpriseT1072Software Deployment Tools
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1190Exploit Public-Facing Application
    addresses
    moderate

    When the COTS/FOSS vulnerability resides in a network-facing service (e.g., a CCSDS-over-IP gateway, telemetry forwarder, or web-based ground tool), the exploitation also matches T1190 'Exploit Public-Facing Application'; cross-tactic moderate (initial-access vs execution).

  • mitre-attack-enterpriseT1203Exploitation for Client Execution
    addresses
    high

    Exploiting known CVEs in COTS/FOSS components used in flight or ground software is exactly the T1203 pattern — leveraging documented vulnerabilities to achieve execution. Tactic and activity align directly.

  • mitre-attack-icsT0890Exploitation for Privilege Escalation
    addresses
    moderate

    Exploiting known CVEs in COTS/FOSS components is the same activity as T0890 'Exploitation for Privilege Escalation' — leveraging documented vulnerabilities. Cross-tactic moderate (priv-esc vs execution).

  • nasa-bpgMI-SOFT-01Software Mission Assurance Function
    addresses
    moderate

    A known defect in a COTS or FOSS component is closed by patching and component inventory, not by assurance of mission-developed code. The practice governs the mission's knowledge of its composition without interdicting the technique.

  • nist-80053-rev5AC-2Account Management
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(11)Restrict Access to Specific Information Types
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(13)Attribute-based Access Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(15)Discretionary and Mandatory Access Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-4(2)Processing Domains
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-6Least Privilege
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-14Session Audit
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-2Event Logging
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3Content of Audit Records
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3(1)Additional Audit Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4Audit Log Storage Capacity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4(1)Transfer to Alternate Storage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5Response to Audit Logging Process Failures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(2)Real-time Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(5)Alternate Audit Logging Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(1)Automated Process Integration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(4)Central Review and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-8Time Stamps
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9Protection of Audit Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(2)Store on Separate Physical Systems or Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(3)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-3(6)Transfer Authorizations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-7Continuous Monitoring
    addresses
    moderate

    CA-7 (Continuous Monitoring) addresses ongoing visibility into the vulnerability state of fielded COTS/FOSS components.

  • nist-80053-rev5CA-7(6)Automation Support for Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-8(1)Independent Penetration Testing Agent or Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-10Software Usage Restrictions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-10(1)Open-source Software
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11User-installed Software
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11(3)Automated Enforcement and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-2Baseline Configuration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(2)Testing, Validation, and Documentation of Changes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(7)Review System Changes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3(8)Prevent or Restrict Configuration Changes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-4Impact Analyses
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-4(1)Separate Test Environments
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-5(6)Limit Library Privileges
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7Least Functionality
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(4)Unauthorized Software — Deny-by-exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(5)Authorized Software — Allow-by-exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-7(8)Binary or Machine Executable Code
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-8System Component Inventory
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-8(7)Centralized Repository
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10System Recovery and Reconstitution
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10(4)Restore Within Time Period
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-12Safe Mode
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-2Contingency Plan
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-2(5)Continue Mission and Business Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-4Contingency Plan Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3Incident Response Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(1)Automated Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-3(2)Coordination with Related Plans
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4Incident Handling
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(11)Integrated Incident Response Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(12)Malicious Code and Forensic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(14)Security Operations Center
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(3)Continuity of Operations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(5)Automatic Disabling of System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5Incident Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5(1)Automated Tracking, Data Collection, and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-6(2)Vulnerabilities Related to Incidents
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PE-10Emergency Shutoff
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8Security and Privacy Architectures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(1)Defense in Depth
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PM-16Threat Awareness Program
    addresses
    moderate

    PM-16 addresses awareness of public/private vulnerability sources adversaries mine for exploit catalogs.

  • nist-80053-rev5PM-5System Inventory
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-10Threat Hunting
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3Risk Assessment
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(4)Predictive Cyber Analytics
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-5Vulnerability Monitoring and Scanning
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-5(11)Public Disclosure Program
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-5(3)Breadth and Depth of Coverage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-7Risk Response
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(2)Alternative Configuration Management Processes
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(4)Trusted Generation
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11Developer Testing and Evaluation
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(3)Independent Verification of Assessment Plans and Evidence
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11(5)Penetration Testing
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-15(7)Automated Vulnerability Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-17(7)Structure for Least Privilege
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-3System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(5)System, Component, and Service Configurations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(9)Functions, Ports, Protocols, and Services in Use
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-5System Documentation
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8Security and Privacy Engineering Principles
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(10)Hierarchical Trust
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(12)Hierarchical Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(13)Minimized Security Elements
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(14)Least Privilege
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(15)Predicate Permission
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(19)Continuous Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(21)Self-analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(22)Accountability and Traceability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(23)Secure Defaults
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(24)Secure Failure and Recovery
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(26)Performance Security
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(29)Repeatable and Documented Procedures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(3)Modularity and Layering
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(30)Procedural Rigor
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(31)Secure System Modification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(4)Partially Ordered Dependencies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(7)Reduced Complexity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(8)Secure Evolvability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(9)Trusted Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9External System Services
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(2)Anti-spoofing Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-2(2)Disassociability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-24Fail in Known State
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-32(1)Separate Physical Domains for Privileged Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-49Hardware-enforced Separation and Policy Enforcement
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5Denial-of-service Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5(3)Detection and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-50Software-enforced Separation and Policy Enforcement
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(10)Prevent Exfiltration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(29)Separate Subnets to Isolate Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(9)Restrict Threatening Outgoing Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(6)Injection Prevention
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-11Error Handling
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-16Memory Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-17Fail-safe Procedures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-2Flaw Remediation
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-2(2)Automated Flaw Remediation Status
    addresses
    moderate

    SI-2(2) (Automated Flaw Remediation Status) mitigates EX-0009.03 by tracking remediation state of known CVEs.

  • nist-80053-rev5SI-2(6)Removal of Previous Versions of Software and Firmware
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3Malicious Code Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(10)Malicious Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(8)Detect Unauthorized Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4System Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(1)System-wide Intrusion Detection System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(10)Visibility of Encrypted Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(11)Analyze Communications Traffic Anomalies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(13)Analyze Traffic and Event Patterns
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(16)Correlate Monitoring Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(17)Integrated Situational Awareness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(2)Automated Tools and Mechanisms for Real-time Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(23)Host-based Devices
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(24)Indicators of Compromise
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(25)Optimize Network Traffic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(4)Inbound and Outbound Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(5)System-generated Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(7)Automated Response to Suspicious Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-6Security and Privacy Function Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7Software, Firmware, and Information Integrity
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(17)Runtime Application Self-protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(5)Automated Response to Integrity Violations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(8)Auditing Capability for Significant Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • space-shieldT2007.006Software vulnerabilities
    addresses
    high

    T2007.006 'Software vulnerabilities' is the direct cross-framework counterpart of EX-0009.03 — both describe matching component versions to publicly/privately known defects in COTS/FOSS components.

SPARTA countermeasures

Cite as SafeMode Space, EX-0009.03 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.