SC-51 has two requirements. Employ hardware based write protect for the firmware of the systems you name. Then implement specific procedures to manually disable that write protect for firmware changes and turn it back on before the system returns to operation.
NIST gives no extra guidance for this control. 800-53 binds federal systems and contractors, and is a reference for the rest.
What it means in practice
Firmware, such as BIOS or UEFI, should not be writable by software or malware during normal operation. A hardware switch or equivalent locks it. When an update is needed, a person follows a written procedure to unlock, update, and relock.
Evidence to collect
- The list of systems and firmware in scope.
- Vendor documentation showing the write protect feature.
- The procedure document and a ticket for the last firmware update showing the lock was restored.
Common gaps
No record that protection was re-enabled. Firmware updates done by anyone with admin rights.
How to implement it
Check what your hardware supports, write the unlock procedure, and require a ticket for every firmware change.
Quick check
What must happen after a firmware update?
Write protect is re-enabled before the system returns to operational mode.
