how to simplify: Control 3: SI-5 - Security Alerts and Advisories a. SI-5 requires organizations to receive, analyze, and act upon external security alerts and advisories from trusted sources, such as CISA and US-CERT. b. Despite receiving a US-CERT advisory about the Apache Struts vulnerability, Equifax did not follow through with effective patch deployment across all affected systems. c. SI-5 implementation would have ensured that advisories were logged, assessed for impact, assigned to responsible personnel, and verified upon completion. This structured approach to handling advisories could have driven timely remediation and reduced risk exposure