diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 1c0ffacf41..e0aac55457 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -49,6 +49,12 @@ tags:
     a permission of a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
+  cis20:
+  - CIS 8
+  - CIS 13
+  nist:
+  - PR.DS
+  - PR.IP
   observable:
   - name: dest_device_id
     type: Hostname
@@ -69,4 +75,5 @@ tags:
   - dest_user_id
   - process
   risk_score: 35
+  risk_severity: medium
   security_domain: endpoint