diff --git a/mappings/remediation_advice/remediation_advice.json b/mappings/remediation_advice/remediation_advice.json
index 059605a..db272cc 100644
--- a/mappings/remediation_advice/remediation_advice.json
+++ b/mappings/remediation_advice/remediation_advice.json
@@ -1144,6 +1144,7 @@
         "https://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection"
       ]
     },
+
     {
       "id": "insecure_os_firmware",
       "children": [
@@ -1165,7 +1166,77 @@
             "https://www.owasp.org/index.php/Password_Management:_Hardcoded_Password",
             "https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"
           ]
-        }
+        },
+        {
+          "id": "data_not_encrypted_at_rest",
+          "children": [
+            {
+              "id": "non_sensitive",
+              "remediation_advice": "Data within the device should be encrypted at rest, preventing the data from being viewable by a 3rd party attacker."
+            },
+            {
+              "id": "sensitive",
+              "remediation_advice": "Data within the device should be encrypted at rest, preventing the data from being viewable by a 3rd party attacker."
+            }
+          ]
+        },
+        {
+          "id": "failure_to_remove_sensitive_artifacts_from_disk",
+          "remediation_advice": "Implement robust deletion functions which not only reference to the data, but write over the existing data to prevent digital forensic methods of recovery"
+        },
+        {
+          "id": "hardcoded_password",
+          "remediation_advice": "1. Never use a hardcoded password within the source code. Many times, the application can be disassembled or decompiled after it has been compiled. This will likely reveal the hardcoded password string to an attacker.\n2. Never use a password string. Instead, use a random salt per user with the password string and run it through a cryptographically strong hashing algorithm.\n3. Store the salt and the hashed password server-side and do the check there. Never check the password on the client side.",
+          "references": [
+            "https://www.owasp.org/index.php/Password_Management:_Hardcoded_Password",
+            "https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"
+          ]
+        },
+        {
+          "id": "kiosk_escape",
+          "remediation_advice": "1. Implement vigirous QA testing of applications prior to deployment\n2. Implement robust error logging and catching within the application to prevent crashes\n3. Initiate application restarts in the event of a application crash.\n4. Use Lower Privleged accounts with minimal permissions to lower the impact of a potential kiosk escape"
+        },
+        {
+          "id": "local_administrator_on_default_environment",
+          "remediation_advice": "The usage of Local Administrator accounts on a device is usually not nessicary for the operation, especially with embedded hardware and kiosks. Use of Lower Privleged accounts with minimal permissions and Jails lowers the impact if access by an attacker is acheved."
+        },
+        {
+          "id": "overpermissioned_credentials_on_storage",
+          "remediation_advice": "When provisioning credentials, strict scoping of the credentials to the resources required to operate reduce the impact of an exposure of those credentials."
+        },
+        {
+          "id": "poorly_configured_disk_encryption",
+          "remediation_advice": "1. Use of standard cryptographic libraries reduces the likelyhood of implementation vulnerabilities\n2. Verify your bootloader and encryption systems are up to date to avoid public exploits."
+        },
+        {
+          "id": "poorly_configured_operating_system_security",
+          "remediation_advice": "Following standards such as the NIST or ASD hardening guide allows you to identify known configuration issues and apply configuration changes to prevent this from being exploited further."
+        },
+        {
+          "id": "recovery_of_disk_contains_sensitive_material",
+          "remediation_advice": "Implement robust deletion functions which not only reference to the data, but write over the existing data to prevent digital forensic methods of recovery."
+        },
+        {
+          "id": "shared_credentials_on_storage",
+          "remediation_advice": "Credentials for shared services should be avoided where possible, they allow for a single breach to be escalated to effect an entire organisation. When provisioning a service credential, they should be unique per device and strict scoped to the resources required to operate, to reduce the impact of an exposure of those credentials"
+        },
+        {
+          "id": "weakness_in_firmware_updates",
+          "children": [
+            {
+              "id": "firmware_cannot_be_updated",
+              "remediation_advice": "Implement the ability for the firmware to be upgraded on a device, including an automatic update policy, which will allow for the patch of future security issues on the device."
+            },
+            {
+              "id": "firmware_does_not_validate_update_integrity",
+              "remediation_advice": "Implementation of firmware integrity checking using cryptographic signitures of a certificate is considered best practice, allowing the integrity of the firmware updates to be validated by the device prior to patching."
+            },
+            {
+              "id": "firmware_is_not_encrypted",
+              "remediation_advice": "Implementation of encryption for firmware updates allows for the update data to be protected during transit, and increases the time taken to reverse engineer the firmware used, and future security patches."
+            }
+          ]
+        }                
       ]
     },
     {