NIST 800-53 r5 · Controls catalogue · Family AT
AT-5Contacts with Security Groups and Associations
Contacts with Security Groups and Associations
Last updated: 20 August 2026 13:14 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (5)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | 700+ | Contacts with security groups provide timely information on broken or risky cryptographic algorithms, reducing the likelihood of their selection and use. |
CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | 200+ | Security associations share details on cryptographically weak PRNGs, helping avoid their implementation in security-critical functions. |
CWE-916 | Use of Password Hash With Insufficient Computational Effort | 100+ | Information from security contacts highlights password hashing methods with insufficient computational effort, preventing their adoption. |
CWE-1104 | Use of Unmaintained Third Party Components | 26 | Security groups frequently discuss maintenance status of third-party components, aiding identification and avoidance of unmaintained ones. |
CWE-759 | Use of a One-Way Hash without a Salt | 19 | Security associations provide guidance on proper one-way hash usage including salting, reducing the chance of unsalted implementations. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||