NIST 800-53 r5 · Controls catalogue · Family AU
AU-13Monitoring for Information Disclosure
Monitor {{ insert: param, au-13_odp.01 }} {{ insert: param, au-13_odp.02 }} for evidence of unauthorized disclosure of organizational information; and If an information disclosure is discovered: Notify {{ insert: param, au-13_odp.03 }} ; and Take the following additional actions: {{ insert: param, au-13_odp.04 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 3 mapping(s) from 1 framework(s): CSF 2.0 3 (mostly)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Monitoring directly detects unauthorized disclosure of sensitive information, enabling response to exposures. |
CWE-532 | Insertion of Sensitive Information into Log File | 1,427 | Identifies insertion of sensitive data into logs, allowing detection of unauthorized disclosure. |
CWE-209 | Generation of Error Message Containing Sensitive Information | 666 | Detects error messages that leak sensitive information as evidence of disclosure. |
CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | 93 | Monitors for sensitive information placed in externally accessible files or directories. |
CWE-548 | Exposure of Information Through Directory Listing | 57 | Detects information exposure through directory listings as unauthorized disclosure. |
CWE-1230 | Exposure of Sensitive Information Through Metadata | 25 | Identifies sensitive information exposed via metadata during disclosure monitoring. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-43451 KEV | 10.0 | 6.5 | 0.8182 | good |
CVE-2026-22038 | 5.5 | 8.1 | 0.0043 | good |
CVE-2026-25813 | 5.5 | 7.5 | 0.0026 | good |
CVE-2023-33145 | 3.5 | 6.5 | 0.0862 | good |
CVE-2023-21237 KEV | 10.0 | 5.5 | 0.0026 | good |
CVE-2019-0676 KEV | 10.0 | 6.5 | 0.0751 | good |
CVE-2016-3298 KEV | 10.0 | 6.5 | 0.3279 | partial |
CVE-2024-30043 | 8.0 | 6.5 | 0.5466 | good |
CVE-2025-24146 | 7.0 | 9.8 | 0.0080 | good |
CVE-2025-15480 | 7.0 | 9.1 | 0.0031 | good |
CVE-2022-0735 | 7.0 | 10.0 | 0.1323 | good |
CVE-2025-24071 | 6.0 | 6.5 | 0.2507 | good |
CVE-2023-35636 | 6.0 | 6.5 | 0.1756 | good |
CVE-2026-2262 | 5.5 | 7.5 | 0.0239 | partial |
CVE-2025-26001 | 5.5 | 7.5 | 0.0035 | good |
CVE-2024-34897 | 5.5 | 7.5 | 0.0037 | good |
CVE-2026-27934 | 5.5 | 7.5 | 0.0025 | good |
CVE-2026-5032 | 5.5 | 7.5 | 0.0096 | good |
CVE-2026-21532 | 5.5 | 8.2 | 0.0084 | good |
CVE-2026-27640 | 5.5 | 7.5 | 0.0030 | good |
CVE-2026-20649 | 5.5 | 7.5 | 0.0023 | good |
CVE-2025-49741 UPD | 5.5 | 7.4 | 0.0338 | good |
CVE-2024-32825 | 5.5 | 7.5 | 0.0202 | good |
CVE-2023-38272 | 3.5 | 5.9 | 0.0033 | good |
CVE-2026-5571 | 3.5 | 5.3 | 0.0047 | good |