NIST 800-53 r5 · Controls catalogue · Family CA
CA-9Internal System Connections
Authorize internal connections of {{ insert: param, ca-09_odp.01 }} to the system; Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated; Terminate internal system connections after {{ insert: param, ca-09_odp.02 }} ; and Review {{ insert: param, ca-09_odp.03 }} the continued need for each internal connection.
Last updated: 04 July 2026 08:17 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (10)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 9,350 | Requiring explicit authorization for each internal connection prevents missing authorization. |
CWE-284 | Improper Access Control | 5,385 | Authorizing and reviewing internal connections enforces proper access control over system interfaces. |
CWE-863 | Incorrect Authorization | 3,523 | Periodic review and documentation of connection needs reduces incorrect authorization. |
CWE-269 | Improper Privilege Management | 3,104 | Terminating and reviewing connections manages privileges associated with internal interfaces. |
CWE-285 | Improper Authorization | 1,360 | Documenting security requirements and authorizing connections ensures correct authorization decisions. |
CWE-668 | Exposure of Resource to Wrong Sphere | 798 | Controlling internal connections prevents exposure of resources to unintended internal spheres. |
CWE-250 | Execution with Unnecessary Privileges | 333 | Automatic termination after a defined period eliminates unnecessary privileges from persistent connections. |
CWE-1220 | Insufficient Granularity of Access Control | 94 | Documenting interface characteristics enables more granular control over internal access. |
CWE-653 | Improper Isolation or Compartmentalization | 66 | Reviewing the continued need for connections supports isolation and compartmentalization. |
CWE-501 | Trust Boundary Violation | 30 | Authorizing and reviewing connections helps maintain proper trust boundaries between internal components. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||