NIST 800-53 r5 · Controls catalogue · Family CA
CA-9Internal System Connections
Authorize internal connections of {{ insert: param, ca-09_odp.01 }} to the system; Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated; Terminate internal system connections after {{ insert: param, ca-09_odp.02 }} ; and Review {{ insert: param, ca-09_odp.03 }} the continued need for each internal connection.
Last updated: 22 August 2026 07:11 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (10)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 10,200+ | Requiring explicit authorization for each internal connection prevents missing authorization. |
CWE-284 | Improper Access Control | 6,900+ | Authorizing and reviewing internal connections enforces proper access control over system interfaces. |
CWE-863 | Incorrect Authorization | 3,900+ | Periodic review and documentation of connection needs reduces incorrect authorization. |
CWE-269 | Improper Privilege Management | 3,400+ | Terminating and reviewing connections manages privileges associated with internal interfaces. |
CWE-285 | Improper Authorization | 1,500+ | Documenting security requirements and authorizing connections ensures correct authorization decisions. |
CWE-668 | Exposure of Resource to Wrong Sphere | 800+ | Controlling internal connections prevents exposure of resources to unintended internal spheres. |
CWE-250 | Execution with Unnecessary Privileges | 300+ | Automatic termination after a defined period eliminates unnecessary privileges from persistent connections. |
CWE-1220 | Insufficient Granularity of Access Control | 100+ | Documenting interface characteristics enables more granular control over internal access. |
CWE-653 | Improper Isolation or Compartmentalization | 73 | Reviewing the continued need for connections supports isolation and compartmentalization. |
CWE-501 | Trust Boundary Violation | 33 | Authorizing and reviewing connections helps maintain proper trust boundaries between internal components. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||