NIST 800-53 r5 · Controls catalogue · Family IA
IA-7Cryptographic Module Authentication
Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 2 mapping(s) from 2 framework(s): ASVS 5.0 1 (partial) · CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (12)
- T1195.003 Compromise Hardware Supply Chain Initial Access
- T1495 Firmware Corruption Impact
- T1542 Pre-OS Boot Stealth, Persistence
- T1542.001 System Firmware Stealth, Persistence
- T1542.003 Bootkit Stealth, Persistence
- T1542.004 ROMMONkit Stealth, Persistence
- T1542.005 TFTP Boot Stealth, Persistence
- T1553 Subvert Trust Controls Defense Impairment
- T1553.006 Code Signing Policy Modification Defense Impairment
- T1601 Modify System Image Defense Impairment
- T1601.001 Patch System Image Defense Impairment
- T1601.002 Downgrade System Image Defense Impairment
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-287 | Improper Authentication | 4,908 | Directly requires implementation of compliant authentication mechanisms to cryptographic modules, preventing improper authentication. |
CWE-306 | Missing Authentication for Critical Function | 2,820 | Mandates authentication for the critical function of accessing or using a cryptographic module. |
CWE-1392 | Use of Default Credentials | 104 | Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules. |
CWE-1390 | Weak Authentication | 82 | Requires authentication mechanisms to meet applicable standards and guidelines, preventing weak authentication. |
CWE-1391 | Use of Weak Credentials | 51 | Enforces use of credentials that comply with standards rather than weak credentials for module access. |
CWE-1393 | Use of Default Password | 40 | Requires authentication that meets guidelines, avoiding default passwords for cryptographic module access. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-64647 | 3.5 | 5.9 | 0.0020 | good |
CVE-2024-42461 | 7.0 | 9.1 | 0.0062 | partial |