NIST 800-53 r5 · Controls catalogue · Family PT
PT-4Consent
Implement {{ insert: param, pt-04_odp }} for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
Last updated: 15 October 2026 20:36 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (5)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 11,800+ | The control supplies the missing authorization check that would otherwise allow processing without user approval. |
CWE-284 | Improper Access Control | 8,100+ | Consent enforcement adds an explicit access-control gate before any PII processing can occur. |
CWE-863 | Incorrect Authorization | 4,800+ | Consent logic ensures authorization decisions governing PII are both present and correctly applied. |
CWE-285 | Improper Authorization | 1,700+ | Requiring affirmative consent implements an authorization decision for each instance of PII collection or use. |
CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | 200+ | Mandating consent prior to collection directly prevents unauthorized exposure of private personal information. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-74969 | 6.6 | 8.8 | 0.0048 | good |
CVE-2024-26192 UPD | 6.2 | 8.2 | 0.0151 | good |
CVE-2025-43227 UPD | 6.1 | 7.5 | 0.0119 | good |
CVE-2025-66172 UPD | 6.1 | 8.1 | 0.0051 | good |
CVE-2025-49715 UPD | 6.0 | 7.5 | 0.0083 | good |
CVE-2025-11959 UPD | 6.0 | 8.1 | 0.0030 | good |
CVE-2025-34441 | 6.0 | 7.5 | 0.0085 | good |
CVE-2024-33271 UPD | 5.9 | 7.5 | 0.0048 | good |
CVE-2024-10267 UPD | 5.9 | 7.5 | 0.0063 | good |
CVE-2025-43399 UPD | 5.9 | 7.5 | 0.0059 | good |
CVE-2025-43405 UPD | 5.9 | 7.5 | 0.0059 | good |
CVE-2025-43496 UPD | 5.9 | 7.5 | 0.0052 | good |
CVE-2025-43500 UPD | 5.9 | 7.5 | 0.0052 | good |
CVE-2026-24735 | 5.9 | 7.5 | 0.0069 | good |
CVE-2020-37173 | 5.9 | 7.5 | 0.0066 | good |
CVE-2026-28906 UPD | 5.9 | 7.5 | 0.0050 | good |
CVE-2019-25762 UPD | 5.9 | 7.5 | 0.0066 | good |
CVE-2026-48048 UPD | 5.9 | 7.5 | 0.0065 | good |
CVE-2023-50053 UPD | 5.8 | 7.6 | 0.0053 | good |
CVE-2024-30056 UPD | 5.8 | 7.1 | 0.0155 | good |
CVE-2024-36677 UPD | 5.8 | 7.5 | 0.0038 | good |
CVE-2024-36682 UPD | 5.8 | 7.5 | 0.0038 | good |
CVE-2024-11206 UPD | 5.8 | 7.5 | 0.0038 | good |
CVE-2025-20060 UPD | 5.8 | 7.5 | 0.0040 | good |
CVE-2025-1030 UPD | 5.8 | 7.5 | 0.0031 | good |