NIST 800-53 r5 · Controls catalogue · Family SA
SA-19Component Authenticity
Component Authenticity
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-295 | Improper Certificate Validation | 1,683 | When certificates are used to establish component provenance, the control requires correct certificate validation procedures. |
CWE-347 | Improper Verification of Cryptographic Signature | 842 | Component authenticity commonly depends on cryptographic signatures; the control enforces proper verification of those signatures. |
CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | 298 | Mandates acquisition only from trusted suppliers and verified authentic sources, reducing inclusion of functionality from untrusted control spheres. |
CWE-494 | Download of Code Without Integrity Check | 252 | Component authenticity requires verifying origin/integrity of acquired firmware or software, directly preventing inclusion of code without integrity checks. |
CWE-506 | Embedded Malicious Code | 85 | Authenticity verification and anti-counterfeit procedures detect and block components that may contain embedded malicious code or backdoors. |
CWE-353 | Missing Support for Integrity Check | 40 | Explicitly requires support for integrity and authenticity checks on components before acceptance into the system. |
CWE-1104 | Use of Unmaintained Third Party Components | 21 | Requires use of trusted, maintained suppliers and configuration control, making use of unmaintained third-party components far less likely. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-24062 | 5.5 | 7.8 | 0.0012 | good |
CVE-2026-24071 | 5.5 | 7.8 | 0.0015 | good |
CVE-2021-44168 KEV | 10.0 | 3.3 | 0.0087 | partial |
CVE-2010-20103 | 7.0 | 9.8 | 0.0475 | good |
CVE-2024-7344 | 5.5 | 8.2 | 0.0104 | good |
CVE-2025-52648 | 3.5 | 4.8 | 0.0012 | partial |