Cyber Resilience

NIST 800-53 r5 · Controls catalogue · Family SA

SA-19Component Authenticity

Component Authenticity

Last updated: 22 August 2026 14:14 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (0)

Weaknesses this control addresses (7)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-295Improper Certificate Validation1,700+When certificates are used to establish component provenance, the control requires correct certificate validation procedures.
CWE-347Improper Verification of Cryptographic Signature900+Component authenticity commonly depends on cryptographic signatures; the control enforces proper verification of those signatures.
CWE-829Inclusion of Functionality from Untrusted Control Sphere300+Mandates acquisition only from trusted suppliers and verified authentic sources, reducing inclusion of functionality from untrusted control spheres.
CWE-494Download of Code Without Integrity Check200+Component authenticity requires verifying origin/integrity of acquired firmware or software, directly preventing inclusion of code without integrity checks.
CWE-506Embedded Malicious Code99Authenticity verification and anti-counterfeit procedures detect and block components that may contain embedded malicious code or backdoors.
CWE-353Missing Support for Integrity Check44Explicitly requires support for integrity and authenticity checks on components before acceptance into the system.
CWE-1104Use of Unmaintained Third Party Components26Requires use of trusted, maintained suppliers and configuration control, making use of unmaintained third-party components far less likely.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2025-32800 7.49.80.0057good
CVE-2024-3313 6.28.40.0026good
CVE-2024-28042 6.18.40.0021good
CVE-2024-26024 6.18.40.0021good
CVE-2026-476195.16.60.0045good
CVE-2024-3094 10.010.00.8597partial
CVE-2025-59374 KEV9.99.80.0117partial
CVE-2026-8398 KEV 9.99.80.0146partial
CVE-2026-48027 KEV 9.99.80.0185partial
CVE-2026-45321 KEV 9.49.60.0234partial
CVE-2026-33634 KEV9.28.80.5916partial
CVE-2025-30066 KEV 8.88.60.6979partial
CVE-2025-30154 KEV 8.88.60.0239partial
CVE-2024-4978 KEV 8.68.40.2694partial
CVE-2025-54313 KEV 8.17.50.0415partial
CVE-2026-464127.410.00.0042partial
CVE-2026-180727.49.80.0059partial
CVE-2026-667477.49.80.0058partial
CVE-2026-319767.39.80.0050partial
CVE-2026-344247.39.80.0055partial
CVE-2026-64437.39.80.0050partial
CVE-2026-735327.39.80.0046partial
CVE-2026-735337.39.80.0045partial
CVE-2026-776497.39.80.0043partial
CVE-2026-776507.39.80.0043partial

Other controls in family SA

SA-1 SA-10 SA-11 SA-12 SA-13 SA-14 SA-15 SA-16 SA-17 SA-18 SA-2 SA-20 SA-21 SA-22 SA-23 SA-24 SA-3 SA-4 SA-5 SA-6 SA-7 SA-8 SA-9