NIST 800-53 r5 · Controls catalogue · Family SA
SA-9External System Services
Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: {{ insert: param, sa-09_odp.01 }}; Define and document organizational oversight and user roles and responsibilities with regard to external system services; and Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: {{ insert: param, sa-09_odp.02 }}.
Last updated: 22 August 2026 07:11 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (6)
- T1041 Exfiltration Over C2 Channel Exfiltration
- T1048 Exfiltration Over Alternative Protocol Exfiltration
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
- T1072 Software Deployment Tools Execution, Lateral Movement
- T1567 Exfiltration Over Web Service Exfiltration
Weaknesses this control addresses (6)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 6,900+ | Requiring external providers to implement and be monitored against organizational access-control requirements directly reduces the likelihood of improper access control across trust boundaries. |
CWE-306 | Missing Authentication for Critical Function | 3,300+ | Mandating that external services employ specified authentication controls and ongoing compliance monitoring makes missing authentication for critical functions harder to overlook or exploit. |
CWE-319 | Cleartext Transmission of Sensitive Information | 1,000+ | Explicit controls and continuous oversight on external system services prevent cleartext transmission of sensitive information over provider-managed channels. |
CWE-311 | Missing Encryption of Sensitive Data | 500+ | Privacy and security requirements placed on external providers, together with monitoring, tangibly reduce missing encryption of sensitive data processed or stored by those services. |
CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | 300+ | Defining oversight, roles, and compliance monitoring for external services directly mitigates risks of including functionality from an untrusted control sphere. |
CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | 69 | Requiring providers to meet communication-channel restrictions and monitoring adherence reduces improper restriction of channels to intended endpoints. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-29944 UPD | 6.9 | 8.4 | 0.0470 | partial |
CVE-2024-42381 UPD | 6.0 | 8.3 | 0.0065 | partial |
CVE-2025-65109 UPD | 5.5 | 8.5 | 0.0028 | partial |
CVE-2025-33028 UPD | 4.6 | 6.1 | 0.0049 | partial |
CVE-2024-35180 UPD | 4.5 | 6.1 | 0.0029 | partial |
CVE-2025-43703 UPD | 4.5 | 6.1 | 0.0022 | partial |
CVE-2025-46652 UPD | 4.5 | 6.1 | 0.0031 | partial |
CVE-2025-33026 UPD | 4.5 | 6.1 | 0.0027 | partial |
CVE-2025-33027 UPD | 4.5 | 6.1 | 0.0027 | partial |