NIST 800-53 r5 · Controls catalogue · Family SC
SC-11Trusted Path
Provide a {{ insert: param, sc-11_odp.01 }} isolated trusted communications path for communications between the user and the trusted components of the system; and Permit users to invoke the trusted communications path for communications between the user and the following security functions of the system, including at a minimum, authentication and re-authentication: {{ insert: param, sc-11_odp.02 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 5 mapping(s) from 2 framework(s): ASVS 5.0 3 (partial) · CSF 2.0 2 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-290 | Authentication Bypass by Spoofing | 698 | Isolated trusted path ensures the user interacts only with genuine system components, preventing spoofing of authentication interfaces or prompts. |
CWE-346 | Origin Validation Error | 661 | Trusted path establishment enforces validation that the communication originates from and reaches only the intended trusted system components. |
CWE-288 | Authentication Bypass Using an Alternate Path or Channel | 592 | Requires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels. |
CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | 61 | Mandates restriction of the channel for authentication to only the intended trusted endpoints, blocking unauthorized communication paths. |
CWE-940 | Improper Verification of Source of a Communication Channel | 55 | Requires explicit verification of the source and integrity of the channel used for authentication and other security functions. |
CWE-300 | Channel Accessible by Non-Endpoint | 54 | Explicitly isolates the communications path so it cannot be accessed or intercepted by non-endpoint entities during security functions. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-2378 | 5.5 | 7.4 | 0.0017 | good |
CVE-2026-0007 | 5.5 | 8.6 | 0.0009 | partial |
CVE-2025-33054 UPD | 5.5 | 8.1 | 0.0083 | good |
CVE-2024-8897 | 3.5 | 6.1 | 0.0689 | partial |
CVE-2025-15032 | 5.5 | 7.4 | 0.0024 | minimal |