NIST 800-53 r5 · Controls catalogue · Family SC
SC-13Cryptographic Protection
Determine the {{ insert: param, sc-13_odp.01 }} ; and Implement the following types of cryptography required for each specified cryptographic use: {{ insert: param, sc-13_odp.02 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 13 mapping(s) from 2 framework(s): ASVS 5.0 11 (mostly) · CSF 2.0 2 (partial)
Implementations targeting this control (30)
- aws-config-ec2-ebs-encryption-by-default EBS encryption by default is enabled AWS::EC2::Volume partial protect enforce CIS v5 §5.1.1CIS v3 §2.2.1Hub EC2.7
- aws-config-encrypted-volumes EBS volumes are encrypted at rest AWS::EC2::Volume partial protect enforce
- aws-config-rds-storage-encrypted RDS storage is encrypted AWS::RDS::DBInstance partial protect enforce CIS v5 §2.2.1CIS v3 §2.3.1Hub RDS.3
- aws-config-s3-bucket-server-side-encryption-enabled S3 bucket has default server-side encryption AWS::S3::Bucket partial protect enforce
- aws-config-efs-encrypted-check EFS file system is encrypted AWS::EFS::FileSystem partial protect enforce CIS v5 §2.3.1CIS v3 §2.4.1Hub EFS.8
- aws-config-sns-encrypted-kms SNS topic uses KMS encryption at rest AWS::SNS::Topic partial protect enforce
- aws-config-elb-tls-https-listeners-only ELB / ALB listeners use HTTPS or TLS AWS::ElasticLoadBalancingV2::Listener partial protect enforce
- aws-config-alb-http-to-https-redirection-check Alb Http To Https Redirection Check AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
- aws-config-api-gw-cache-enabled-and-encrypted Api Gw Cache Enabled And Encrypted AWS::ApiGateway::Stage partial protect enforce
- aws-config-api-gw-ssl-enabled Api Gw Ssl Enabled AWS::ApiGateway::Stage partial protect enforce
- aws-config-cloud-trail-encryption-enabled Cloud Trail Encryption Enabled AWS::CloudTrail::Trail partial detect enforce CIS §3.5Hub CloudTrail.2
- aws-config-codebuild-project-artifact-encryption Codebuild Project Artifact Encryption AWS::CodeBuild::Project partial protect enforce
- aws-config-dynamodb-table-encrypted-kms Dynamodb Table Encrypted Kms AWS::DynamoDB::Table partial protect enforce
- aws-config-elasticsearch-encrypted-at-rest Elasticsearch Encrypted At Rest AWS::OpenSearchService::Domain partial protect enforce
- aws-config-elasticsearch-node-to-node-encryption-check Elasticsearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
- aws-config-elb-acm-certificate-required Elb Acm Certificate Required AWS::ElasticLoadBalancing::LoadBalancer partial protect enforce
- aws-config-elbv2-acm-certificate-required Elbv2 Acm Certificate Required AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
- aws-config-kinesis-stream-encrypted Kinesis Stream Encrypted AWS::Kinesis::Stream partial protect enforce
- aws-config-opensearch-encrypted-at-rest Opensearch Encrypted At Rest AWS::OpenSearchService::Domain partial protect enforce
- aws-config-opensearch-https-required Opensearch Https Required AWS::OpenSearchService::Domain partial protect enforce
- aws-config-opensearch-node-to-node-encryption-check Opensearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
- aws-config-rds-snapshot-encrypted Rds Snapshot Encrypted AWS::RDS::DBInstance partial recover enforce
- aws-config-redshift-cluster-configuration-check Redshift Cluster Configuration Check AWS::Redshift::Cluster partial protect enforce
- aws-config-redshift-cluster-kms-enabled Redshift Cluster Kms Enabled AWS::Redshift::Cluster partial protect enforce
- aws-config-redshift-require-tls-ssl Redshift Require Tls Ssl AWS::Redshift::Cluster partial protect enforce
- aws-config-s3-bucket-ssl-requests-only S3 Bucket Ssl Requests Only AWS::S3::Bucket partial protect enforce CIS §2.1.1Hub S3.5
- aws-config-s3-default-encryption-kms S3 Default Encryption Kms AWS::S3::Bucket partial protect enforce
- aws-config-sagemaker-endpoint-configuration-kms-key-configured Sagemaker Endpoint Configuration Kms Key Configured AWS::SageMaker::NotebookInstance partial protect enforce
- aws-config-sagemaker-notebook-instance-kms-key-configured Sagemaker Notebook Instance Kms Key Configured AWS::SageMaker::NotebookInstance partial protect enforce
- aws-config-secretsmanager-using-cmk Secretsmanager Using Cmk AWS::SecretsManager::Secret partial protect enforce
ATT&CK techniques this control mitigates (5)
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-319 | Cleartext Transmission of Sensitive Information | 1,076 | Requires cryptography for transmission uses, eliminating cleartext exposure of sensitive data in transit. |
CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | 777 | Enforces approved cryptographic algorithms for each use case, blocking use of broken or risky algorithms. |
CWE-311 | Missing Encryption of Sensitive Data | 554 | Mandates encryption for specified data uses, directly preventing missing encryption of sensitive information. |
CWE-326 | Inadequate Encryption Strength | 520 | Specifies required cryptography types and parameters, preventing selection of inadequate encryption strength. |
CWE-328 | Use of Weak Hash | 85 | Requires appropriate hash functions for cryptographic uses, preventing reliance on weak hashes. |
CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation | 19 | Requires specific, validated cryptographic primitives, reducing use of risky or improperly implemented primitives. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2018-18325 KEV | 10.0 | 7.5 | 0.7405 | good |
CVE-2018-15811 KEV | 10.0 | 7.5 | 0.7405 | good |
CVE-2017-11317 KEV | 10.0 | 9.8 | 0.8348 | good |
CVE-2017-1000486 KEV | 10.0 | 9.8 | 0.9410 | good |
CVE-2024-4282 | 7.0 | 9.8 | 0.0027 | good |
CVE-2026-28252 | 7.0 | 9.8 | 0.0022 | good |
CVE-2024-58041 | 7.0 | 9.1 | 0.0041 | good |
CVE-2026-22585 | 7.0 | 9.8 | 0.0038 | good |
CVE-2025-15385 | 7.0 | 9.8 | 0.0020 | good |
CVE-2024-42461 | 7.0 | 9.1 | 0.0062 | good |
CVE-2019-25651 | 5.5 | 8.3 | 0.0008 | good |
CVE-2023-24012 | 5.5 | 8.2 | 0.0027 | good |
CVE-2024-51346 | 5.5 | 7.7 | 0.0012 | good |
CVE-2024-8603 | 5.5 | 7.5 | 0.0032 | good |
CVE-2024-54089 | 5.5 | 7.5 | 0.0019 | good |
CVE-2026-33488 | 5.5 | 7.4 | 0.0025 | good |
CVE-2026-23687 UPD | 5.5 | 8.8 | 0.0046 | good |
CVE-2026-1529 UPD | 5.5 | 8.1 | 0.0045 | good |
CVE-2025-68931 | 5.5 | 7.5 | 0.0017 | good |
CVE-2026-3598 | 5.5 | 7.5 | 0.0023 | good |
CVE-2026-30791 | 5.5 | 7.5 | 0.0024 | good |
CVE-2025-66597 | 5.5 | 7.5 | 0.0017 | good |
CVE-2026-27519 | 5.5 | 7.5 | 0.0019 | good |
CVE-2026-28479 | 5.5 | 7.5 | 0.0018 | good |
CVE-2025-58743 | 5.5 | 7.5 | 0.0007 | good |