NIST 800-53 r5 · Controls catalogue · Family SC
SC-13Cryptographic Protection
Determine the {{ insert: param, sc-13_odp.01 }} ; and Implement the following types of cryptography required for each specified cryptographic use: {{ insert: param, sc-13_odp.02 }}.
Last updated: 11 September 2026 14:19 UTC
Implementations targeting this control (30)
- aws-config-ec2-ebs-encryption-by-default EBS encryption by default is enabled AWS::EC2::Volume partial protect enforce CIS v5 §5.1.1CIS v3 §2.2.1Hub EC2.7
- aws-config-encrypted-volumes EBS volumes are encrypted at rest AWS::EC2::Volume partial protect enforce
- aws-config-rds-storage-encrypted RDS storage is encrypted AWS::RDS::DBInstance partial protect enforce CIS v5 §2.2.1CIS v3 §2.3.1Hub RDS.3
- aws-config-s3-bucket-server-side-encryption-enabled S3 bucket has default server-side encryption AWS::S3::Bucket partial protect enforce
- aws-config-efs-encrypted-check EFS file system is encrypted AWS::EFS::FileSystem partial protect enforce CIS v5 §2.3.1CIS v3 §2.4.1Hub EFS.8
- aws-config-sns-encrypted-kms SNS topic uses KMS encryption at rest AWS::SNS::Topic partial protect enforce
- aws-config-elb-tls-https-listeners-only ELB / ALB listeners use HTTPS or TLS AWS::ElasticLoadBalancingV2::Listener partial protect enforce
- aws-config-alb-http-to-https-redirection-check Alb Http To Https Redirection Check AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
- aws-config-api-gw-cache-enabled-and-encrypted Api Gw Cache Enabled And Encrypted AWS::ApiGateway::Stage partial protect enforce
- aws-config-api-gw-ssl-enabled Api Gw Ssl Enabled AWS::ApiGateway::Stage partial protect enforce
- aws-config-cloud-trail-encryption-enabled Cloud Trail Encryption Enabled AWS::CloudTrail::Trail partial detect enforce CIS §3.5Hub CloudTrail.2
- aws-config-codebuild-project-artifact-encryption Codebuild Project Artifact Encryption AWS::CodeBuild::Project partial protect enforce
- aws-config-dynamodb-table-encrypted-kms Dynamodb Table Encrypted Kms AWS::DynamoDB::Table partial protect enforce
- aws-config-elasticsearch-encrypted-at-rest Elasticsearch Encrypted At Rest AWS::OpenSearchService::Domain partial protect enforce
- aws-config-elasticsearch-node-to-node-encryption-check Elasticsearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
- aws-config-elb-acm-certificate-required Elb Acm Certificate Required AWS::ElasticLoadBalancing::LoadBalancer partial protect enforce
- aws-config-elbv2-acm-certificate-required Elbv2 Acm Certificate Required AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
- aws-config-kinesis-stream-encrypted Kinesis Stream Encrypted AWS::Kinesis::Stream partial protect enforce
- aws-config-opensearch-encrypted-at-rest Opensearch Encrypted At Rest AWS::OpenSearchService::Domain partial protect enforce
- aws-config-opensearch-https-required Opensearch Https Required AWS::OpenSearchService::Domain partial protect enforce
- aws-config-opensearch-node-to-node-encryption-check Opensearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
- aws-config-rds-snapshot-encrypted Rds Snapshot Encrypted AWS::RDS::DBInstance partial recover enforce
- aws-config-redshift-cluster-configuration-check Redshift Cluster Configuration Check AWS::Redshift::Cluster partial protect enforce
- aws-config-redshift-cluster-kms-enabled Redshift Cluster Kms Enabled AWS::Redshift::Cluster partial protect enforce
- aws-config-redshift-require-tls-ssl Redshift Require Tls Ssl AWS::Redshift::Cluster partial protect enforce
- aws-config-s3-bucket-ssl-requests-only S3 Bucket Ssl Requests Only AWS::S3::Bucket partial protect enforce CIS §2.1.1Hub S3.5
- aws-config-s3-default-encryption-kms S3 Default Encryption Kms AWS::S3::Bucket partial protect enforce
- aws-config-sagemaker-endpoint-configuration-kms-key-configured Sagemaker Endpoint Configuration Kms Key Configured AWS::SageMaker::NotebookInstance partial protect enforce
- aws-config-sagemaker-notebook-instance-kms-key-configured Sagemaker Notebook Instance Kms Key Configured AWS::SageMaker::NotebookInstance partial protect enforce
- aws-config-secretsmanager-using-cmk Secretsmanager Using Cmk AWS::SecretsManager::Secret partial protect enforce
ATT&CK techniques this control mitigates (5)
Weaknesses this control addresses (6)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-319 | Cleartext Transmission of Sensitive Information | 1,100+ | Requires cryptography for transmission uses, eliminating cleartext exposure of sensitive data in transit. |
CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | 800+ | Enforces approved cryptographic algorithms for each use case, blocking use of broken or risky algorithms. |
CWE-311 | Missing Encryption of Sensitive Data | 500+ | Mandates encryption for specified data uses, directly preventing missing encryption of sensitive information. |
CWE-326 | Inadequate Encryption Strength | 500+ | Specifies required cryptography types and parameters, preventing selection of inadequate encryption strength. |
CWE-328 | Use of Weak Hash | 90 | Requires appropriate hash functions for cryptographic uses, preventing reliance on weak hashes. |
CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation | 22 | Requires specific, validated cryptographic primitives, reducing use of risky or improperly implemented primitives. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-48558 KEV UPD | 10.0 | 10.0 | 0.6431 | good |
CVE-2025-59718 KEV UPD | 9.9 | 9.8 | 0.6829 | good |
CVE-2025-59719 UPD | 8.8 | 9.8 | 0.2922 | good |
CVE-2026-34486 KEV UPD | 8.5 | 7.5 | 0.9862 | good |
CVE-2024-9487 UPD | 8.3 | 9.1 | 0.2561 | good |
CVE-2024-45409 UPD | 8.2 | 10.0 | 0.1068 | good |
CVE-2026-40372 UPD | 7.8 | 9.1 | 0.1120 | good |
CVE-2022-3365 UPD | 7.7 | 9.8 | 0.0208 | good |
CVE-2023-5347 UPD | 7.6 | 9.8 | 0.0134 | good |
CVE-2024-29868 UPD | 7.6 | 9.1 | 0.0600 | good |
CVE-2024-6800 UPD | 7.6 | 9.8 | 0.0153 | good |
CVE-2026-15013 UPD | 7.6 | 9.8 | 0.0150 | good |
CVE-2024-21917 UPD | 7.5 | 9.8 | 0.0086 | good |
CVE-2024-40762 UPD | 7.5 | 9.8 | 0.0104 | good |
CVE-2025-47827 KEV UPD | 7.5 | 4.6 | 0.0493 | good |
CVE-2026-29000 UPD | 7.5 | 9.1 | 0.0586 | good |
CVE-2026-61500 | 7.5 | 9.8 | 0.0086 | good |
CVE-2024-32962 UPD | 7.4 | 10.0 | 0.0083 | good |
CVE-2024-31510 UPD | 7.4 | 9.8 | 0.0062 | good |
CVE-2024-47943 UPD | 7.4 | 9.8 | 0.0064 | good |
CVE-2025-3495 UPD | 7.4 | 9.8 | 0.0067 | good |
CVE-2025-9485 UPD | 7.4 | 9.8 | 0.0060 | good |
CVE-2025-59390 UPD | 7.4 | 9.8 | 0.0061 | good |
CVE-2026-21718 | 7.4 | 10.0 | 0.0043 | good |
CVE-2026-56451 | 7.4 | 10.0 | 0.0050 | good |