NIST 800-53 r5 · Controls catalogue · Family SC
SC-16Transmission of Security and Privacy Attributes
Associate {{ insert: param, sc-16_prm_1 }} with information exchanged between systems and between system components.
Last updated: 14 October 2026 20:41 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (5)
Weaknesses this control addresses (5)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 11,700+ | Associating security/privacy attributes with exchanged data enables receiving systems to enforce handling rules and avoid unauthorized disclosure. |
CWE-284 | Improper Access Control | 8,100+ | Transmitting bound security attributes preserves access-control context across system boundaries, directly reducing improper access control. |
CWE-285 | Improper Authorization | 1,700+ | Security attributes carried with data allow consistent authorization decisions between components and external systems. |
CWE-807 | Reliance on Untrusted Inputs in a Security Decision | 100+ | Providing authoritative attributes with the data reduces the need for security decisions to rely on untrusted external inputs. |
CWE-501 | Trust Boundary Violation | 36 | Explicitly binding attributes to information crossing trust boundaries prevents loss of security context that leads to trust-boundary violations. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-85104 | 3.5 | 5.3 | 0.0016 | partial |
CVE-2026-28324 | 7.4 | 9.8 | 0.0065 | partial |
CVE-2026-62874 UPD | 7.3 | 10.0 | 0.0032 | partial |
CVE-2026-92161 | 7.2 | 9.8 | 0.0027 | partial |
CVE-2025-12999 UPD | 7.0 | 9.1 | 0.0034 | partial |
CVE-2024-44730 UPD | 6.8 | 9.1 | 0.0043 | partial |
CVE-2026-88592 | 6.7 | 9.1 | 0.0021 | partial |
CVE-2026-89238 | 6.7 | 9.1 | 0.0027 | partial |
CVE-2026-73437 | 6.6 | 9.6 | 0.0021 | partial |
CVE-2025-0592 UPD | 6.5 | 8.8 | 0.0036 | partial |
CVE-2019-25719 UPD | 6.3 | 8.6 | 0.0013 | partial |
CVE-2026-57122 | 6.3 | 8.6 | 0.0019 | partial |
CVE-2026-95985 | 6.3 | 8.8 | 0.0014 | partial |
CVE-2026-54167 UPD | 6.1 | 8.2 | 0.0027 | partial |
CVE-2023-6408 UPD | 6.0 | 8.1 | 0.0032 | partial |
CVE-2026-26950 UPD | 5.9 | 8.1 | 0.0017 | partial |
CVE-2026-81630 | 5.9 | 8.1 | 0.0019 | partial |
CVE-2024-43450 UPD | 5.8 | 7.5 | 0.0057 | partial |
CVE-2026-12576 | 5.7 | 7.5 | 0.0023 | partial |
CVE-2026-73435 | 5.7 | 8.2 | 0.0019 | partial |
CVE-2026-63127 UPD | 5.7 | 8.2 | 0.0020 | partial |
CVE-2026-103878 | 5.7 | 7.5 | 0.0021 | partial |
CVE-2020-11639 UPD | 5.6 | 7.8 | 0.0013 | partial |
CVE-2024-8933 UPD | 5.6 | 7.5 | 0.0029 | partial |
CVE-2026-54174 UPD | 5.6 | 8.3 | 0.0015 | partial |