NIST 800-53 r5 · Controls catalogue · Family SC
SC-17Public Key Infrastructure Certificates
Issue public key certificates under an {{ insert: param, sc-17_odp }} or obtain public key certificates from an approved service provider; and Include only approved trust anchors in trust stores or certificate stores managed by the organization.
Last updated: 15 October 2026 20:36 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (2)
Weaknesses this control addresses (6)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-295 | Improper Certificate Validation | 1,900+ | Mandates approved trust anchors and issuance policies, directly preventing acceptance of unvalidated or untrusted certificates. |
CWE-347 | Improper Verification of Cryptographic Signature | 1,000+ | PKI certificates under an approved policy require cryptographic signature verification on issuance and validation. |
CWE-345 | Insufficient Verification of Data Authenticity | 900+ | Use of approved PKI certificates provides verifiable data authenticity and origin for communications and artifacts. |
CWE-321 | Use of Hard-coded Cryptographic Key | 300+ | Approved PKI issuance and trust stores replace ad-hoc or hard-coded keys with properly managed, signed certificates. |
CWE-297 | Improper Validation of Certificate with Host Mismatch | 93 | Approved PKI issuance and trust stores enforce full certificate validation steps including name/hostname checks. |
CWE-296 | Improper Following of a Certificate's Chain of Trust | 19 | Requires only approved trust anchors in stores, ensuring proper chain-of-trust validation rather than arbitrary or incomplete paths. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-85102 KEV UPD | 9.9 | 9.8 | 0.5040 | good |
CVE-2024-49369 UPD | 7.8 | 9.8 | 0.0291 | good |
CVE-2019-20461 UPD | 7.5 | 9.8 | 0.0089 | good |
CVE-2025-68121 UPD | 7.5 | 10.0 | 0.0092 | good |
CVE-2024-56521 UPD | 7.4 | 9.8 | 0.0078 | good |
CVE-2023-51837 UPD | 7.3 | 9.8 | 0.0047 | good |
CVE-2024-25140 UPD | 7.3 | 9.8 | 0.0051 | good |
CVE-2024-5261 UPD | 7.3 | 9.8 | 0.0043 | good |
CVE-2024-45159 UPD | 7.3 | 9.8 | 0.0039 | good |
CVE-2025-48057 UPD | 7.3 | 9.8 | 0.0044 | good |
CVE-2025-32878 UPD | 7.3 | 9.8 | 0.0041 | good |
CVE-2025-29331 UPD | 7.3 | 9.8 | 0.0046 | good |
CVE-2025-46070 UPD | 7.3 | 9.8 | 0.0052 | good |
CVE-2026-20184 | 7.3 | 9.8 | 0.0052 | good |
CVE-2026-58162 UPD | 7.3 | 10.0 | 0.0036 | good |
CVE-2026-66402 UPD | 7.3 | 9.8 | 0.0051 | good |
CVE-2026-96207 | 7.3 | 10.0 | 0.0048 | partial |
CVE-2024-20080 UPD | 7.2 | 9.8 | 0.0029 | good |
CVE-2025-6433 UPD | 7.2 | 9.8 | 0.0030 | good |
CVE-2025-67229 | 7.2 | 9.8 | 0.0027 | good |
CVE-2025-3463 UPD | 7.0 | 9.4 | 0.0085 | good |
CVE-2025-7395 UPD | 7.0 | 9.2 | 0.0026 | good |
CVE-2026-22093 | 7.0 | 9.5 | 0.0026 | good |
CVE-2026-46428 | 7.0 | 9.1 | 0.0032 | good |
CVE-2026-66795 UPD | 7.0 | 9.9 | 0.0049 | good |