NIST 800-53 r5 · Controls catalogue · Family SC
SC-17Public Key Infrastructure Certificates
Issue public key certificates under an {{ insert: param, sc-17_odp }} or obtain public key certificates from an approved service provider; and Include only approved trust anchors in trust stores or certificate stores managed by the organization.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 7 mapping(s) from 1 framework(s): ASVS 5.0 7 (mostly)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (2)
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-295 | Improper Certificate Validation | 1,683 | Mandates approved trust anchors and issuance policies, directly preventing acceptance of unvalidated or untrusted certificates. |
CWE-347 | Improper Verification of Cryptographic Signature | 842 | PKI certificates under an approved policy require cryptographic signature verification on issuance and validation. |
CWE-345 | Insufficient Verification of Data Authenticity | 699 | Use of approved PKI certificates provides verifiable data authenticity and origin for communications and artifacts. |
CWE-321 | Use of Hard-coded Cryptographic Key | 302 | Approved PKI issuance and trust stores replace ad-hoc or hard-coded keys with properly managed, signed certificates. |
CWE-297 | Improper Validation of Certificate with Host Mismatch | 59 | Approved PKI issuance and trust stores enforce full certificate validation steps including name/hostname checks. |
CWE-296 | Improper Following of a Certificate's Chain of Trust | 17 | Requires only approved trust anchors in stores, ensuring proper chain-of-trust validation rather than arbitrary or incomplete paths. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2020-0601 KEV | 10.0 | 8.1 | 0.8944 | good |
CVE-2026-20184 | 7.0 | 9.8 | 0.0052 | good |
CVE-2025-70043 | 7.0 | 9.1 | 0.0018 | good |
CVE-2025-67229 | 7.0 | 9.8 | 0.0026 | good |
CVE-2026-1709 UPD | 7.0 | 9.4 | 0.0575 | good |
CVE-2025-15573 | 7.0 | 9.4 | 0.0022 | good |
CVE-2026-25160 | 7.0 | 9.1 | 0.0023 | good |
CVE-2024-32962 | 7.0 | 10.0 | 0.0083 | good |
CVE-2022-34689 | 6.0 | 7.5 | 0.3793 | good |
CVE-2024-11621 | 5.5 | 8.8 | 0.0022 | good |
CVE-2024-41724 | 5.5 | 8.7 | 0.0018 | good |
CVE-2024-40702 | 5.5 | 8.2 | 0.0025 | good |
CVE-2023-24011 | 5.5 | 8.2 | 0.0033 | good |
CVE-2026-4434 | 5.5 | 8.1 | 0.0014 | good |
CVE-2025-1146 | 5.5 | 8.1 | 0.0027 | good |
CVE-2025-1193 | 5.5 | 8.1 | 0.0036 | good |
CVE-2024-47258 | 5.5 | 8.1 | 0.0013 | good |
CVE-2026-4396 | 5.5 | 8.1 | 0.0014 | good |
CVE-2025-0501 | 5.5 | 7.5 | 0.0044 | good |
CVE-2024-52329 | 5.5 | 7.4 | 0.0037 | good |
CVE-2024-52330 | 5.5 | 7.4 | 0.0033 | good |
CVE-2024-10444 | 5.5 | 7.5 | 0.0024 | good |
CVE-2019-25652 | 5.5 | 7.5 | 0.0011 | good |
CVE-2024-54848 | 5.5 | 7.4 | 0.0030 | good |
CVE-2026-33896 UPD | 5.5 | 7.4 | 0.0035 | good |