NIST 800-53 r5 · Controls catalogue · Family SC
SC-2Separation of System and User Functionality
Separate user functionality, including user interface services, from system management functionality.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (8)
- T1068 Exploitation for Privilege Escalation Privilege Escalation
- T1189 Drive-by Compromise Initial Access
- T1190 Exploit Public-Facing Application Initial Access
- T1203 Exploitation for Client Execution Execution
- T1210 Exploitation of Remote Services Lateral Movement
- T1211 Exploitation for Stealth Stealth
- T1212 Exploitation for Credential Access Credential Access
- T1611 Escape to Host Privilege Escalation
Weaknesses this control addresses (7)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 5,367 | Explicit separation implements access control boundaries between user interfaces and system management functionality. |
CWE-269 | Improper Privilege Management | 3,104 | The control enforces proper privilege boundaries by ensuring user functionality cannot invoke or manage system-level privileges. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Ensures critical system resources and functions receive permission assignments distinct from ordinary user resources. |
CWE-668 | Exposure of Resource to Wrong Sphere | 797 | Prevents exposure of system management resources and functions into the user functionality sphere. |
CWE-250 | Execution with Unnecessary Privileges | 333 | Separating user-facing code from system management functions directly prevents execution of privileged operations from untrusted user contexts. |
CWE-1220 | Insufficient Granularity of Access Control | 94 | Provides the necessary granularity by placing system management functions outside the reach of user-level access controls. |
CWE-653 | Improper Isolation or Compartmentalization | 66 | Directly requires isolation/compartmentalization of user services from system management functions. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-33334 | 7.0 | 9.6 | 0.0039 | good |
CVE-2026-39911 | 5.5 | 8.8 | 0.0054 | good |
CVE-2026-27952 | 5.5 | 8.8 | 0.0050 | good |
CVE-2026-7064 | 5.5 | 7.3 | 0.0171 | good |
CVE-2026-40317 | 7.0 | 9.3 | 0.0022 | good |
CVE-2025-59252 | 7.0 | 9.3 | 0.0052 | good |
CVE-2026-33336 | 5.5 | 8.8 | 0.0112 | good |
CVE-2025-56098 | 5.5 | 8.8 | 0.0224 | partial |
CVE-2025-24228 | 5.5 | 7.8 | 0.0032 | good |
CVE-2025-0478 | 5.5 | 7.8 | 0.0014 | good |
CVE-2024-44303 | 5.5 | 7.5 | 0.0027 | good |
CVE-2025-24130 | 3.5 | 5.5 | 0.0063 | good |