NIST 800-53 r5 · Controls catalogue · Family SC
SC-2Separation of System and User Functionality
Separate user functionality, including user interface services, from system management functionality.
Last updated: 16 October 2026 07:24 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (8)
- T1068 Exploitation for Privilege Escalation Privilege Escalation
- T1189 Drive-by Compromise Initial Access
- T1190 Exploit Public-Facing Application Initial Access
- T1203 Exploitation for Client Execution Execution
- T1210 Exploitation of Remote Services Lateral Movement
- T1211 Exploitation for Stealth Stealth
- T1212 Exploitation for Credential Access Credential Access
- T1611 Escape to Host Privilege Escalation
Weaknesses this control addresses (7)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 8,100+ | Explicit separation implements access control boundaries between user interfaces and system management functionality. |
CWE-269 | Improper Privilege Management | 4,000+ | The control enforces proper privilege boundaries by ensuring user functionality cannot invoke or manage system-level privileges. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 2,000+ | Ensures critical system resources and functions receive permission assignments distinct from ordinary user resources. |
CWE-668 | Exposure of Resource to Wrong Sphere | 800+ | Prevents exposure of system management resources and functions into the user functionality sphere. |
CWE-250 | Execution with Unnecessary Privileges | 300+ | Separating user-facing code from system management functions directly prevents execution of privileged operations from untrusted user contexts. |
CWE-1220 | Insufficient Granularity of Access Control | 100+ | Provides the necessary granularity by placing system management functions outside the reach of user-level access controls. |
CWE-653 | Improper Isolation or Compartmentalization | 85 | Directly requires isolation/compartmentalization of user services from system management functions. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-79033 | 6.5 | 8.8 | 0.0041 | partial |
CVE-2026-20271 UPD | 6.2 | 8.6 | 0.0047 | partial |
CVE-2026-20276 UPD | 6.1 | 8.6 | 0.0027 | partial |
CVE-2025-51675 UPD | 5.7 | 7.5 | 0.0026 | partial |
CVE-2025-22893 UPD | 5.3 | 7.8 | 0.0013 | partial |
CVE-2025-25273 UPD | 5.3 | 7.8 | 0.0013 | partial |
CVE-2025-35963 UPD | 5.3 | 7.4 | 0.0020 | partial |
CVE-2024-29079 UPD | 5.1 | 6.8 | 0.0020 | partial |
CVE-2025-25774 UPD | 5.1 | 6.5 | 0.0043 | partial |
CVE-2025-49463 UPD | 5.1 | 6.5 | 0.0049 | partial |
CVE-2021-33157 UPD | 5.0 | 7.2 | 0.0020 | partial |
CVE-2024-21801 UPD | 5.0 | 7.1 | 0.0018 | partial |
CVE-2025-20004 UPD | 4.9 | 7.2 | 0.0015 | partial |
CVE-2025-24305 UPD | 4.9 | 7.2 | 0.0014 | partial |
CVE-2024-33617 UPD | 4.7 | 5.9 | 0.0046 | partial |
CVE-2024-22374 UPD | 4.6 | 6.5 | 0.0016 | partial |
CVE-2025-20022 UPD | 4.3 | 5.7 | 0.0023 | partial |
CVE-2026-5938 | 4.2 | 5.5 | 0.0015 | partial |
CVE-2024-37158 UPD | 3.2 | 3.5 | 0.0044 | partial |
CVE-2024-25565 UPD | 3.0 | 3.8 | 0.0018 | partial |
CVE-2025-47285 UPD | 1.5 | 2.9 | 0.0046 | partial |
CVE-2025-47774 UPD | 1.5 | 2.9 | 0.0048 | partial |
CVE-2025-3466 UPD | 5.6 | 7.2 | 0.0083 | partial |
CVE-2024-9612 UPD | 5.2 | 6.5 | 0.0073 | partial |
CVE-2025-1974 UPD | 9.9 | 9.8 | 0.9938 | good |