NIST 800-53 r5 · Controls catalogue · Family SC
SC-2Separation of System and User Functionality
Separate user functionality, including user interface services, from system management functionality.
Last updated: 22 August 2026 07:11 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (8)
- T1068 Exploitation for Privilege Escalation Privilege Escalation
- T1189 Drive-by Compromise Initial Access
- T1190 Exploit Public-Facing Application Initial Access
- T1203 Exploitation for Client Execution Execution
- T1210 Exploitation of Remote Services Lateral Movement
- T1211 Exploitation for Stealth Stealth
- T1212 Exploitation for Credential Access Credential Access
- T1611 Escape to Host Privilege Escalation
Weaknesses this control addresses (7)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 6,900+ | Explicit separation implements access control boundaries between user interfaces and system management functionality. |
CWE-269 | Improper Privilege Management | 3,400+ | The control enforces proper privilege boundaries by ensuring user functionality cannot invoke or manage system-level privileges. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,900+ | Ensures critical system resources and functions receive permission assignments distinct from ordinary user resources. |
CWE-668 | Exposure of Resource to Wrong Sphere | 800+ | Prevents exposure of system management resources and functions into the user functionality sphere. |
CWE-250 | Execution with Unnecessary Privileges | 300+ | Separating user-facing code from system management functions directly prevents execution of privileged operations from untrusted user contexts. |
CWE-1220 | Insufficient Granularity of Access Control | 100+ | Provides the necessary granularity by placing system management functions outside the reach of user-level access controls. |
CWE-653 | Improper Isolation or Compartmentalization | 73 | Directly requires isolation/compartmentalization of user services from system management functions. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-20271 UPD | 6.1 | 8.6 | 0.0027 | partial |
CVE-2025-22893 UPD | 5.3 | 7.8 | 0.0013 | partial |
CVE-2025-25273 UPD | 5.3 | 7.8 | 0.0013 | partial |
CVE-2025-35963 UPD | 5.2 | 7.4 | 0.0019 | partial |
CVE-2024-29079 UPD | 5.1 | 6.8 | 0.0020 | partial |
CVE-2025-25774 UPD | 5.1 | 6.5 | 0.0041 | partial |
CVE-2025-49463 UPD | 5.1 | 6.5 | 0.0043 | partial |
CVE-2021-33157 UPD | 5.0 | 7.2 | 0.0020 | partial |
CVE-2024-21801 UPD | 5.0 | 7.1 | 0.0018 | partial |
CVE-2025-20004 UPD | 4.9 | 7.2 | 0.0015 | partial |
CVE-2025-24305 UPD | 4.9 | 7.2 | 0.0014 | partial |
CVE-2024-33617 UPD | 4.7 | 5.9 | 0.0046 | partial |
CVE-2024-22374 UPD | 4.6 | 6.5 | 0.0016 | partial |
CVE-2025-20022 UPD | 4.3 | 5.7 | 0.0022 | partial |
CVE-2026-5938 | 4.1 | 5.5 | 0.0010 | partial |
CVE-2024-37158 UPD | 3.2 | 3.5 | 0.0044 | partial |
CVE-2024-25565 UPD | 3.0 | 3.8 | 0.0018 | partial |
CVE-2025-47285 UPD | 1.5 | 2.9 | 0.0044 | partial |
CVE-2025-47774 UPD | 1.5 | 2.9 | 0.0046 | partial |
CVE-2025-3466 UPD | 5.6 | 7.2 | 0.0072 | partial |
CVE-2024-9612 UPD | 5.2 | 6.5 | 0.0071 | partial |
CVE-2025-1974 UPD | 9.9 | 9.8 | 0.9952 | good |
CVE-2024-34144 UPD | 9.3 | 9.8 | 0.4808 | good |
CVE-2024-29988 KEV UPD | 9.2 | 8.8 | 0.4515 | good |
CVE-2026-21510 KEV | 9.2 | 8.8 | 0.2584 | good |