NIST 800-53 r5 · Controls catalogue · Family SC
SC-24Fail in Known State
Fail to a {{ insert: param, sc-24_odp.02 }} for the following failures on the indicated components while preserving {{ insert: param, sc-24_odp.03 }} in failure: {{ insert: param, sc-24_odp.01 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 2 mapping(s) from 2 framework(s): CSF 2.0 1 (mostly) · ASVS 5.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-754 | Improper Check for Unusual or Exceptional Conditions | 730 | Requires detection of unusual conditions followed by a controlled transition to the defined failure state. |
CWE-755 | Improper Handling of Exceptional Conditions | 677 | Enforces structured response to exceptional conditions so the system cannot remain in an unsafe state. |
CWE-248 | Uncaught Exception | 219 | Prevents abrupt termination from uncaught exceptions by requiring a defined, preserved-state failure mode. |
CWE-703 | Improper Check or Handling of Exceptional Conditions | 150 | Mandates explicit, predictable handling of exceptional conditions rather than undefined continuation. |
CWE-636 | Not Failing Securely ('Failing Open') | 35 | Directly requires transition to a known (secure) state on failure, preventing fail-open behavior. |
CWE-390 | Detection of Error Condition Without Action | 18 | Ensures that detected error conditions trigger an explicit action to reach the known failure state. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2021-1906 KEV | 10.0 | 6.2 | 0.0052 | good |
CVE-2025-30430 | 7.0 | 9.8 | 0.0109 | good |
CVE-2026-2287 | 7.0 | 9.8 | 0.0069 | good |
CVE-2026-27586 | 7.0 | 9.1 | 0.0027 | good |
CVE-2026-23466 | 5.5 | 7.8 | 0.0013 | good |
CVE-2026-42423 | 5.5 | 7.5 | 0.0032 | good |
CVE-2026-35535 UPD | 5.5 | 7.4 | 0.0017 | good |
CVE-2025-70956 | 5.5 | 7.5 | 0.0046 | good |
CVE-2026-31837 UPD | 5.5 | 7.5 | 0.0038 | good |
CVE-2026-26319 | 5.5 | 7.5 | 0.0028 | good |
CVE-2024-27983 UPD | 8.0 | 8.2 | 0.8721 | partial |
CVE-2026-31409 | 5.5 | 8.8 | 0.0045 | good |
CVE-2026-34063 | 5.5 | 7.5 | 0.0035 | good |
CVE-2026-40246 | 5.5 | 7.5 | 0.0038 | good |
CVE-2026-29643 | 5.5 | 7.1 | 0.0016 | partial |
CVE-2025-70123 | 5.5 | 7.5 | 0.0033 | partial |
CVE-2025-68134 | 5.5 | 7.4 | 0.0016 | partial |
CVE-2025-68141 | 5.5 | 7.4 | 0.0025 | partial |
CVE-2026-28402 | 5.5 | 7.1 | 0.0020 | partial |
CVE-2025-5987 UPD | 5.5 | 8.1 | 0.0144 | partial |
CVE-2022-36127 | 5.5 | 7.5 | 0.0159 | partial |
CVE-2026-1739 | 3.5 | 5.3 | 0.0070 | partial |