NIST 800-53 r5 · Controls catalogue · Family SC
SC-27Platform-independent Applications
Include within organizational systems the following platform independent applications: {{ insert: param, sc-27_odp }}.
Last updated: 22 August 2026 07:11 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 14,500+ | Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation. |
CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 7,600+ | Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection. |
CWE-284 | Improper Access Control | 6,900+ | Sandboxing and security contexts provided by platform-independent runtimes add an enforceable access-control boundary that is independent of the host OS. |
CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 5,300+ | Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows. |
CWE-269 | Improper Privilege Management | 3,400+ | The abstraction layer of platform-independent applications allows centralized privilege management inside the runtime rather than scattered OS-level calls. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,900+ | Platform-independent applications inherit runtime-enforced resource permissions instead of relying on error-prone native file or process permission assignments. |
CWE-250 | Execution with Unnecessary Privileges | 300+ | Runtimes for platform-independent applications commonly support configurable security managers or sandboxes that enforce least privilege by default. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||