NIST 800-53 r5 · Controls catalogue · Family SC
SC-31Covert Channel Analysis
Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert {{ insert: param, sc-31_odp }} channels; and Estimate the maximum bandwidth of those channels.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (11)
- T1041 Exfiltration Over C2 Channel Exfiltration
- T1048 Exfiltration Over Alternative Protocol Exfiltration
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
- T1071 Application Layer Protocol Command And Control
- T1071.001 Web Protocols Command And Control
- T1071.002 File Transfer Protocols Command And Control
- T1071.003 Mail Protocols Command And Control
- T1071.004 DNS Command And Control
- T1071.005 Publish/Subscribe Protocols Command And Control
- T1567 Exfiltration Over Web Service Exfiltration
Weaknesses this control addresses (3)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-203 | Observable Discrepancy | 854 | Observable discrepancies in system behavior can be modulated to create covert storage or timing channels; the required analysis detects and constrains such avenues. |
CWE-208 | Observable Timing Discrepancy | 147 | Observable timing discrepancies are a primary mechanism for constructing covert timing channels; analysis identifies and bounds them, limiting exploitation. |
CWE-385 | Covert Timing Channel | 43 | Directly targets covert timing channels by requiring identification and bandwidth estimation, enabling mitigation that reduces or eliminates their usability. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-48630 | 5.5 | 7.4 | 0.0009 | good |
CVE-2024-49734 | 5.5 | 7.5 | 0.0028 | good |
CVE-2026-25222 | 5.5 | 7.5 | 0.0041 | good |
CVE-2025-70949 | 5.5 | 7.5 | 0.0038 | good |
CVE-2026-23519 | 7.0 | 9.8 | 0.0050 | good |
CVE-2022-24436 | 6.0 | 6.5 | 0.1212 | partial |
CVE-2024-13939 | 5.5 | 7.5 | 0.0034 | good |