NIST 800-53 r5 · Controls catalogue · Family SC
SC-41Port and I/O Device Access
{{ insert: param, sc-41_odp.02 }} disable or remove {{ insert: param, sc-41_odp.01 }} on the following systems or system components: {{ insert: param, sc-41_odp.03 }}.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (5)
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 5,367 | Disabling or removing ports and I/O devices directly enforces hardware-level access control by eliminating entry points. |
CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | 61 | Restricts communication channels to only intended endpoints by eliminating unnecessary ports and devices. |
CWE-300 | Channel Accessible by Non-Endpoint | 54 | Eliminates channels that could be accessed by non-endpoint actors through disabled ports and devices. |
CWE-420 | Unprotected Alternate Channel | 38 | Removes or disables unprotected alternate I/O channels that could otherwise be used to bypass primary controls. |
CWE-1191 | On-Chip Debug and Test Interface With Improper Access Control | 20 | Directly mitigates exposure of on-chip debug and test interfaces by disabling or removing them. |
CWE-1263 | Improper Physical Access Control | 13 | Reduces physical access attack surface by disabling physical ports and I/O devices. |
CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State | 12 | Prevents internal assets from being exposed through debug or test access levels by removing those interfaces. |
CWE-1299 | Missing Protection Mechanism for Alternate Hardware Interface | 11 | Provides protection for alternate hardware interfaces by disabling them when not required. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2018-19322 KEV | 10.0 | 7.8 | 0.0187 | good |
CVE-2026-30704 | 7.0 | 9.1 | 0.0031 | good |
CVE-2024-48123 | 5.5 | 8.4 | 0.0018 | good |
CVE-2026-29093 | 5.5 | 8.1 | 0.0049 | good |
CVE-2024-55407 | 5.5 | 7.8 | 0.0021 | good |
CVE-2024-55412 | 5.5 | 7.8 | 0.0021 | good |
CVE-2026-25086 | 5.5 | 7.7 | 0.0015 | good |
CVE-2024-53197 KEV | 10.0 | 7.8 | 0.0356 | partial |
CVE-2024-53150 KEV | 10.0 | 7.1 | 0.0132 | partial |
CVE-2015-1769 KEV | 10.0 | 6.6 | 0.0434 | good |
CVE-2025-30113 | 7.0 | 9.8 | 0.0041 | good |
CVE-2025-54304 | 7.0 | 9.8 | 0.0044 | good |
CVE-2022-24082 | 7.0 | 9.8 | 0.0948 | good |
CVE-2026-27182 | 5.5 | 8.4 | 0.0121 | good |
CVE-2026-25807 | 5.5 | 8.8 | 0.0064 | good |
CVE-2025-55221 | 5.5 | 8.6 | 0.0036 | good |
CVE-2024-55413 | 5.5 | 7.8 | 0.0021 | good |
CVE-2025-30141 | 5.5 | 7.5 | 0.0033 | good |
CVE-2022-50976 | 5.5 | 7.7 | 0.0014 | good |
CVE-2021-47786 | 5.5 | 7.5 | 0.0044 | good |
CVE-2024-40431 | 5.5 | 8.8 | 0.0127 | good |
CVE-2026-2038 | 7.0 | 9.8 | 0.0065 | good |
CVE-2026-26333 | 7.0 | 9.8 | 0.0093 | good |
CVE-2025-59403 | 7.0 | 9.8 | 0.0100 | good |
CVE-2025-30137 | 7.0 | 9.8 | 0.0044 | good |