NIST 800-53 r5 · Controls catalogue · Family SC

SC-42Sensor Capability and Data

Prohibit {{ insert: param, sc-42_odp.01 }} ; and Provide an explicit indication of sensor use to {{ insert: param, sc-42_odp.05 }}.

Last updated: 22 August 2026 07:11 UTC

Implementations targeting this control (0)

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-200`	Exposure of Sensitive Information to an Unauthorized Actor	11,000+	Requiring explicit sensor-use indication and prohibiting selected capabilities directly reduces covert collection and exposure of sensitive data captured by device sensors.
`CWE-284`	Improper Access Control	6,900+	Prohibiting specific sensor capabilities implements an access-control policy on hardware resources that would otherwise be freely usable by unauthorized software.
`CWE-668`	Exposure of Resource to Wrong Sphere	800+	By restricting sensor activation and surfacing its use, the control prevents sensor data from being transferred into an unintended sphere (e.g., attacker-controlled processes or remote exfiltration).
`CWE-359`	Exposure of Private Personal Information to an Unauthorized Actor	200+	Mandatory user notification of sensor activation makes surreptitious capture of private personal information (camera, microphone, location, etc.) substantially harder to perform without detection.

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.