NIST 800-53 r5 · Controls catalogue · Family SC

SC-42Sensor Capability and Data

Prohibit {{ insert: param, sc-42_odp.01 }} ; and Provide an explicit indication of sensor use to {{ insert: param, sc-42_odp.05 }}.

Last updated: 04 July 2026 00:28 UTC

Implementations targeting this control (0)

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-200`	Exposure of Sensitive Information to an Unauthorized Actor	10,501	Requiring explicit sensor-use indication and prohibiting selected capabilities directly reduces covert collection and exposure of sensitive data captured by device sensors.
`CWE-284`	Improper Access Control	5,367	Prohibiting specific sensor capabilities implements an access-control policy on hardware resources that would otherwise be freely usable by unauthorized software.
`CWE-668`	Exposure of Resource to Wrong Sphere	797	By restricting sensor activation and surfacing its use, the control prevents sensor data from being transferred into an unintended sphere (e.g., attacker-controlled processes or remote exfiltration).
`CWE-359`	Exposure of Private Personal Information to an Unauthorized Actor	190	Mandatory user notification of sensor activation makes surreptitious capture of private personal information (camera, microphone, location, etc.) substantially harder to perform without detection.

CVE	Risk	CVSS	EPSS	Match
`CVE-2025-69515`	7.0	9.1	0.0050	good
`CVE-2017-20213`	5.5	7.5	0.0042	good