NIST 800-53 r5 · Controls catalogue · Family SC
SC-50Software-enforced Separation and Policy Enforcement
Implement software-enforced separation and policy enforcement mechanisms between {{ insert: param, sc-50_odp }}.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 9,346 | Requires explicit authorization checks as part of the enforced policy between separated components. |
CWE-284 | Improper Access Control | 5,367 | Directly implements software-enforced boundaries that prevent unauthorized access across separated components or domains. |
CWE-863 | Incorrect Authorization | 3,515 | Policy enforcement mechanisms correct or prevent flawed authorization logic across domain boundaries. |
CWE-269 | Improper Privilege Management | 3,104 | Policy enforcement mechanisms limit privilege escalation and improper privilege assignments across boundaries. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Software-enforced separation ensures correct permission assignments on critical resources between domains. |
CWE-285 | Improper Authorization | 1,356 | Enforces policy-based authorization decisions between the separated subjects and objects. |
CWE-250 | Execution with Unnecessary Privileges | 333 | Separation and policy enforcement reduce the ability to execute with unnecessary privileges by isolating higher-privilege functions. |
CWE-653 | Improper Isolation or Compartmentalization | 66 | Explicitly requires isolation and compartmentalization mechanisms that address failures in separating security domains. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2014-0546 KEV | 10.0 | 9.8 | 0.2233 | good |
CVE-2026-33396 | 7.0 | 9.9 | 0.0083 | good |
CVE-2026-27952 | 5.5 | 8.8 | 0.0050 | good |
CVE-2025-0781 | 5.5 | 8.6 | 0.0034 | good |
CVE-2026-27597 | 7.0 | 10.0 | 0.0088 | good |
CVE-2026-25142 | 7.0 | 10.0 | 0.0109 | good |
CVE-2026-34208 | 7.0 | 10.0 | 0.0056 | good |
CVE-2025-24178 | 7.0 | 9.8 | 0.0148 | good |
CVE-2026-29649 | 7.0 | 9.8 | 0.0045 | good |
CVE-2026-40959 | 7.0 | 9.3 | 0.0018 | good |
CVE-2026-25520 | 7.0 | 10.0 | 0.0078 | good |
CVE-2026-25587 | 7.0 | 10.0 | 0.0065 | partial |
CVE-2026-25725 | 7.0 | 10.0 | 0.0042 | good |
CVE-2026-0881 UPD | 7.0 | 10.0 | 0.0031 | good |
CVE-2024-34144 | 7.0 | 9.8 | 0.4808 | good |
CVE-2025-43257 | 5.5 | 8.7 | 0.0018 | good |
CVE-2026-28891 | 5.5 | 8.1 | 0.0014 | good |
CVE-2026-32988 | 5.5 | 7.5 | 0.0008 | good |
CVE-2025-15540 | 5.5 | 8.8 | 0.0048 | good |
CVE-2025-52643 | 3.5 | 4.7 | 0.0009 | good |
CVE-2026-23830 | 7.0 | 10.0 | 0.0112 | good |
CVE-2026-22686 | 7.0 | 10.0 | 0.0059 | good |
CVE-2026-39888 | 7.0 | 9.9 | 0.0054 | good |
CVE-2026-33897 | 7.0 | 9.9 | 0.0048 | good |
CVE-2026-29646 | 7.0 | 9.8 | 0.0037 | good |