NIST 800-53 r5 · Controls catalogue · Family SI
SI-20Tainting
Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: {{ insert: param, si-20_odp }}.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (3)
- aws-config-cloudwatch-alarm-action-check Critical CloudWatch alarms have at least one action AWS::CloudWatch::Alarm partial detect enforce
- aws-config-cloud-trail-cloud-watch-logs-enabled Cloud Trail Cloud Watch Logs Enabled AWS::CloudTrail::Trail partial detect enforce
- aws-config-guardduty-enabled-centralized Guardduty Enabled Centralized AWS::GuardDuty::Detector partial detect enforce
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Tainting directly detects exfiltration resulting from exposure of sensitive information to unauthorized actors. |
CWE-552 | Files or Directories Accessible to External Parties | 563 | Detects improper removal of data from files or directories that are accessible to external parties. |
CWE-201 | Insertion of Sensitive Information Into Sent Data | 353 | Embedding taints allows detection when sensitive data is inserted into outbound or sent data streams. |
CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 342 | The control detects removal of sensitive system information into an unauthorized control sphere. |
CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | 190 | Tainting enables identification of exfiltration of private personal information to unauthorized parties. |
CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | 93 | Tainting makes it possible to determine when sensitive data has been removed from externally accessible files or directories. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2022-41049 KEV | 10.0 | 5.4 | 0.0248 | good |
CVE-2026-33873 | 7.0 | 9.9 | 0.0143 | good |
CVE-2026-25881 | 7.0 | 9.0 | 0.0055 | good |
CVE-2025-21622 | 5.5 | 7.5 | 0.0092 | good |
CVE-2026-34041 | 7.0 | 9.8 | 0.0062 | good |