NIST 800-53 r5 · Controls catalogue · Family SR
SR-11Component Authenticity
Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and Report counterfeit system components to {{ insert: param, sr-11_odp.01 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 2 mapping(s) from 2 framework(s): OWASP-Web 1 (partial) · CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (15)
- T1059.002 AppleScript Execution
- T1195 Supply Chain Compromise Initial Access
- T1195.001 Compromise Software Dependencies and Development Tools Initial Access
- T1195.002 Compromise Software Supply Chain Initial Access
- T1195.003 Compromise Hardware Supply Chain Initial Access
- T1204.003 Malicious Image Execution
- T1505 Server Software Component Persistence
- T1505.001 SQL Stored Procedures Persistence
- T1505.002 Transport Agent Persistence
- T1505.004 IIS Components Persistence
- T1546.006 LC_LOAD_DYLIB Addition Privilege Escalation, Persistence
- T1554 Compromise Host Software Binary Persistence
- T1601 Modify System Image Defense Impairment
- T1601.001 Patch System Image Defense Impairment
- T1601.002 Downgrade System Image Defense Impairment
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-347 | Improper Verification of Cryptographic Signature | 842 | Authenticity validation commonly relies on cryptographic signature or certificate checks that this control enforces. |
CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | 298 | Anti-counterfeit procedures directly block inclusion of components originating from untrusted supply-chain actors. |
CWE-494 | Download of Code Without Integrity Check | 252 | Detecting counterfeits requires integrity verification of received components before acceptance. |
CWE-506 | Embedded Malicious Code | 85 | Counterfeit components are a common vector for embedding malicious code; preventing their entry reduces this exposure. |
CWE-912 | Hidden Functionality | 79 | Policies that verify component provenance make introduction of hidden or undocumented functionality materially harder. |
CWE-353 | Missing Support for Integrity Check | 40 | The control mandates support for integrity-checking mechanisms to identify non-genuine components. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-33634 KEV | 10.0 | 8.8 | 0.6037 | good |
CVE-2026-34424 | 7.0 | 9.8 | 0.0055 | good |
CVE-2026-6443 | 7.0 | 9.8 | 0.0050 | good |
CVE-2026-34841 | 7.0 | 9.8 | 0.0023 | good |
CVE-2026-40154 | 7.0 | 9.3 | 0.0030 | good |
CVE-2026-31976 | 7.0 | 9.8 | 0.0050 | good |
CVE-2010-20103 | 7.0 | 9.8 | 0.0475 | good |
CVE-2011-10018 | 7.0 | 9.8 | 0.0186 | good |
CVE-2025-34212 | 7.0 | 9.8 | 0.0063 | good |
CVE-2024-41739 | 5.5 | 8.8 | 0.0043 | good |
CVE-2026-41387 | 5.5 | 7.8 | 0.0024 | good |
CVE-2026-4269 | 5.5 | 7.5 | 0.0024 | good |
CVE-2025-27510 | 0.0 | 0.0 | 0.0058 | good |
CVE-2025-59374 KEV | 10.0 | 9.8 | 0.0108 | good |
CVE-2024-41334 | 5.5 | 8.8 | 0.0037 | good |
CVE-2026-28500 UPD | 5.5 | 8.6 | 0.0032 | good |
CVE-2023-24011 | 5.5 | 8.2 | 0.0033 | good |
CVE-2025-21399 | 5.5 | 7.4 | 0.0066 | good |
CVE-2025-15556 KEV | 10.0 | 7.5 | 0.0127 | good |
CVE-2026-8398 KEV UPD | 10.0 | 9.8 | 0.0146 | partial |
CVE-2024-4978 KEV | 10.0 | 8.4 | 0.2694 | partial |
CVE-2025-27680 | 7.0 | 9.1 | 0.0029 | good |
CVE-2026-35044 | 5.5 | 8.8 | 0.0039 | good |
CVE-2026-4478 | 5.5 | 8.1 | 0.0027 | good |
CVE-2025-1058 | 5.5 | 8.1 | 0.0022 | good |