Cyber Resilience

NIST 800-53 r5 · Controls catalogue · Family SR

SR-4Provenance

Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: {{ insert: param, sr-04_odp }}.

Last updated: 22 August 2026 14:14 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (22)

Weaknesses this control addresses (8)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-502Deserialization of Untrusted Data3,600+Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.
CWE-345Insufficient Verification of Data Authenticity800+Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.
CWE-829Inclusion of Functionality from Untrusted Control Sphere300+Documenting component provenance ensures functionality is only included from verified, trusted control spheres rather than untrusted ones.
CWE-494Download of Code Without Integrity Check200+Tracking provenance of components and code necessitates integrity verification, preventing downloads or inclusions without such checks.
CWE-506Embedded Malicious Code99Valid provenance monitoring makes insertion of embedded malicious code during supply chain or development stages detectable.
CWE-912Hidden Functionality87Provenance tracking of components reveals hidden functionality introduced via supply chain or build processes.
CWE-353Missing Support for Integrity Check44Maintaining valid provenance requires supporting integrity checks on the origin and chain of custody for systems and data.
CWE-1104Use of Unmaintained Third Party Components26Provenance records include supplier and lifecycle details, enabling ongoing monitoring to avoid unmaintained third-party components.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2026-0770 KEV 9.99.80.6292good
CVE-2025-32463 KEV 9.29.30.5876good
CVE-2024-38476 9.19.80.4161good
CVE-2025-70974 7.510.00.0070good
CVE-2025-27668 7.49.80.0064good
CVE-2026-1699 7.410.00.0050good
CVE-2026-26974 7.39.80.0054good
CVE-2025-0982 7.210.00.0026good
CVE-2025-700467.29.80.0036good
CVE-2025-27510 7.09.30.0063good
CVE-2025-36852 7.09.40.0020good
CVE-2026-471727.09.50.0032good
CVE-2026-471747.09.50.0031good
CVE-2025-27607 6.98.80.0155good
CVE-2026-27941 6.99.90.0040good
CVE-2025-53546 6.89.10.0031good
CVE-2026-403136.89.10.0031good
CVE-2026-5241 6.89.60.0055good
CVE-2026-581226.89.10.0029good
CVE-2025-20236 6.78.80.0095good
CVE-2025-8714 6.78.80.0074good
CVE-2025-62726 6.78.80.0076good
CVE-2026-40903 6.79.10.0024good
CVE-2026-714716.79.00.0145good
CVE-2025-65964 6.68.80.0067good

Other controls in family SR

SR-1 SR-10 SR-11 SR-12 SR-2 SR-3 SR-5 SR-6 SR-7 SR-8 SR-9