Security Resilience

NIST 800-53 r5 · Controls catalogue · Family SR

SR-4Provenance

Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: {{ insert: param, sr-04_odp }}.

Last updated: 15 October 2026 14:21 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (22)

Weaknesses this control addresses (8)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-502Deserialization of Untrusted Data4,000+Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.
CWE-345Insufficient Verification of Data Authenticity900+Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.
CWE-829Inclusion of Functionality from Untrusted Control Sphere300+Documenting component provenance ensures functionality is only included from verified, trusted control spheres rather than untrusted ones.
CWE-494Download of Code Without Integrity Check200+Tracking provenance of components and code necessitates integrity verification, preventing downloads or inclusions without such checks.
CWE-506Embedded Malicious Code100+Valid provenance monitoring makes insertion of embedded malicious code during supply chain or development stages detectable.
CWE-912Hidden Functionality89Provenance tracking of components reveals hidden functionality introduced via supply chain or build processes.
CWE-353Missing Support for Integrity Check51Maintaining valid provenance requires supporting integrity checks on the origin and chain of custody for systems and data.
CWE-1104Use of Unmaintained Third Party Components31Provenance records include supplier and lifecycle details, enabling ongoing monitoring to avoid unmaintained third-party components.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2026-0770 KEV 9.99.80.6301good
CVE-2025-32463 KEV 9.29.30.5550good
CVE-2024-38476 9.19.80.4161good
CVE-2025-70974 7.510.00.0076good
CVE-2025-27668 7.49.80.0067good
CVE-2026-1699 7.410.00.0056good
CVE-2026-26974 7.49.80.0078good
CVE-2025-0982 7.210.00.0026good
CVE-2025-700467.29.80.0037good
CVE-2025-27510 7.09.30.0064good
CVE-2025-36852 7.09.40.0025good
CVE-2026-27941 7.09.90.0058good
CVE-2026-471727.09.50.0044good
CVE-2026-471747.09.50.0043good
CVE-2025-27607 6.98.80.0161good
CVE-2026-403136.99.10.0051good
CVE-2026-5241 6.99.60.0094good
CVE-2025-53546 6.89.10.0035good
CVE-2026-40903 6.89.10.0043good
CVE-2026-581226.89.10.0037good
CVE-2026-67623 6.88.80.0106good
CVE-2025-20236 6.78.80.0097good
CVE-2025-8714 6.78.80.0076good
CVE-2025-62726 6.78.80.0081good
CVE-2026-6859 6.78.80.0077good

Other controls in family SR

SR-1 SR-10 SR-11 SR-12 SR-2 SR-3 SR-5 SR-6 SR-7 SR-8 SR-9