Cyber Resilience

← ISO 27001 Annex A

A.8.27 Technological

Secure system architecture and engineering principles

AttributesPreventive C·I·A Protect Application security System and network security Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (14)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-6←P →P CM-7←P →P PL-8←M →M SA-17←M →P SA-3←P SA-4←M SC-2→M SC-7→P SA-8gov

Why these map — AI rationale (under review)

PL-8mostlyaligns with — Both controls require a documented security architecture that integrates controls across business, data, application, and technology layers to meet identified threats.
SC-2mostlyaligns with — The ISO control explicitly calls for separation of system and user functionality through principles such as least privilege and least functionality, matching SC-2's objective.
AC-6partialaligns with — A.8.27 requires least-privilege and dynamic access control techniques as core engineering principles, satisfying the same objective as AC-6.
CM-7partialaligns with — The ISO control lists least functionality among its mandated secure-engineering principles, directly supporting CM-7's goal of restricting systems to only essential capabilities.
SA-17partialaligns with — A.8.27 requires security-oriented design reviews and formal documentation of security controls, aligning with SA-17's focus on developer security architecture and design.
SC-7partialaligns with — Zero-trust guidance in A.8.27, including never-trust-always-verify and end-to-end encryption, aligns with SC-7's boundary-protection and information-flow objectives without replacing perimeter controls.
SA-8noneimplements — ISO A.8.27 mandates the establishment and application of security engineering principles across all architecture layers, directly encompassing the intent of SA-8 to embed security and privacy principles into system design and development.

Aligned NIST CSF 2.0 outcomes (11)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

GV.SC-05←P →P ID.AM-08←M ID.RA-05→P PR.AA-05→M PR.IR-01←M →M PR.PS-01←M →M PR.PS-06←M →P

Why these map — AI rationale (under review)

PR.AA-05mostlyaligns with — By requiring dynamic access control, contextual authorization, and least-privilege enforcement within system design, the control satisfies the CSF outcome of defining, managing, and enforcing access permissions and entitlements.
PR.IR-01mostlycovers — The control's emphasis on embedding security architecture principles such as defense-in-depth, least privilege, and zero-trust directly produces the outcome of protecting networks and environments from unauthorized logical access.
PR.PS-01mostlyaligns with — Mandating security-oriented design reviews, hardening, and formal documentation of controls that do not fully meet requirements aligns with establishing and applying configuration-management practices.
GV.SC-05partialaligns with — Extending the same security-engineering principles to suppliers via binding agreements aligns with establishing and integrating cybersecurity requirements into supplier contracts.
ID.RA-05partialaligns with — Analyzing the full range of required controls against identified threats and attack patterns supports the CSF outcome of using threats, vulnerabilities, likelihoods, and impacts to understand inherent risk and prioritize responses.
PR.PS-06partialaligns with — Requiring that secure engineering principles be applied to outsourced development through contracts integrates secure software-development practices into the system life cycle.

Related OWASP ASVS 5.0 requirements (15)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V1.2.4←P V1.3.6→P V13.2.4→P V15.2.3←P →P V16.5.3←P V2.2.1←M V2.2.2→P V6.3.3←M →P V7.2.1←P V8.2.1←M V8.2.4→M V8.3.1←M →M

Why these map — AI rationale (under review)

V8.2.4mostlycovers — Requiring dynamic access control based on contextual attributes such as user identity, device posture and data classification satisfies the ASVS expectation that authorization adapt to environmental and contextual factors.
V8.3.1mostlycovers — The ISO control's mandate to enforce authorization at a trusted service layer and integrate controls into the security architecture directly implements the ASVS requirement that authorization decisions must not rely on untrusted client-side enforcement.
V1.3.6partialaligns with — The principle of distrusting input from external applications and verifying every request maps to the ASVS control that protects against server-side request forgery by validating untrusted data against an allow-list.
V13.2.4partialaligns with — The ISO directive to maintain an allow-list of permitted external resources and systems corresponds to the ASVS requirement that outbound connections be restricted to an explicitly approved set of destinations.
V15.2.3partialaligns with — The ISO principle of least functionality, which removes unnecessary features and hardens systems, aligns with the ASVS requirement that production deployments contain only the minimal functionality needed for operation.
V2.2.2partialaligns with — The ISO guidance to distrust external input and perform validation at a trusted service layer aligns with the ASVS requirement that input validation be enforced server-side rather than solely on the client.
V6.3.3partialaligns with — The ISO requirement for strong authentication and multi-factor verification for every access request aligns with the ASVS mandate that multi-factor or equivalent-strength controls be used for sensitive operations.

Related weaknesses / CWE (776)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-1007←P →P CWE-1021←P →P CWE-1022←P →P CWE-1023←P →P CWE-1024←P CWE-1037←P CWE-1038←P →P CWE-1039←P →P CWE-1049←P →P CWE-1051→P CWE-1055←P →P CWE-1057→P CWE-1058←P →P CWE-1059←P →M CWE-1066←P →P CWE-1067←P →P CWE-1068→P CWE-1072→P CWE-1076←P →M CWE-1083←P →M CWE-1088←P →P CWE-1091←P →P CWE-1100←P →M CWE-1102←P CWE-1103←P →P CWE-1106→P CWE-1107←P →P CWE-1108←P →P CWE-111←P →P CWE-112→P CWE-1124←P CWE-1125←P →M CWE-113→P CWE-114←P →P CWE-115←P →P CWE-116→P CWE-1173→P CWE-1176←P CWE-118←P →P CWE-1189←P →M CWE-119←P →P CWE-1190←P →M CWE-1191←P →P CWE-120←P →P CWE-121←P →P CWE-122←P →P CWE-1221←P →P CWE-1222←P →P CWE-1223←P →M CWE-1224←P →P CWE-123←P →P CWE-1231←P →P CWE-1233←P →P CWE-1234←P →P CWE-1236→P CWE-124←P →P CWE-1240←P →P CWE-1241→P CWE-1242←P →P CWE-1244←P →P CWE-1245←P →P CWE-1246←P →P CWE-1247←P →P CWE-125←P →P CWE-1250←P →M CWE-1251←P →P CWE-1253←P →P CWE-1254←P →P CWE-1255←P →P CWE-1256←P →P CWE-1257←P →M CWE-1258←P →P CWE-1259→P CWE-126←P →P CWE-1260←P →P CWE-1262→P CWE-1264←P →P CWE-1265←P →P CWE-127←P →P CWE-1274←P →P CWE-1278←P →P CWE-1279←P →P CWE-128←P →P CWE-1280→P CWE-1281←P →P CWE-1282←P →P CWE-1283←P →P CWE-1284→P CWE-1285←P →P CWE-1286→P CWE-1287←P →P CWE-1288→P CWE-1289←P →P CWE-129→P CWE-1298←P →P CWE-1299←P →M CWE-130←P →P CWE-1300→P CWE-1303←P →P CWE-131←P →P CWE-1310→P CWE-1312←P →P CWE-1313←P →P CWE-1314←P →M CWE-1316←P →M CWE-1319→P CWE-1320←P →P CWE-1321→P CWE-1322←P →P CWE-1323←P →P CWE-1325→P CWE-1326←P →P CWE-1327←P →M CWE-1328→P CWE-1332←P →P CWE-1333→P CWE-1334→P CWE-1335←P CWE-1336→P CWE-134←P →P CWE-1341←P CWE-1342→P CWE-135←P →P CWE-138→P CWE-1385←P →P CWE-1386←P →P CWE-141→P CWE-142←P →P CWE-143→P CWE-144→P CWE-145→P CWE-146→P CWE-147→P CWE-148←P →P CWE-149→P CWE-150→P CWE-154→P CWE-155→P CWE-156→P CWE-157→P CWE-158→P CWE-159→P CWE-160→P CWE-162→P CWE-164→P CWE-166→P CWE-167←P →P CWE-168→P CWE-170←P CWE-172←P →P CWE-173←P →P CWE-176←P →P CWE-178←P →P CWE-179→P CWE-180→P CWE-182←P →P CWE-183←P →P CWE-184←P →P CWE-187←P CWE-188←P →P CWE-190←P CWE-191←P →P CWE-192←P →P CWE-193←P →P CWE-194←P →P CWE-195←P →P CWE-196←P →P CWE-197←P CWE-198←P →P CWE-20→P CWE-200→P CWE-204←P →P CWE-205←P →P CWE-207→P CWE-209→P CWE-210→P CWE-219←P →M CWE-22←P →P CWE-228→P CWE-229→P CWE-23←P →P CWE-231→P CWE-232←P →P CWE-234←P CWE-237←P →P CWE-24→P CWE-240←P →P CWE-241→P CWE-248←P →P CWE-25→P CWE-252←P CWE-253←P →P CWE-26→P CWE-267→P CWE-269→P CWE-27→P CWE-270←P →P CWE-277←P →P CWE-28←P →P CWE-284→P CWE-287→P CWE-288→P CWE-29←P →P CWE-290←P →P CWE-297←P →P CWE-30→P CWE-301→P CWE-306→P CWE-31→P CWE-32→P CWE-322→P CWE-329→P CWE-332→P CWE-333→P CWE-337→P CWE-338→P CWE-34→P CWE-342→P CWE-343→P CWE-344→P CWE-346→P CWE-348→M CWE-349←P →P CWE-35←P →P CWE-350←P →P CWE-351←P →P CWE-353←P →P CWE-356→P CWE-357←P →P CWE-358←P →P CWE-36←P →P CWE-360←P →P CWE-362←P →P CWE-363←P →P CWE-364←P CWE-366←P →P CWE-368←P →P CWE-369←P →P CWE-37←P →P CWE-372←P →P CWE-374←P →P CWE-377→P CWE-378←P →P CWE-379←P →P CWE-38→P CWE-385→P CWE-386←P →P CWE-39←P →P CWE-391←P CWE-40←P →P CWE-401←P →P CWE-407←P →P CWE-409→P CWE-41←P →P CWE-410→P CWE-412→P CWE-413←P →P CWE-415→P CWE-416←P →P CWE-419←P →P CWE-42←P →P CWE-421←P →P CWE-422←P →P CWE-424←P →P CWE-426←P →P CWE-427←P →P CWE-428←P CWE-43←P →P CWE-430←P →P CWE-431←P →P CWE-433→P CWE-435←P →M CWE-436←P →P CWE-437←P →P CWE-44←P →P CWE-441←P →P CWE-444←P →P CWE-446→P CWE-450←P →P CWE-453←P →P CWE-454←P →P CWE-455←P →P CWE-456←P CWE-46←P →P CWE-460←P →P CWE-462←P CWE-466←P CWE-469←P CWE-470←P →P CWE-471→P CWE-474←P CWE-475←P →P CWE-476←P →P CWE-479←P CWE-488←P →P CWE-491←P →P CWE-495←P →P CWE-499←P →P CWE-50←P →P CWE-501←P →M CWE-514←P →P CWE-515←P →P CWE-523→P CWE-526←P →P CWE-535→P CWE-544←P →P CWE-548←P →P CWE-550←P →P CWE-551←P →P CWE-553→P CWE-556→P CWE-562←P CWE-564→P CWE-566→P CWE-567←P →P CWE-57→P CWE-573←P →P CWE-587←P →P CWE-588←P →P CWE-59←P →P CWE-590←P →P CWE-598→P CWE-600←P →P CWE-602→M CWE-603←P →M CWE-605←P →P CWE-61←P →P CWE-610←P →P CWE-611→P CWE-616→P CWE-617←P →P CWE-618←P →P CWE-62←P →P CWE-621→P CWE-622←P →P CWE-623→P CWE-624←P CWE-626←P →P CWE-627←P →P CWE-637←P →M CWE-641→P CWE-642→M CWE-643→P CWE-644→P CWE-646←P →P CWE-648←P →P CWE-649←P →P CWE-65←P →P CWE-650←P →P CWE-652→P CWE-653←P →M CWE-656←P →M CWE-657←F →F CWE-66←P →P CWE-662←P →P CWE-663←P →P CWE-664→P CWE-665←P →P CWE-667←P →P CWE-669←P →P CWE-67→P CWE-674→P CWE-675←P →P CWE-680←P →P CWE-681←P →P CWE-682←P CWE-686←P CWE-687←P →P CWE-689←P →P CWE-690←P →P CWE-691←P →P CWE-695←P →P CWE-696←P →P CWE-697←P →P CWE-698←P →P CWE-704←P CWE-706←P →P CWE-707←P →P CWE-73→P CWE-732→P CWE-74→P CWE-749←P →P CWE-75→P CWE-754←P →P CWE-755←P →P CWE-757→P CWE-758←P CWE-76←P →P CWE-760→P CWE-762←P CWE-763←P →P CWE-764←P →P CWE-765←P →P CWE-767←P →P CWE-768←P CWE-77→P CWE-771←P →P CWE-774←P →P CWE-776→P CWE-780→P CWE-782→P CWE-786←P →P CWE-787←P →P CWE-788←P →P CWE-789←P →P CWE-790←P →P CWE-791←P →P CWE-792→P CWE-794→P CWE-799→P CWE-805←P →P CWE-807←P →P CWE-81→P CWE-82←P →P CWE-820←P →P CWE-821←P →P CWE-822←P →P CWE-823←P CWE-824←P CWE-825→P CWE-826←P →P CWE-827←P →P CWE-828←P CWE-83→P CWE-830←P →M CWE-832←P →P CWE-833←P →P CWE-834←P →P CWE-839←P →P CWE-841←P →P CWE-843←P →P CWE-862→P CWE-87→P CWE-88←P →P CWE-908←P →P CWE-909→P CWE-91→P CWE-910←P CWE-911←P →P CWE-912←P →P CWE-913←P →P CWE-914←P →P CWE-915←P →P CWE-917→P CWE-923→P CWE-925←P →P CWE-926→P CWE-927←P →P CWE-93→P CWE-941→P CWE-942←P →P CWE-943→P CWE-95→P CWE-96→P CWE-97→P CWE-98→P CWE-99→P

Why these map — AI rationale (under review)

CWE-657fullprevents — Secure system architecture and engineering principles are the explicit embodiment of the secure design principles violated by CWE-657.
CWE-1059mostlyprevents — Secure architecture principles require documented engineering decisions and component descriptions.
CWE-1076mostlyprevents — Architecture principles may include conventions but are not the primary enforcement mechanism.
CWE-1083mostlyprevents — Secure system architecture principles require centralized data access mediation, mitigating the architectural flaw described by CWE-1083.
CWE-1100mostlyprevents — Secure system architecture and engineering principles explicitly require modular isolation of system-dependent functions.
CWE-1125mostlyprevents — Secure architecture principles explicitly call for minimizing the attack surface through least functionality.
CWE-1189mostlyprevents — Secure system architecture and engineering principles directly require hardware-level isolation of shared SoC resources.
CWE-1190mostlyprevents — Secure system architecture principles require DMA devices to be enabled only after security settings are active.
CWE-1223mostlyprevents — Secure system architecture and engineering principles can mandate hardware access ordering and initialization sequencing to prevent race conditions.
CWE-1250mostlyprevents — Secure architecture principles can address distributed-state design yet leave the actual consistency mechanisms unspecified.
CWE-1257mostlyprevents — Secure system architecture principles require consistent access-control enforcement across mirrored memory regions.
CWE-1299mostlyprevents — Secure system architecture and engineering principles require protection of all interfaces, directly addressing unguarded alternate hardware paths.
CWE-1314mostlyprevents — Secure system architecture and engineering principles require hardware-level write-protection for critical sensor parameters.
CWE-1316mostlyprevents — Secure system architecture and engineering principles directly require non-overlapping protected address ranges in fabric design.
CWE-1327mostlyprevents — Secure architecture principles discourage exposing services on all interfaces, though the control is broader than this single weakness.
CWE-219mostlymitigates — Secure architecture principles discourage storing sensitive data in publicly served directories.
CWE-348mostlyprevents — Secure architecture principles include trusted input channels and source verification mechanisms.
CWE-435mostlyprevents — Secure architecture principles address component interfaces and composition risks.
CWE-501mostlyprevents — Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.
CWE-602mostlyprevents — Secure architecture principles discourage client-side trust but do not directly address this weakness.
CWE-603mostlyprevents — Promotes secure architecture principles that reject client-only authentication designs.
CWE-637mostlyprevents — Secure system architecture and engineering principles explicitly require simplicity and minimalism, directly mitigating unnecessary complexity.
CWE-642mostlyprevents — Secure architecture principles discourage external control of security-critical state.
CWE-653mostlyprevents — Secure system architecture principles explicitly call for isolation and least-privilege boundaries.
CWE-656mostlyprevents — Requires secure architecture and engineering principles that reject reliance on obscurity.
CWE-830mostlyprevents — Secure architecture principles discourage embedding untrusted content, yet require additional controls for full mitigation.
CWE-1007partialprevents — Secure architecture principles can include user-interface protections that reduce visual ambiguity.
CWE-1021partialprevents — Secure architecture principles include isolation of UI layers and proper use of browser security controls.
CWE-1022partialprevents — Secure architecture principles include isolation of untrusted content and safe navigation patterns that mitigate opener-based attacks.
CWE-1023partialprevents — Secure architecture principles can require exhaustive entity comparisons, yet the control addresses many other design concerns.
CWE-1038partialprevents — Secure architecture and engineering principles require explicit validation that automated optimizations preserve security assumptions.
CWE-1039partialprevents — Secure architecture principles include resilience against input manipulation and adversarial ML attacks.
CWE-1049partialprevents — Secure architecture principles include database design and indexing standards that mitigate large-table query risks.
CWE-1051partialprevents — Secure system architecture principles discourage embedding network identifiers in code, but the control is broader.
CWE-1055partialprevents — Secure system architecture principles discourage complex inheritance that leads to fragile designs.
CWE-1057partialprevents — Secure architecture principles require all data operations to flow through the designated manager component.
CWE-1058partialprevents — Secure architecture principles require proper concurrency controls and avoidance of shared mutable static data.
CWE-1066partialprevents — Secure architecture principles mandate explicit serialization controls for serializable objects.
CWE-1067partialmitigates — Secure architecture principles include data-access efficiency and proper indexing strategies.
CWE-1068partialprevents — Secure architecture principles guide design but do not verify that code follows the documented design.
CWE-1072partialprevents — Secure system architecture principles may recommend efficient resource management including pooling, yet do not mandate it.
CWE-1088partialprevents — Secure architecture principles encourage defensive coding patterns such as timeouts, but do not prescribe them explicitly.
CWE-1091partialprevents — Secure architecture principles include lifecycle management and resource-release mechanisms.
CWE-1103partialmitigates — Secure architecture principles can require abstraction layers or portable component selection.
CWE-1106partialprevents — Secure architecture principles promote maintainable code that favors named constants.
CWE-1107partialprevents — Secure system architecture and engineering principles promote modular, centralized constant handling to improve maintainability.
CWE-1108partialprevents — Secure architecture principles promote limited scope and explicit interfaces over global variables.
CWE-111partialprevents — Secure architecture principles discourage direct unsafe JNI and favor safer integration patterns.
CWE-112partialprevents — Secure architecture principles encourage defensive input handling but do not prescribe XML schema validation.
CWE-113partialprevents — Secure architecture principles reduce the likelihood of header-splitting vulnerabilities through proper component isolation.
CWE-114partialprevents — Secure architecture principles discourage reliance on untrusted external processes or libraries.
CWE-115partialprevents — Secure architecture principles include defensive input processing and error handling that reduce misinterpretation risks.
CWE-116partialprevents — Secure architecture principles reduce the likelihood of missing encoding but do not prescribe the actual technique.
CWE-1173partialprevents — Secure architecture principles encourage validated input handling but do not prescribe frameworks.
CWE-118partialprevents — Secure architecture principles promote defensive coding that limits out-of-bounds access.
CWE-119partialprevents — Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.
CWE-1191partialprevents — Secure architecture principles include hardware access-control mechanisms for debug and test interfaces.
CWE-120partialprevents — Secure system architecture and engineering principles promote defensive coding patterns that reduce the likelihood of unchecked buffer copies.
CWE-121partialprevents — Secure architecture principles include memory-safety and least-privilege stack usage.
CWE-122partialprevents — Secure architecture and engineering principles include memory-safety and input-validation controls that address heap overflows.
CWE-1221partialprevents — Secure system architecture and engineering principles guide the selection of safe register defaults and module parameters.
CWE-1222partialprevents — Secure architecture principles require appropriate granularity of protection mechanisms, directly addressing the register-lock design flaw.
CWE-1224partialprevents — Secure system architecture and engineering principles directly address hardware register design correctness.
CWE-123partialprevents — Secure architecture and engineering principles discourage unsafe memory handling that leads to write-what-where vulnerabilities.
CWE-1231partialprevents — Secure system architecture principles can mandate one-time lock-bit setting, but the control does not enforce hardware-level protection.
CWE-1233partialprevents — Secure system architecture principles require hardware lock-bit protection for critical configuration registers.
CWE-1234partialprevents — Secure system architecture and engineering principles can mandate hardware lock enforcement during debug, covering most of the weakness.
CWE-1236partialprevents — Secure architecture principles encourage safe data export design but do not specifically address CSV formula neutralization.
CWE-124partialprevents — Secure architecture and engineering principles require safe memory-handling patterns.
CWE-1240partialprevents — Secure architecture principles include selection of proven cryptographic components and avoidance of custom risky implementations.
CWE-1241partialprevents — Secure engineering principles include selection of cryptographically strong random number generators.
CWE-1242partialprevents — Secure system architecture and engineering principles mandate documented, minimal, and auditable designs, limiting chicken bits.
CWE-1244partialprevents — Secure system architecture principles can require proper debug port isolation, yet the control is broader than this specific weakness.
CWE-1245partialprevents — Secure system architecture and engineering principles directly address proper FSM design and state validation.
CWE-1246partialprevents — Secure system architecture and engineering principles include selecting and configuring storage technologies to avoid premature wear-out.
CWE-1247partialprevents — Secure system architecture and engineering principles can mandate glitch-detection circuitry and fault-injection countermeasures.
CWE-125partialprevents — Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.
CWE-1251partialprevents — Secure architecture principles require consistent state across replicated components, directly addressing mirrored-region integrity.
CWE-1253partialprevents — Secure system architecture and engineering principles require hardware fuses to be selected and blown so that the secure state is the default.
CWE-1254partialprevents — Secure system architecture principles can mandate constant-time primitives to eliminate timing side-channels.
CWE-1255partialmitigates — Secure architecture principles include hardware and software countermeasures against physical side-channel attacks.
CWE-1256partialprevents — Secure system architecture and engineering principles require hardware abstraction layers and access mediation that directly address improper exposure of hardware features.
CWE-1258partialprevents — Secure system architecture and engineering principles directly address clearing of sensitive data on debug transitions.
CWE-1259partialprevents — Secure architecture principles can guide token protection mechanisms but do not enforce assignment rules.
CWE-126partialprevents — Secure architecture principles include memory-safety and bounds-checking design choices.
CWE-1260partialprevents — Secure system architecture and engineering principles require explicit memory-range separation and protection mechanisms that directly prevent overlapping protected regions.
CWE-1262partialprevents — Secure architecture principles require proper hardware register access controls by design.
CWE-1264partialprevents — Secure system architecture and engineering principles require proper sequencing of security checks before data forwarding in hardware logic.
CWE-1265partialprevents — Secure architecture principles such as thread-safety and state isolation help prevent unintended reentrant invocations.
CWE-127partialprevents — Secure architecture principles include memory-safety and bounds-checking mechanisms.
CWE-1274partialprevents — Secure system architecture principles include memory protection mechanisms that can mitigate this weakness.
CWE-1278partialprevents — Secure engineering principles can include anti-reverse-engineering measures such as obfuscation or tamper resistance.
CWE-1279partialprevents — Requires secure system architecture and engineering principles that would address readiness of cryptographic inputs.
CWE-128partialprevents — Secure architecture principles include use of safe data types and overflow detection mechanisms.
CWE-1280partialprevents — Promotes secure architecture that can embed early checks, but does not mandate them.
CWE-1281partialprevents — Secure system architecture and engineering principles can mandate hardware-abstraction layers and errata handling to prevent processor lock states.
CWE-1282partialprevents — Secure system architecture principles require hardware write-protection or one-time-programmable memory for immutable data.
CWE-1283partialprevents — Secure architecture principles require hardware-protected, immutable attestation registers.
CWE-1284partialprevents — Secure architecture principles encourage robust input handling but do not specifically address quantity validation.
CWE-1285partialprevents — Secure architecture principles include defensive input validation and bounds checking for indexable resources.
CWE-1286partialprevents — Secure architecture principles reduce the likelihood of missing syntactic checks.
CWE-1287partialprevents — Secure architecture principles promote defensive input handling and type enforcement at system boundaries.
CWE-1288partialprevents — Secure architecture principles encourage robust input handling but do not specifically mandate consistency validation.
CWE-1289partialprevents — Secure architecture principles include proper input validation and canonicalization to avoid unsafe equivalence.
CWE-129partialprevents — Secure architecture principles encourage defensive coding patterns that reduce index-related vulnerabilities.
CWE-1298partialprevents — Secure system architecture and engineering principles require timing analysis to avoid race conditions in hardware logic.
CWE-130partialprevents — Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
CWE-1300partialmitigates — Secure engineering principles can mandate hardware or software side-channel protections.
CWE-1303partialmitigates — Secure system architecture principles can mandate hardware-level isolation of microarchitectural resources.
CWE-131partialprevents — Secure architecture principles include safe memory-allocation guidelines.
CWE-1310partialprevents — Secure architecture principles recommend patchable components, yet the control does not specifically require ROM update mechanisms.
CWE-1312partialprevents — Secure system architecture principles require complete address-space protection, directly addressing missing mirrored-region coverage.
CWE-1313partialprevents — Secure system architecture and engineering principles require disabling or locking debug/test logic in production hardware.
CWE-1319partialprevents — Secure system architecture principles can include hardware-level countermeasures against EM-FI, though the control is not specific to this threat.
CWE-1320partialprevents — Secure architecture principles address integrity of error and alert mechanisms.
CWE-1321partialprevents — Secure architecture principles reduce the likelihood of prototype pollution through safe design patterns.
CWE-1322partialprevents — Secure system architecture principles include designing for non-blocking, scalable concurrency models.
CWE-1323partialprevents — Secure architecture principles require protected storage and transport paths for trace data.
CWE-1325partialprevents — Secure architecture principles can mandate bounded resource usage, but eliminating this CWE does not address broader architectural controls.
CWE-1326partialprevents — Secure system architecture and engineering principles require hardware roots of trust to prevent bypass of secure boot.
CWE-1328partialprevents — Secure architecture principles can mandate hardware-enforced version counters or fuses.
CWE-1332partialprevents — Secure system architecture and engineering principles can require hardware-level fault detection and instruction-integrity mechanisms.
CWE-1333partialprevents — Secure architecture principles encourage avoidance of computationally expensive constructs such as catastrophic backtracking.
CWE-1334partialprevents — Secure system architecture principles include designing redundancy so that single-point error injection is harder.
CWE-1336partialprevents — Secure architecture principles reduce the likelihood of unsafe template processing but do not prescribe specific neutralization techniques.
CWE-134partialprevents — Secure architecture principles discourage dangerous string-handling patterns that lead to format-string issues.
CWE-1342partialmitigates — Secure architecture principles include selecting processors or designs that reduce microarchitectural leakage.
CWE-135partialprevents — Secure system architecture and engineering principles can incorporate input validation and encoding-aware string handling to mitigate this weakness.
CWE-138partialprevents — Secure system architecture principles reduce attack surface but do not prescribe the specific neutralization techniques needed for CWE-138.
CWE-1385partialprevents — Secure architecture principles can require proper origin validation mechanisms in WebSocket implementations.
CWE-1386partialprevents — Secure system architecture principles include canonicalization and path-traversal defenses that mitigate junction attacks.
CWE-141partialprevents — Secure system architecture principles encourage safe interfaces but do not prescribe delimiter neutralization.
CWE-142partialprevents — Secure system architecture and engineering principles require defensive coding patterns that neutralize special characters.
CWE-143partialprevents — Secure architecture principles encourage safe data-flow design but do not prescribe delimiter neutralization.
CWE-144partialprevents — Secure architecture principles encourage safe data handling but do not specifically address line-delimiter neutralization.
CWE-145partialprevents — Secure system architecture principles reduce delimiter injection risk through proper component isolation.
CWE-146partialprevents — Secure architecture principles reduce attack surface but do not prescribe delimiter neutralization.
CWE-147partialprevents — Secure architecture principles encourage robust input handling but do not prescribe the specific neutralization technique.
CWE-148partialprevents — Secure system architecture principles address robust input parsing and neutralization of malformed leaders.
CWE-149partialprevents — Secure architecture principles reduce the attack surface but do not prescribe the specific quoting-neutralization technique.
CWE-150partialprevents — Secure architecture principles reduce attack surface but do not prescribe specific neutralization techniques.
CWE-154partialprevents — Secure architecture principles reduce the attack surface for delimiter injection but do not prescribe the actual neutralization technique.
CWE-155partialprevents — Secure architecture principles encourage safe handling of untrusted input but do not prescribe specific wildcard neutralization.
CWE-156partialprevents — Secure system architecture principles may indirectly support input handling but do not specifically address whitespace neutralization.
CWE-157partialprevents — Secure system architecture principles can guide design choices that reduce delimiter-related parsing risks.
CWE-158partialprevents — Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
CWE-159partialprevents — Secure architecture principles reduce attack surface but do not prescribe specific input-filtering techniques.
CWE-160partialprevents — Secure architecture principles reduce injection vectors but do not prescribe specific neutralization techniques.
CWE-162partialprevents — Secure architecture principles may indirectly reduce such weaknesses but do not specifically address input neutralization.
CWE-164partialprevents — Secure system architecture principles reduce attack surface but do not specifically address neutralization of internal special elements.
CWE-166partialprevents — Secure architecture principles may indirectly reduce malformed-input risks but do not specifically address missing elements.
CWE-167partialprevents — Secure architecture principles include defensive input handling to prevent injection or parsing anomalies.
CWE-168partialprevents — Secure architecture principles encourage consistent data handling but do not directly address this weakness.
CWE-172partialprevents — Secure system architecture and engineering principles address data handling and transformation correctness.
CWE-173partialprevents — Secure architecture principles include input normalization and canonicalization controls that mitigate encoding-related weaknesses.
CWE-176partialprevents — Secure architecture principles require robust input processing to avoid encoding-related vulnerabilities.
CWE-178partialprevents — Architecture principles should enforce canonical, case-aware resource naming.
CWE-179partialprevents — Secure architecture principles discourage unsafe ordering of validation and sanitization steps.
CWE-180partialprevents — Secure architecture principles reduce the likelihood of ordering errors in input processing.
CWE-182partialprevents — Secure architecture principles require defensive design against data-reduction vulnerabilities.
CWE-183partialprevents — Secure system architecture and engineering principles require explicit, least-privilege input validation designs that directly address permissive allow-lists.
CWE-184partialprevents — Secure architecture principles include robust input validation design, yet the control is broader than this single weakness.
CWE-188partialprevents — Secure system architecture and engineering principles directly address assumptions about memory and protocol layout.
CWE-191partialprevents — Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
CWE-192partialprevents — Secure system architecture and engineering principles promote strong typing and overflow protection.
CWE-193partialprevents — Secure system architecture and engineering principles promote defensive coding practices that reduce off-by-one mistakes.
CWE-194partialprevents — Secure architecture principles encourage use of safe data types and explicit casting, reducing sign-extension risk.
CWE-195partialprevents — Secure system architecture and engineering principles include data-type safety and overflow prevention.
CWE-196partialprevents — Secure architecture principles include choosing appropriate data types and avoiding implicit conversions.
CWE-198partialprevents — Secure architecture principles mandate explicit handling of platform differences such as byte ordering.
CWE-20partialprevents — Security-by-design principles explicitly call for data validation and sanitization at every layer, reducing the chance that malformed or malicious input will be processed without scrutiny.
CWE-200partialprevents — Designing controls to encrypt sensitive data, apply least privilege and fail securely limits the exposure of confidential information when an attacker gains partial access or an error occurs.
CWE-204partialprevents — Secure architecture principles discourage designs that leak internal state via differing responses.
CWE-205partialprevents — Secure architecture principles can mandate uniform error handling and response patterns to avoid leaking internal state.
CWE-207partialprevents — Secure architecture principles can ensure equivalent products behave identically to external observers.
CWE-209partialprevents — Secure architecture principles include proper exception handling.
CWE-210partialprevents — Secure architecture principles reduce exposure but do not directly address error-message content.
CWE-22partialprevents — Secure architecture principles require least-privilege file access and directory isolation.
CWE-228partialprevents — Secure system architecture principles encourage robust input handling but do not prescribe the specific coding practice.
CWE-229partialprevents — Secure architecture principles encourage robust input handling but do not directly specify value-count checks.
CWE-23partialprevents — Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.
CWE-231partialprevents — Secure architecture principles encourage robust input handling but do not specifically address extra-value scenarios.
CWE-232partialprevents — Secure architecture principles mandate explicit handling of undefined or unsupported states.
CWE-237partialprevents — Secure system architecture principles include defensive design against malformed or complex structural inputs.
CWE-24partialprevents — Secure architecture principles reduce attack surface but do not prescribe the specific coding fix.
CWE-240partialprevents — Secure architecture principles mandate consistent structural definitions across system components.
CWE-241partialprevents — Secure system architecture principles encourage robust input handling but do not specifically address data-type validation.
CWE-248partialprevents — Secure architecture principles call for centralized, comprehensive exception management.
CWE-25partialprevents — Secure architecture principles reduce exposure to path traversal through least-privilege file-system design.
CWE-253partialprevents — Secure architecture principles require defensive coding practices such as validating function results.
CWE-26partialprevents — Secure architecture principles reduce the attack surface but do not prescribe the specific coding fix.
CWE-267partialprevents — Secure system architecture can design safer privilege models but does not eliminate unsafe actions in existing privileges.
CWE-269partialprevents — Requiring dynamic, context-based privilege assignment and least-privilege enforcement stops the assignment of excessive rights that would let a compromised account perform unintended privileged actions.
CWE-27partialprevents — Secure architecture principles discourage unsafe path construction but do not prescribe the specific coding fix.
CWE-270partialprevents — Secure-architecture principles encourage least-privilege context separation but leave implementation details open.
CWE-277partialprevents — Secure system architecture principles can incorporate least-privilege permission models but do not specifically mandate secure inheritance.
CWE-28partialprevents — Secure architecture principles require canonicalization and least-privilege directory access to prevent traversal.
CWE-284partialprevents — Embedding least-privilege, default-deny and zero-trust verification into every architecture layer stops the creation of overly permissive access paths that would otherwise allow unauthorized actors to reach protected resources.
CWE-287partialprevents — Mandating strong, context-aware authentication for all access attempts prevents systems from accepting unauthenticated or weakly authenticated identities that attackers could impersonate.
CWE-288partialprevents — Secure architecture principles reduce likelihood of alternate unauthenticated paths but do not eliminate them.
CWE-29partialprevents — Secure architecture principles include directory sandboxing and safe file-access design that mitigate path traversal.
CWE-290partialprevents — Secure architecture principles help avoid spoofable designs but do not mandate specific controls.
CWE-297partialmitigates — Secure system architecture principles require proper certificate validation to protect communications.
CWE-30partialprevents — Secure architecture principles reduce the attack surface but do not prescribe the specific coding checks needed.
CWE-301partialprevents — Secure system architecture principles encourage mutual authentication and nonce usage that mitigate reflection attacks.
CWE-306partialprevents — Security engineering principles insist on authentication and authorization for every critical function, eliminating entry points that lack any access control mechanism.
CWE-31partialprevents — Secure architecture principles reduce the attack surface but do not prescribe the specific coding fix.
CWE-32partialprevents — Secure architecture principles reduce exposure to path traversal but do not prescribe the specific coding fix.
CWE-322partialprevents — Secure system architecture principles include authenticated key exchange as a foundational design requirement.
CWE-329partialprevents — Secure architecture principles guide selection of strong cryptographic primitives and IV handling.
CWE-332partialprevents — Secure architecture principles include use of approved cryptographic modules with adequate entropy sources.
CWE-333partialmitigates — Requires secure system architecture that includes robust random-number services, mitigating TRNG failures.
CWE-337partialprevents — Secure architecture principles include choosing cryptographically strong random number generation.
CWE-338partialprevents — Secure engineering principles include selection of appropriate cryptographic primitives.
CWE-34partialprevents — Secure system architecture principles reduce the attack surface for path traversal but do not prescribe specific coding fixes.
CWE-342partialprevents — Secure architecture principles include use of strong, unpredictable random sources.
CWE-343partialprevents — Secure architecture principles call for cryptographically strong randomness sources.
CWE-344partialprevents — Secure architecture principles discourage hard-coded assumptions, yet the control is broader than this single weakness.
CWE-346partialprevents — Secure architecture principles encourage origin checks but do not mandate them.
CWE-349partialprevents — Secure architecture principles require explicit trust boundaries and data-origin checks that mitigate mixing of trusted and untrusted inputs.
CWE-35partialprevents — Secure architecture principles require proper directory restrictions and input sanitization to prevent traversal.
CWE-350partialprevents — Secure architecture principles discourage reliance on unauthenticated DNS for security decisions.
CWE-351partialprevents — Secure architecture principles encourage strong typing and clear type boundaries in system design.
CWE-353partialprevents — Secure architecture principles can mandate integrity protection for communications.
CWE-356partialprevents — Secure architecture principles can mandate confirmation prompts for risky actions.
CWE-357partialprevents — Secure system architecture and engineering principles address usable security mechanisms such as prominent warnings.
CWE-358partialprevents — Secure system architecture and engineering principles require faithful realization of protocol-level security checks.
CWE-36partialprevents — Secure architecture principles call for canonicalization and sandboxing that limit absolute path traversal.
CWE-360partialprevents — Secure architecture principles can include event validation mechanisms but do not mandate them.
CWE-362partialprevents — Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.
CWE-363partialmitigates — Secure architecture principles encourage atomic checks and safe file APIs, but do not prescribe them explicitly.
CWE-366partialprevents — Secure architecture principles address concurrent access and resource synchronization.
CWE-368partialprevents — Secure architecture principles include designing atomic privilege transitions to avoid race conditions.
CWE-369partialprevents — Secure architecture principles encourage defensive coding patterns that avoid arithmetic exceptions.
CWE-37partialmitigates — Secure architecture principles include canonicalization and path-handling controls that prevent traversal.
CWE-372partialprevents — Secure architecture principles encourage explicit state modelling and fail-safe transitions.
CWE-374partialprevents — Secure architecture principles include isolating mutable state and avoiding shared references across trust boundaries.
CWE-377partialprevents — Secure system architecture principles discourage insecure temporary-file patterns but do not directly address them.
CWE-378partialprevents — Secure architecture principles require least-privilege file creation and access controls.
CWE-379partialprevents — Secure system architecture principles include proper file-system permission models that mitigate insecure temp-file creation.
CWE-38partialprevents — Secure architecture principles encourage safe file-access design patterns that reduce traversal risk.
CWE-385partialprevents — Secure architecture principles can include timing-channel countermeasures but are not specific.
CWE-386partialmitigates — Secure architecture principles discourage use of mutable symbolic references that can resolve to unintended objects.
CWE-39partialprevents — Secure architecture principles include canonicalization and path sanitization to prevent traversal via drive letters.
CWE-40partialprevents — Secure architecture principles include canonicalization and path-handling controls that prevent UNC traversal.
CWE-401partialprevents — Secure system architecture and engineering principles include resource-management guidelines that address memory leaks.
CWE-407partialprevents — Secure system architecture principles encourage selection of algorithms with acceptable worst-case complexity.
CWE-409partialprevents — Secure architecture principles encourage defensive design against resource-exhaustion threats.
CWE-41partialprevents — Secure architecture principles call for safe file-system abstractions that mitigate path traversal risks.
CWE-410partialprevents — Secure architecture principles include designing adequate resource allocation and limits.
CWE-412partialprevents — Secure architecture principles discourage exposing lock mechanisms to external actors.
CWE-413partialprevents — Secure system architecture principles include concurrency and resource-locking design rules.
CWE-415partialprevents — Secure system architecture and engineering principles can prescribe safe memory-management patterns.
CWE-416partialprevents — Secure architecture principles include memory-safety design choices that limit use-after-free exposure.
CWE-419partialprevents — Secure architecture principles include protecting management channels by design.
CWE-42partialprevents — Secure system architecture can enforce canonicalization and path normalization controls.
CWE-421partialprevents — Secure architecture principles reduce the likelihood of exposing alternate channels to unintended actors.
CWE-422partialprevents — Secure system architecture principles require least-privilege design and authenticated inter-process communication, mitigating shatter attacks.
CWE-424partialprevents — Secure architecture principles require eliminating unauthorized entry points during design.
CWE-426partialprevents — Secure architecture principles include hard-coded or validated search paths and avoiding reliance on untrusted directories.
CWE-427partialmitigates — Secure system architecture and engineering principles require explicit control over search paths and resource locations.
CWE-43partialprevents — Secure architecture principles mandate canonicalization and safe path resolution mechanisms.
CWE-430partialprevents — Secure architecture principles require correct component wiring and handler assignment.
CWE-431partialprevents — Secure architecture principles include robust error handling and graceful degradation to avoid unhandled paths.
CWE-433partialprevents — Secure architecture principles can guide safe web-root design but do not directly address unparsed file extensions.
CWE-436partialprevents — Secure architecture principles include well-defined component boundaries and shared data models that limit conflicting state perceptions.
CWE-437partialprevents — Secure architecture principles emphasize complete system modeling, including all endpoint capabilities and states.
CWE-44partialprevents — Secure architecture principles include canonicalization and input sanitization to prevent path equivalence attacks.
CWE-441partialprevents — Secure-architecture principles discourage designs where a component blindly forwards requests without source validation.
CWE-444partialprevents — Secure architecture principles include consistent protocol handling and defense-in-depth for proxies.
CWE-446partialprevents — Secure architecture principles can guide UI design but do not specifically address misleading security-state indicators.
CWE-450partialprevents — Secure system architecture principles can enforce consistent, least-privilege handling of ambiguous UI input.
CWE-453partialprevents — Secure architecture principles include avoiding insecure defaults in design.
CWE-454partialprevents — Secure architecture principles reduce exposure of trusted variables to external inputs.
CWE-455partialprevents — Secure system architecture principles include fail-safe initialization and error handling requirements.
CWE-46partialprevents — Secure system architecture and engineering principles include canonicalization and path-handling controls that mitigate ambiguous file names.
CWE-460partialprevents — Secure architecture principles include designing for safe failure and guaranteed cleanup on exceptions.
CWE-470partialprevents — Secure architecture principles discourage dynamic class loading from external data sources.
CWE-471partialprevents — Secure architecture principles call for explicit immutability guarantees and enforcement mechanisms.
CWE-475partialprevents — Secure system architecture principles can require defensive coding that eliminates undefined behavior in APIs.
CWE-476partialprevents — Secure architecture principles encourage defensive design that avoids unsafe pointer use.
CWE-488partialprevents — Secure system architecture principles require isolation of session state to avoid cross-session data leakage.
CWE-491partialprevents — Secure architecture principles discourage mutable state exposure via cloneable objects.
CWE-495partialprevents — Secure architecture principles such as least privilege and encapsulation directly address the exposure of private data structures.
CWE-499partialprevents — Secure architecture principles include data-protection patterns that prevent unintended serialization of secrets.
CWE-50partialprevents — Secure system architecture principles mandate proper input sanitization and path normalization.
CWE-514partialmitigates — Secure architecture principles include isolation and resource separation that mitigate covert channels, yet the control is broader than this single weakness.
CWE-515partialprevents — Secure architecture principles can reduce covert storage opportunities but do not guarantee elimination.
CWE-523partialprevents — Requires secure system architecture principles that can mandate encrypted transport.
CWE-526partialprevents — Secure architecture principles discourage placing secrets in environment variables without encryption.
CWE-535partialmitigates — Secure architecture principles encourage generic error responses but are not specific to shell error messages.
CWE-544partialprevents — Secure system architecture and engineering principles include consistent exception and error-handling mechanisms.
CWE-548partialprevents — Secure system architecture principles include configuring web servers to prevent automatic directory listings.
CWE-550partialprevents — Secure architecture principles include proper exception handling to prevent leakage.
CWE-551partialprevents — Secure architecture principles include proper request handling order to prevent bypasses.
CWE-553partialprevents — Secure architecture principles discourage exposing executable directories but do not directly prevent the weakness.
CWE-556partialmitigates — Secure architecture principles discourage the use of impersonation in favor of proper delegation models.
CWE-564partialprevents — Secure architecture principles discourage dynamic SQL but do not directly address Hibernate misuse.
CWE-566partialmitigates — Secure architecture principles require least-privilege data access and input validation, directly mitigating the described authorization bypass.
CWE-567partialprevents — Secure architecture principles address concurrency and shared-state protection mechanisms.
CWE-57partialprevents — Promotes secure architecture principles that reduce the likelihood of path-equivalence vulnerabilities.
CWE-573partialprevents — Secure system architecture and engineering principles include specification adherence as a design constraint.
CWE-587partialprevents — Secure system architecture and engineering principles discourage unsafe pointer usage.
CWE-588partialprevents — Secure architecture principles discourage unsafe casting and promote strong typing.
CWE-59partialprevents — Secure architecture principles include input validation and safe file-access design patterns.
CWE-590partialprevents — Secure architecture and engineering principles include disciplined memory management that prevents freeing non-heap memory.
CWE-598partialprevents — Secure architecture principles discourage exposing sensitive data in URLs.
CWE-600partialprevents — Secure system architecture principles require robust error management and containment of exception information.
CWE-605partialprevents — Secure system architecture principles require unique service endpoints and prevent port collisions by design.
CWE-61partialprevents — Secure-architecture principles require safe file-handling and canonicalization, directly addressing symlink attacks.
CWE-610partialprevents — Secure architecture principles reduce the attack surface for externally controlled references but do not prescribe specific validation rules.
CWE-611partialprevents — Secure architecture principles include safe parser configuration that mitigates external entity risks.
CWE-616partialprevents — Secure architecture principles discourage unsafe global state, indirectly reducing exposure to variable-injection attacks.
CWE-617partialprevents — Secure architecture principles discourage the use of assertions for runtime error handling that an attacker could exploit.
CWE-618partialprevents — Secure architecture principles discourage exposing privileged operations outside the browser security model.
CWE-62partialprevents — Secure architecture principles include proper file-system namespace handling that can prevent hard-link traversal.
CWE-621partialprevents — Secure architecture principles discourage unsafe dynamic variable extraction patterns.
CWE-622partialprevents — Secure architecture principles mandate defensive coding and parameter validation at API boundaries.
CWE-623partialprevents — Secure architecture principles discourage unsafe ActiveX usage, yet the control is broader than this specific weakness.
CWE-626partialprevents — Secure architecture principles can require canonicalization and safe data-representation boundaries.
CWE-627partialprevents — Secure architecture principles discourage unsafe dynamic evaluation constructs.
CWE-641partialprevents — Secure system architecture principles discourage unsafe resource naming but do not prescribe specific controls.
CWE-643partialprevents — Secure architecture principles reduce the likelihood of unsafe dynamic query construction.
CWE-644partialprevents — Secure architecture principles reduce injection surfaces but do not prescribe header-specific controls.
CWE-646partialprevents — Secure architecture principles encourage safe file handling, yet the control is broader than this specific weakness.
CWE-648partialprevents — Secure architecture principles guide proper privilege separation and API usage.
CWE-649partialprevents — Secure architecture principles require that encrypted or obfuscated data be protected against unauthorized modification.
CWE-65partialprevents — Secure system architecture principles include least-privilege file access and sandboxing that mitigate link-based redirection attacks.
CWE-650partialprevents — Secure system architecture principles include proper HTTP method handling and RESTful design to prevent state changes via GET.
CWE-652partialprevents — Secure architecture principles reduce the likelihood of unsafe dynamic query construction.
CWE-66partialprevents — Secure system architecture and engineering principles can incorporate design controls that prevent improper resolution of virtual file names.
CWE-662partialprevents — Secure system architecture principles include thread-safety and resource-locking mechanisms to avoid improper synchronization.
CWE-663partialprevents — Secure architecture principles include concurrency-safe design and avoidance of shared mutable state in non-reentrant functions.
CWE-664partialprevents — Secure architecture principles reduce lifetime control issues but are not specific to them.
CWE-665partialprevents — Secure system architecture and engineering principles require explicit initialization of resources and secure state management.
CWE-667partialprevents — Secure architecture principles address thread-safety and resource synchronization.
CWE-669partialmitigates — Secure architecture principles reduce cross-sphere transfer weaknesses.
CWE-67partialprevents — Secure architecture principles mandate safe pathname construction and canonicalization.
CWE-674partialprevents — Secure system architecture principles include resource-management and input-validation rules that limit recursion.
CWE-675partialprevents — Secure architecture principles discourage redundant operations on the same resource.
CWE-680partialprevents — Secure architecture principles encourage use of safe arithmetic libraries and overflow detection.
CWE-681partialprevents — Secure architecture principles promote strong typing and safe conversion practices.
CWE-687partialprevents — Secure architecture principles promote defensive coding that reduces argument misuse.
CWE-689partialprevents — Promotes secure architecture principles that avoid race conditions in resource operations.
CWE-690partialprevents — Secure architecture principles require robust error handling and pointer validation.
CWE-691partialprevents — Secure system architecture and engineering principles require explicit control-flow integrity mechanisms and error-handling paths.
CWE-695partialprevents — Secure architecture principles restrict use of low-level constructs outside approved patterns.
CWE-696partialprevents — Secure system architecture and engineering principles require proper ordering of design and implementation steps.
CWE-697partialprevents — Secure architecture principles can require robust comparison mechanisms for access decisions.
CWE-698partialprevents — Secure architecture principles discourage continued execution after redirects.
CWE-706partialprevents — Secure architecture principles discourage reliance on ambient or globally-resolvable names without explicit scoping.
CWE-707partialprevents — Secure architecture principles include canonicalization and safe parsing, mitigating but not fully covering neutralization issues.
CWE-73partialprevents — Secure architecture principles discourage unsafe path construction but do not prescribe concrete file-name controls.
CWE-732partialprevents — System hardening and explicit specification of required permissions during design reduce the likelihood that critical resources will be created or left with overly permissive access rights.
CWE-74partialprevents — Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.
CWE-749partialprevents — Secure architecture principles discourage exposing dangerous functions, but do not guarantee their absence.
CWE-75partialprevents — Secure architecture principles reduce injection surfaces but do not prescribe the actual sanitization logic.
CWE-754partialprevents — Secure system architecture and engineering principles require robust error and exception handling mechanisms.
CWE-755partialprevents — Secure architecture and engineering principles require robust exception and error management.
CWE-757partialprevents — Secure architecture principles include enforcing strong algorithm selection in protocol design.
CWE-76partialprevents — Secure system architecture principles require consistent canonicalization and neutralization of equivalent inputs.
CWE-760partialprevents — Secure system architecture and engineering principles guide the selection of strong cryptographic mechanisms including proper salting.
CWE-763partialprevents — Secure architecture principles include safe memory handling and resource-lifetime rules.
CWE-764partialprevents — Secure system architecture and engineering principles can mandate proper resource-locking patterns and deadlock analysis.
CWE-765partialprevents — Secure system architecture and engineering principles can mandate proper resource-state management and locking invariants.
CWE-767partialprevents — Secure architecture principles enforce encapsulation and least-privilege data access.
CWE-77partialprevents — Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
CWE-771partialprevents — Secure system architecture principles can mandate explicit resource tracking and release mechanisms.
CWE-774partialprevents — Secure architecture principles include resource-management controls to prevent exhaustion.
CWE-776partialprevents — Secure architecture principles discourage unsafe parser configurations that enable entity expansion attacks.
CWE-780partialprevents — Secure architecture principles include choosing appropriate cryptographic primitives and padding.
CWE-782partialprevents — Secure system architecture principles mandate least-privilege access to kernel interfaces.
CWE-786partialprevents — Secure architecture principles promote safe memory handling and pointer arithmetic safeguards.
CWE-787partialprevents — Secure architecture and engineering principles reduce the likelihood of buffer overflows.
CWE-788partialprevents — Secure architecture principles discourage unsafe pointer arithmetic and unbounded buffers.
CWE-789partialprevents — Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.
CWE-790partialprevents — Secure system architecture and engineering principles include defensive input handling that reduces the risk of unfiltered special elements.
CWE-791partialprevents — Secure system architecture and engineering principles require defensive design patterns that prevent unfiltered data from reaching downstream components.
CWE-792partialprevents — Secure architecture principles encourage defensive input handling but do not prescribe the specific filtering mechanism.
CWE-794partialprevents — Secure architecture principles encourage defensive input handling but do not prescribe specific filtering controls.
CWE-799partialprevents — Secure architecture principles recommend rate-limiting and resource-management mechanisms.
CWE-805partialprevents — Secure architecture principles encourage bounds-checked APIs, yet leave concrete coding decisions to developers.
CWE-807partialprevents — Secure architecture principles mandate treating all external inputs as untrusted.
CWE-81partialprevents — Secure system architecture principles reduce the likelihood of unsafe error handling but do not prescribe specific neutralization techniques.
CWE-82partialprevents — Secure architecture and engineering principles include design rules that eliminate unsafe attribute handling in web pages.
CWE-820partialprevents — Secure architecture principles include proper synchronization for shared resources.
CWE-821partialprevents — Secure architecture principles address concurrent access and resource synchronization.
CWE-822partialprevents — Secure architecture principles discourage direct use of untrusted values as pointers.
CWE-825partialprevents — Secure architecture and engineering principles can prescribe memory-safety patterns, yet fixing only this weakness does not achieve the control.
CWE-826partialprevents — Secure architecture principles encourage proper resource scoping and lifetime management.
CWE-827partialprevents — Secure architecture principles require disabling external DTD resolution and entity expansion limits.
CWE-83partialprevents — Secure architecture principles reduce attack surface but do not prescribe the specific neutralization techniques needed.
CWE-832partialprevents — Secure system architecture and engineering principles can mandate proper resource-locking patterns.
CWE-833partialprevents — Secure system architecture principles include concurrency controls and resource-locking discipline that prevent deadlock.
CWE-834partialprevents — Secure architecture principles mandate defensive coding patterns such as loop termination checks.
CWE-839partialprevents — Secure system architecture principles require defensive input handling and range validation to prevent out-of-bounds values.
CWE-841partialprevents — Secure architecture principles address proper ordering of security-critical operations.
CWE-843partialprevents — Secure architecture principles promote type-safe languages and memory-safety mechanisms that mitigate type confusion.
CWE-862partialprevents — Requiring explicit authorization checks for every request, even from inside the perimeter, eliminates the absence of authorization logic that would let callers invoke functions or data without proper rights.
CWE-87partialprevents — Secure architecture principles reduce attack surface but do not prescribe specific encoding rules.
CWE-88partialprevents — Secure architecture principles discourage unsafe command invocation patterns and favor safer APIs.
CWE-908partialprevents — Secure system architecture and engineering principles include defensive coding practices that prevent use of uninitialized memory or objects.
CWE-909partialprevents — Secure architecture principles include proper resource lifecycle management.
CWE-91partialprevents — Secure architecture principles reduce attack surface but do not prescribe XML-specific controls.
CWE-911partialprevents — Secure system architecture principles encourage explicit resource-ownership models that mitigate reference-count misuse.
CWE-912partialprevents — Secure system architecture and engineering principles require transparent, documented designs that preclude hidden functionality.
CWE-913partialprevents — Secure architecture principles require design controls that prevent improper dynamic code resource manipulation.
CWE-914partialprevents — Secure architecture principles discourage unsafe dynamic variable access patterns.
CWE-915partialprevents — Secure architecture principles mandate strict control over dynamic object modification and attribute binding.
CWE-917partialprevents — Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
CWE-923partialprevents — Secure architecture principles recommend endpoint verification but are not a direct mitigation.
CWE-925partialprevents — Secure architecture principles include proper component authorization and input validation.
CWE-926partialprevents — Secure architecture principles discourage overly permissive component exports, though the control is broader than this single weakness.
CWE-927partialprevents — Secure architecture principles discourage implicit intents for sensitive payloads.
CWE-93partialprevents — Secure architecture principles encourage safe handling of untrusted data but do not prescribe specific CRLF controls.
CWE-941partialprevents — Secure architecture principles encourage proper endpoint design, providing indirect mitigation.
CWE-942partialprevents — Secure architecture principles include defining trust boundaries, which can reduce permissive cross-domain allowances.
CWE-943partialprevents — Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.
CWE-95partialprevents — Secure architecture principles discourage unsafe dynamic evaluation constructs.
CWE-96partialprevents — Secure architecture principles reduce injection surfaces but do not prescribe the specific neutralization techniques.
CWE-97partialprevents — Secure architecture principles reduce the attack surface for SSI but do not prescribe specific neutralization techniques.
CWE-98partialprevents — Secure architecture principles reduce attack surface but do not specifically address dynamic file inclusion.
CWE-99partialprevents — Secure architecture principles reduce attack surface for resource injection but do not prescribe identifier validation.
CWE-1024nonenone — Secure system architecture and engineering principles promote language features and design patterns that avoid unsafe type comparisons.
CWE-1037nonenone — Secure architecture and engineering principles include selecting build options that do not remove security mechanisms.
CWE-1056nonenone — Secure architecture principles discourage unsafe API designs but do not specifically address variadic signatures.
CWE-1102nonenone — Secure system architecture and engineering principles require designs that abstract away low-level, platform-dependent constructs.
CWE-1124nonenone — Secure system architecture and engineering principles include maintainability and complexity limits that address deep nesting.
CWE-1176nonenone — Secure architecture principles encourage selection of efficient algorithms and resource-conscious design.
CWE-1335nonenone — Secure system architecture and engineering principles encourage defensive coding that prevents undefined integer operations.
CWE-1341nonenone — Secure system architecture and engineering principles can mandate consistent resource-lifetime handling.
CWE-1389nonenone — Secure architecture principles promote robust input handling but do not specifically address numeric radix issues.
CWE-170nonenone — Secure architecture principles include defensive coding practices that address buffer and string termination issues.
CWE-187nonemitigates — Secure system architecture principles discourage unsafe partial comparisons in critical paths.
CWE-190nonenone — Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
CWE-197nonenone — Secure architecture principles include choosing appropriate data types and avoiding unsafe casts.
CWE-234nonenone — Secure system architecture and engineering principles require robust error handling and defensive coding against malformed calls.
CWE-235nonemitigates — Secure architecture principles encourage robust input handling but do not specifically address parameter-count validation.
CWE-244nonenone — Secure architecture principles may reduce exposure but do not prescribe explicit heap-clearing techniques.
CWE-252nonenone — Secure system architecture and engineering principles require robust error handling and defensive coding practices.
CWE-336noneprevents — Secure architecture principles include use of strong randomness, but do not specifically prescribe PRNG seeding.
CWE-364nonenone — Secure architecture principles can mandate safe concurrency and signal design.
CWE-391noneprevents — Secure architecture principles mandate robust exception and error management.
CWE-428nonenone — Secure system architecture and engineering principles require safe path construction and quoting conventions.
CWE-456nonenone — Secure system architecture and engineering principles include defensive coding practices that eliminate missing-initialization flaws.
CWE-457nonenone — Secure architecture principles encourage defensive coding that can mitigate uninitialized variables.
CWE-462nonenone — Secure architecture principles encourage use of data structures that enforce uniqueness.
CWE-466nonenone — Secure architecture principles can enforce memory-safety patterns that reduce the likelihood of out-of-range pointer returns.
CWE-469nonenone — Secure architecture principles discourage unsafe pointer arithmetic and promote safer abstractions.
CWE-474nonemitigates — Secure architecture principles include portable abstractions and avoiding platform-specific calls with divergent behavior.
CWE-479nonenone — Secure architecture principles require re-entrant or async-signal-safe designs for handlers.
CWE-562nonenone — Secure architecture and engineering principles discourage unsafe stack usage patterns.
CWE-624nonenone — Secure architecture principles discourage embedding user-controlled executable regex components.
CWE-682nonenone — Secure architecture principles include input validation and safe arithmetic design that reduce calculation errors.
CWE-686nonenone — Secure system architecture and engineering principles promote type-safe designs and interface definitions.
CWE-704nonenone — Secure architecture principles discourage unsafe type conversions in design.
CWE-758nonenone — Secure system architecture and engineering principles mandate use of well-specified interfaces and avoid undefined constructs.
CWE-762nonenone — Secure system architecture and engineering principles require use of matching allocators and deallocators.
CWE-768nonenone — Secure architecture principles discourage reliance on side effects inside conditional expressions.
CWE-775nonenone — Secure architecture principles encourage proper resource management, but the control itself does not specifically address file-descriptor release.
CWE-823nonenone — Secure architecture principles promote safe pointer handling and memory layout controls.
CWE-824nonenone — Secure architecture principles discourage unsafe pointer handling.
CWE-828nonenone — Secure system architecture and engineering principles include designing for reentrancy and safe signal handling.
CWE-835nonenone — Secure architecture principles encourage designs that avoid unreachable exit conditions.
CWE-90nonemitigates — Secure architecture principles encourage safe query interfaces but do not prescribe the specific coding controls needed for LDAP injection.
CWE-910nonenone — Secure architecture principles can require explicit resource-release patterns that prevent reuse of closed descriptors.
CWE-920nonemitigates — Secure architecture principles may include power-aware design, but the control is not focused on power limits.

Mitigated MITRE ATT&CK techniques (9)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1055→P T1068→P T1078→P T1190→M T1210→P T1548→P T1550→P T1556→M

Why these map — AI rationale (under review)

T1190mostlyprevents — Security-by-design reviews, threat analysis, and hardening of public-facing applications directly shrink the attack surface that adversaries exploit to gain initial access.
T1556mostlyprevents — Requiring strong, context-aware authentication and authorization at every layer makes it harder for an attacker to weaken or bypass authentication processes without detection.
T1055partialmitigates — Least-privilege execution contexts and fail-secure design reduce the permissions and stability needed for successful process-injection stealth techniques.
T1068partialprevents — Applying least-privilege, fail-secure defaults, and defence-in-depth principles reduces opportunities for privilege-escalation exploits within compromised processes.
T1078partialmitigates — Mandating least-privilege, dynamic access control, and continuous verification of every request reduces the value and usability of compromised valid accounts for initial access or lateral movement.
T1210partialprevents — Secure architecture reviews and hardening of remote services decrease the number of remotely exploitable pathways available for lateral movement.
T1548partialmitigates — Enforcing least privilege and distrust of external input limits an adversary’s ability to abuse elevation mechanisms to obtain higher rights.
T1550partialmitigates — Requiring contextual, per-request authentication and authorization limits the effectiveness of stolen tokens or tickets for impersonation across systems.
T1027nonemitigates — Security-oriented design reviews and distrust of external input make it harder for attackers to hide malicious payloads through obfuscation or smuggling techniques.

Prevented OWASP Web Top 10 (2025) risks (6)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01→P A02→M A04→P A05→P A06→F A07→P

Why these map — AI rationale (under review)

A06fullprevents — Requiring security-oriented design reviews and threat-model-based control selection at every layer prevents insecure design decisions from reaching production.
A02mostlyprevents — Mandating security-by-default, hardening and documented control integration eliminates the misconfigured defaults and missing hardening steps that create exploitable environments.
A01partialprevents — Embedding least-privilege, default-deny and zero-trust verification into every architecture layer directly stops unauthorized access paths from being coded into the application.
A04partialprevents — Requiring encryption of sensitive data and PKI integration as part of the architecture ensures cryptographic controls are selected and applied correctly from the outset.
A05partialmitigates — Explicit inclusion of data-validation and sanitization principles in the secure-engineering guidance stops many classes of injection flaws from being implemented.
A07partialprevents — Specifying strong authentication, session control and contextual authorization within the engineering principles reduces the chance that weak or missing authentication mechanisms are introduced.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.