REFERENCE
The control list behind the mapping
The Enterprise page maps seven public standards to the domains a behavioral comparison covers. Behind those standards are individual controls. This page lists the ones pulled from the publishers' own machine-readable sources: OWASP ASVS 4.0.3, CWE, and NIST SP 800-53 revision 5. Each entry carries a provisional classification. Shows means a behavioral comparison demonstrates the control directly. Supports means the comparison contributes evidence without being the whole answer. A review pass of these classifications is in progress. This list is illustrative, not a compliance certification.
749 controls total · 128 OWASP ASVS · 75 CWE · 546 NIST SP 800-53r5 · 262 shows · 487 supports
OWASP ASVS 4.0.3 (128)
| ID | Requirement | Domain | Classification |
|---|---|---|---|
| V3.1.1 | Verify the application never reveals session tokens in URL parameters. | session management | shows |
| V3.2.1 | Verify the application generates a new session token on user authentication. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering)) | session management | shows |
| V3.2.2 | Verify that session tokens possess at least 64 bits of entropy. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering)) | session management | shows |
| V3.2.3 | Verify the application only stores session tokens in the browser using secure methods such as appropriately secured cookies (see section 3.4) or HTML 5 session | session management | shows |
| V3.2.4 | Verify that session tokens are generated using approved cryptographic algorithms. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering)) | session management | shows |
| V3.3.1 | Verify that logout and expiration invalidate the session token, such that the back button or a downstream relying party does not resume an authenticated session | session management | shows |
| V3.3.2 | If authenticators permit users to remain logged in, verify that re-authentication occurs periodically both when actively used or after an idle period. ([C6](htt | session management | shows |
| V3.3.3 | Verify that the application gives the option to terminate all other active sessions after a successful password change (including change via password reset/reco | session management | shows |
| V3.3.4 | Verify that users are able to view and (having re-entered login credentials) log out of any or all currently active sessions and devices. | session management | shows |
| V3.4.1 | Verify that cookie-based session tokens have the 'Secure' attribute set. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering)) | session management | shows |
| V3.4.2 | Verify that cookie-based session tokens have the 'HttpOnly' attribute set. ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering)) | session management | shows |
| V3.4.3 | Verify that cookie-based session tokens utilize the 'SameSite' attribute to limit exposure to cross-site request forgery attacks. ([C6](https://owasp.org/www-pr | session management | shows |
| V3.4.4 | Verify that cookie-based session tokens use the "__Host-" prefix so cookies are only sent to the host that initially set the cookie. | session management | shows |
| V3.4.5 | Verify that if the application is published under a domain name with other applications that set or use session cookies that might disclose the session cookies, | session management | shows |
| V3.5.1 | Verify the application allows users to revoke OAuth tokens that form trust relationships with linked applications. | session management | supports |
| V3.5.2 | Verify the application uses session tokens rather than static API secrets and keys, except with legacy implementations. | session management | shows |
| V3.5.3 | Verify that stateless session tokens use digital signatures, encryption, and other countermeasures to protect against tampering, enveloping, replay, null cipher | session management | shows |
| V3.6.1 | Verify that Relying Parties (RPs) specify the maximum authentication time to Credential Service Providers (CSPs) and that CSPs re-authenticate the user if they | session management | supports |
| V3.6.2 | Verify that Credential Service Providers (CSPs) inform Relying Parties (RPs) of the last authentication event, to allow RPs to determine if they need to re-auth | session management | shows |
| V3.7.1 | Verify the application ensures a full, valid login session or requires re-authentication or secondary verification before allowing any sensitive transactions or | session management | shows |
| V4.1.1 | Verify that the application enforces access control rules on a trusted service layer, especially if client-side access control is present and could be bypassed. | access control | supports |
| V4.1.2 | Verify that all user and data attributes and policy information used by access controls cannot be manipulated by end users unless specifically authorized. | access control | shows |
| V4.1.3 | Verify that the principle of least privilege exists - users should only be able to access functions, data files, URLs, controllers, services, and other resource | access control | shows |
| V4.1.4 | [DELETED, DUPLICATE OF 4.1.3] | access control | supports |
| V4.1.5 | Verify that access controls fail securely including when an exception occurs. ([C10](https://owasp.org/www-project-proactive-controls/#div-numbering)) | access control | shows |
| V4.2.1 | Verify that sensitive data and APIs are protected against Insecure Direct Object Reference (IDOR) attacks targeting creation, reading, updating and deletion of | access control | shows |
| V4.2.2 | Verify that the application or framework enforces a strong anti-CSRF mechanism to protect authenticated functionality, and effective anti-automation or anti-CSR | access control | supports |
| V4.3.1 | Verify administrative interfaces use appropriate multi-factor authentication to prevent unauthorized use. | access control | shows |
| V4.3.2 | Verify that directory browsing is disabled unless deliberately desired. Additionally, applications should not allow discovery or disclosure of file or directory | access control | supports |
| V4.3.3 | Verify the application has additional authorization (such as step up or adaptive authentication) for lower value systems, and / or segregation of duties for hig | access control | shows |
| V5.1.1 | Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the sour | validation and encoding | supports |
| V5.1.2 | Verify that frameworks protect against mass parameter assignment attacks, or that the application has countermeasures to protect against unsafe parameter assign | validation and encoding | supports |
| V5.1.3 | Verify that all input (HTML form fields, REST requests, URL parameters, HTTP headers, cookies, batch files, RSS feeds, etc) is validated using positive validati | validation and encoding | supports |
| V5.1.4 | Verify that structured data is strongly typed and validated against a defined schema including allowed characters, length and pattern (e.g. credit card numbers, | validation and encoding | supports |
| V5.1.5 | Verify that URL redirects and forwards only allow destinations which appear on an allow list, or show a warning when redirecting to potentially untrusted conten | validation and encoding | supports |
| V5.2.1 | Verify that all untrusted HTML input from WYSIWYG editors or similar is properly sanitized with an HTML sanitizer library or framework feature. ([C5](https://ow | validation and encoding | supports |
| V5.2.2 | Verify that unstructured data is sanitized to enforce safety measures such as allowed characters and length. | validation and encoding | supports |
| V5.2.3 | Verify that the application sanitizes user input before passing to mail systems to protect against SMTP or IMAP injection. | validation and encoding | supports |
| V5.2.4 | Verify that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must | validation and encoding | supports |
| V5.2.5 | Verify that the application protects against template injection attacks by ensuring that any user input being included is sanitized or sandboxed. | validation and encoding | supports |
| V5.2.6 | Verify that the application protects against SSRF attacks, by validating or sanitizing untrusted data or HTTP file metadata, such as filenames and URL input fie | validation and encoding | supports |
| V5.2.7 | Verify that the application sanitizes, disables, or sandboxes user-supplied Scalable Vector Graphics (SVG) scriptable content, especially as they relate to XSS | validation and encoding | supports |
| V5.2.8 | Verify that the application sanitizes, disables, or sandboxes user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL sty | validation and encoding | supports |
| V5.3.1 | Verify that output encoding is relevant for the interpreter and context required. For example, use encoders specifically for HTML values, HTML attributes, JavaS | validation and encoding | supports |
| V5.3.2 | Verify that output encoding preserves the user's chosen character set and locale, such that any Unicode character point is valid and safely handled. ([C4](https | validation and encoding | supports |
| V5.3.3 | Verify that context-aware, preferably automated - or at worst, manual - output escaping protects against reflected, stored, and DOM based XSS. ([C4](https://owa | validation and encoding | shows |
| V5.3.4 | Verify that data selection or database queries (e.g. SQL, HQL, ORM, NoSQL) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from d | validation and encoding | supports |
| V5.3.5 | Verify that where parameterized or safer mechanisms are not present, context-specific output encoding is used to protect against injection attacks, such as the | validation and encoding | supports |
| V5.3.6 | Verify that the application protects against JSON injection attacks, JSON eval attacks, and JavaScript expression evaluation. ([C4](https://owasp.org/www-projec | validation and encoding | supports |
| V5.3.7 | Verify that the application protects against LDAP injection vulnerabilities, or that specific security controls to prevent LDAP injection have been implemented. | validation and encoding | shows |
| V5.3.8 | Verify that the application protects against OS command injection and that operating system calls use parameterized OS queries or use contextual command line ou | validation and encoding | supports |
| V5.3.9 | Verify that the application protects against Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks. | validation and encoding | supports |
| V5.3.10 | Verify that the application protects against XPath injection or XML injection attacks. ([C4](https://owasp.org/www-project-proactive-controls/#div-numbering)) | validation and encoding | supports |
| V5.4.1 | Verify that the application uses memory-safe string, safer memory copy and pointer arithmetic to detect or prevent stack, buffer, or heap overflows. | validation and encoding | shows |
| V5.4.2 | Verify that format strings do not take potentially hostile input, and are constant. | validation and encoding | supports |
| V5.4.3 | Verify that sign, range, and input validation techniques are used to prevent integer overflows. | validation and encoding | shows |
| V5.5.1 | Verify that serialized objects use integrity checks or are encrypted to prevent hostile object creation or data tampering. ([C5](https://owasp.org/www-project-p | validation and encoding | shows |
| V5.5.2 | Verify that the application correctly restricts XML parsers to only use the most restrictive configuration possible and to ensure that unsafe features such as r | validation and encoding | supports |
| V5.5.3 | Verify that deserialization of untrusted data is avoided or is protected in both custom code and third-party libraries (such as JSON, XML and YAML parsers). | validation and encoding | supports |
| V5.5.4 | Verify that when parsing JSON in browsers or JavaScript-based backends, JSON.parse is used to parse the JSON document. Do not use eval() to parse JSON. | validation and encoding | supports |
| V7.1.1 | Verify that the application does not log credentials or payment details. Session tokens should only be stored in logs in an irreversible, hashed form. ([C9, C10 | error handling and logging | shows |
| V7.1.2 | Verify that the application does not log other sensitive data as defined under local privacy laws or relevant security policy. ([C9](https://owasp.org/www-proje | error handling and logging | shows |
| V7.1.3 | Verify that the application logs security relevant events including successful and failed authentication events, access control failures, deserialization failur | error handling and logging | shows |
| V7.1.4 | Verify that each log event includes necessary information that would allow for a detailed investigation of the timeline when an event happens. ([C9](https://owa | error handling and logging | shows |
| V7.2.1 | Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata | error handling and logging | shows |
| V7.2.2 | Verify that all access control decisions can be logged and all failed decisions are logged. This should include requests with relevant metadata needed for secur | error handling and logging | shows |
| V7.3.1 | Verify that all logging components appropriately encode data to prevent log injection. ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering)) | error handling and logging | shows |
| V7.3.2 | [DELETED, DUPLICATE OF 7.3.1] | error handling and logging | supports |
| V7.3.3 | Verify that security logs are protected from unauthorized access and modification. ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering)) | error handling and logging | shows |
| V7.3.4 | Verify that time sources are synchronized to the correct time and time zone. Strongly consider logging only in UTC if systems are global to assist with post-inc | error handling and logging | shows |
| V7.4.1 | Verify that a generic message is shown when an unexpected or security sensitive error occurs, potentially with a unique ID which support personnel can use to in | error handling and logging | shows |
| V7.4.2 | Verify that exception handling (or a functional equivalent) is used across the codebase to account for expected and unexpected error conditions. ([C10](https:// | error handling and logging | shows |
| V7.4.3 | Verify that a "last resort" error handler is defined which will catch all unhandled exceptions. ([C10](https://owasp.org/www-project-proactive-controls/#div-num | error handling and logging | shows |
| V8.1.1 | Verify the application protects sensitive data from being cached in server components such as load balancers and application caches. | data protection | supports |
| V8.1.2 | Verify that all cached or temporary copies of sensitive data stored on the server are protected from unauthorized access or purged/invalidated after the authori | data protection | shows |
| V8.1.3 | Verify the application minimizes the number of parameters in a request, such as hidden fields, Ajax variables, cookies and header values. | data protection | supports |
| V8.1.4 | Verify the application can detect and alert on abnormal numbers of requests, such as by IP, user, total per hour or day, or whatever makes sense for the applica | data protection | supports |
| V8.1.5 | Verify that regular backups of important data are performed and that test restoration of data is performed. | data protection | supports |
| V8.1.6 | Verify that backups are stored securely to prevent data from being stolen or corrupted. | data protection | shows |
| V8.2.1 | Verify the application sets sufficient anti-caching headers so that sensitive data is not cached in modern browsers. | data protection | supports |
| V8.2.2 | Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data. | data protection | shows |
| V8.2.3 | Verify that authenticated data is cleared from client storage, such as the browser DOM, after the client or session is terminated. | data protection | shows |
| V8.3.1 | Verify that sensitive data is sent to the server in the HTTP message body or headers, and that query string parameters from any HTTP verb do not contain sensiti | data protection | shows |
| V8.3.2 | Verify that users have a method to remove or export their data on demand. | data protection | supports |
| V8.3.3 | Verify that users are provided clear language regarding collection and use of supplied personal information and that users have provided opt-in consent for the | data protection | supports |
| V8.3.4 | Verify that all sensitive data created and processed by the application has been identified, and ensure that a policy is in place on how to deal with sensitive | data protection | supports |
| V8.3.5 | Verify accessing sensitive data is audited (without logging the sensitive data itself), if the data is collected under relevant data protection directives or wh | data protection | shows |
| V8.3.6 | Verify that sensitive information contained in memory is overwritten as soon as it is no longer required to mitigate memory dumping attacks, using zeroes or ran | data protection | supports |
| V8.3.7 | Verify that sensitive or private information that is required to be encrypted, is encrypted using approved algorithms that provide both confidentiality and inte | data protection | supports |
| V8.3.8 | Verify that sensitive personal information is subject to data retention classification, such that old or out of date data is deleted automatically, on a schedul | data protection | supports |
| V11.1.1 | Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps. | business logic | shows |
| V11.1.2 | Verify that the application will only process business logic flows with all steps being processed in realistic human time, i.e. transactions are not submitted t | business logic | shows |
| V11.1.3 | Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis. | business logic | shows |
| V11.1.4 | Verify that the application has anti-automation controls to protect against excessive calls such as mass data exfiltration, business logic requests, file upload | business logic | shows |
| V11.1.5 | Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar | business logic | shows |
| V11.1.6 | Verify that the application does not suffer from "Time Of Check to Time Of Use" (TOCTOU) issues or other race conditions for sensitive operations. | business logic | supports |
| V11.1.7 | Verify that the application monitors for unusual events or activity from a business logic perspective. For example, attempts to perform actions out of order or | business logic | shows |
| V11.1.8 | Verify that the application has configurable alerting when automated attacks or unusual activity is detected. | business logic | supports |
| V12.1.1 | Verify that the application will not accept large files that could fill up storage or cause a denial of service. | files and resources | supports |
| V12.1.2 | Verify that the application checks compressed files (e.g. zip, gz, docx, odt) against maximum allowed uncompressed size and against maximum number of files befo | files and resources | supports |
| V12.1.3 | Verify that a file size quota and maximum number of files per user is enforced to ensure that a single user cannot fill up the storage with too many files, or e | files and resources | supports |
| V12.2.1 | Verify that files obtained from untrusted sources are validated to be of expected type based on the file's content. | files and resources | supports |
| V12.3.1 | Verify that user-submitted filename metadata is not used directly by system or framework filesystems and that a URL API is used to protect against path traversa | files and resources | shows |
| V12.3.2 | Verify that user-submitted filename metadata is validated or ignored to prevent the disclosure, creation, updating or removal of local files (LFI). | files and resources | shows |
| V12.3.3 | Verify that user-submitted filename metadata is validated or ignored to prevent the disclosure or execution of remote files via Remote File Inclusion (RFI) or S | files and resources | shows |
| V12.3.4 | Verify that the application protects against Reflective File Download (RFD) by validating or ignoring user-submitted filenames in a JSON, JSONP, or URL paramete | files and resources | supports |
| V12.3.5 | Verify that untrusted file metadata is not used directly with system API or libraries, to protect against OS command injection. | files and resources | shows |
| V12.3.6 | Verify that the application does not include and execute functionality from untrusted sources, such as unverified content distribution networks, JavaScript libr | files and resources | supports |
| V12.4.1 | Verify that files obtained from untrusted sources are stored outside the web root, with limited permissions. | files and resources | supports |
| V12.4.2 | Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent upload and serving of known malicious content. | files and resources | shows |
| V12.5.1 | Verify that the web tier is configured to serve only files with specific file extensions to prevent unintentional information and source code leakage. For examp | files and resources | shows |
| V12.5.2 | Verify that direct requests to uploaded files will never be executed as HTML/JavaScript content. | files and resources | supports |
| V12.6.1 | Verify that the web or application server is configured with an allow list of resources or systems to which the server can send requests or load data/files from | files and resources | supports |
| V13.1.1 | Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that coul | API and web service | supports |
| V13.1.2 | [DELETED, DUPLICATE OF 4.3.1] | API and web service | supports |
| V13.1.3 | Verify API URLs do not expose sensitive information, such as the API key, session tokens etc. | API and web service | shows |
| V13.1.4 | Verify that authorization decisions are made at both the URI, enforced by programmatic or declarative security at the controller or router, and at the resource | API and web service | shows |
| V13.1.5 | Verify that requests containing unexpected or missing content types are rejected with appropriate headers (HTTP response status 406 Unacceptable or 415 Unsuppor | API and web service | supports |
| V13.2.1 | Verify that enabled RESTful HTTP methods are a valid choice for the user or action, such as preventing normal users using DELETE or PUT on protected API or reso | API and web service | shows |
| V13.2.2 | Verify that JSON schema validation is in place and verified before accepting input. | API and web service | supports |
| V13.2.3 | Verify that RESTful web services that utilize cookies are protected from Cross-Site Request Forgery via the use of at least one or more of the following: double | API and web service | supports |
| V13.2.4 | [DELETED, DUPLICATE OF 11.1.4] | API and web service | supports |
| V13.2.5 | Verify that REST services explicitly check the incoming Content-Type to be the expected one, such as application/xml or application/json. | API and web service | supports |
| V13.2.6 | Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient | API and web service | supports |
| V13.3.1 | Verify that XSD schema validation takes place to ensure a properly formed XML document, followed by validation of each input field before any processing of that | API and web service | supports |
| V13.3.2 | Verify that the message payload is signed using WS-Security to ensure reliable transport between client and service. | API and web service | supports |
| V13.4.1 | Verify that a query allow list or a combination of depth limiting and amount limiting is used to prevent GraphQL or data layer expression Denial of Service (DoS | API and web service | shows |
| V13.4.2 | Verify that GraphQL or other data layer authorization logic should be implemented at the business logic layer instead of the GraphQL layer. | API and web service | shows |
CWE v4.20 (75)
| ID | Requirement | Domain | Classification |
|---|---|---|---|
| CWE-1004 | Sensitive Cookie Without 'HttpOnly' Flag | weakness class | shows |
| CWE-116 | Improper Encoding or Escaping of Output | weakness class | shows |
| CWE-117 | Improper Output Neutralization for Logs | weakness class | shows |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | weakness class | shows |
| CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | weakness class | shows |
| CWE-134 | Use of Externally-Controlled Format String | weakness class | shows |
| CWE-138 | Improper Neutralization of Special Elements | weakness class | shows |
| CWE-147 | Improper Neutralization of Input Terminators | weakness class | shows |
| CWE-159 | Improper Handling of Invalid Use of Special Elements | weakness class | shows |
| CWE-176 | Improper Handling of Unicode Encoding | weakness class | shows |
| CWE-190 | Integer Overflow or Wraparound | weakness class | shows |
| CWE-20 | Improper Input Validation | weakness class | shows |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | weakness class | shows |
| CWE-210 | Self-generated Error Message Containing Sensitive Information | weakness class | shows |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | weakness class | shows |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | weakness class | shows |
| CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | weakness class | shows |
| CWE-233 | Improper Handling of Parameters | weakness class | shows |
| CWE-235 | Improper Handling of Extra Parameters | weakness class | shows |
| CWE-285 | Improper Authorization | weakness class | shows |
| CWE-290 | Authentication Bypass by Spoofing | weakness class | shows |
| CWE-306 | Missing Authentication for Critical Function | weakness class | shows |
| CWE-319 | Cleartext Transmission of Sensitive Information | weakness class | shows |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | weakness class | shows |
| CWE-331 | Insufficient Entropy | weakness class | shows |
| CWE-345 | Insufficient Verification of Data Authenticity | weakness class | shows |
| CWE-352 | Cross-Site Request Forgery (CSRF) | weakness class | shows |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | weakness class | shows |
| CWE-384 | Session Fixation | weakness class | shows |
| CWE-390 | Detection of Error Condition Without Action | weakness class | shows |
| CWE-400 | Uncontrolled Resource Consumption | weakness class | shows |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | weakness class | shows |
| CWE-419 | Unprotected Primary Channel | weakness class | shows |
| CWE-431 | Missing Handler | weakness class | shows |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | weakness class | shows |
| CWE-436 | Interpretation Conflict | weakness class | shows |
| CWE-502 | Deserialization of Untrusted Data | weakness class | shows |
| CWE-509 | Replicating Malicious Code (Virus or Worm) | weakness class | shows |
| CWE-524 | Use of Cache Containing Sensitive Information | weakness class | shows |
| CWE-525 | Use of Web Browser Cache Containing Sensitive Information | weakness class | shows |
| CWE-532 | Insertion of Sensitive Information into Log File | weakness class | shows |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | weakness class | shows |
| CWE-544 | Missing Standardized Error Handling Mechanism | weakness class | shows |
| CWE-548 | Exposure of Information Through Directory Listing | weakness class | shows |
| CWE-552 | Files or Directories Accessible to External Parties | weakness class | shows |
| CWE-598 | Use of HTTP Request With Sensitive Query String | weakness class | shows |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | weakness class | shows |
| CWE-602 | Client-Side Enforcement of Server-Side Security | weakness class | shows |
| CWE-611 | Improper Restriction of XML External Entity Reference | weakness class | shows |
| CWE-613 | Insufficient Session Expiration | weakness class | shows |
| CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | weakness class | shows |
| CWE-639 | Authorization Bypass Through User-Controlled Key | weakness class | shows |
| CWE-641 | Improper Restriction of Names for Files and Other Resources | weakness class | shows |
| CWE-643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') | weakness class | shows |
| CWE-650 | Trusting HTTP Permission Methods on the Server Side | weakness class | shows |
| CWE-73 | External Control of File Name or Path | weakness class | shows |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | weakness class | shows |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | weakness class | shows |
| CWE-770 | Allocation of Resources Without Limits or Throttling | weakness class | shows |
| CWE-778 | Insufficient Logging | weakness class | shows |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | weakness class | shows |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | weakness class | shows |
| CWE-798 | Use of Hard-coded Credentials | weakness class | shows |
| CWE-799 | Improper Control of Interaction Frequency | weakness class | shows |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | weakness class | shows |
| CWE-830 | Inclusion of Web Functionality from an Untrusted Source | weakness class | shows |
| CWE-841 | Improper Enforcement of Behavioral Workflow | weakness class | shows |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | weakness class | shows |
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | weakness class | shows |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | weakness class | shows |
| CWE-918 | Server-Side Request Forgery (SSRF) | weakness class | shows |
| CWE-922 | Insecure Storage of Sensitive Information | weakness class | shows |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | weakness class | shows |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | weakness class | shows |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | weakness class | shows |
NIST SP 800-53r5 (546)
| ID | Requirement | Domain | Classification |
|---|---|---|---|
| AC-2 | Account Management | Access Control | supports |
| AC-2.1 | Automated System Account Management | Access Control | supports |
| AC-2.2 | Automated Temporary and Emergency Account Management | Access Control | supports |
| AC-2.3 | Disable Accounts | Access Control | supports |
| AC-2.4 | Automated Audit Actions | Access Control | shows |
| AC-2.5 | Inactivity Logout | Access Control | shows |
| AC-2.6 | Dynamic Privilege Management | Access Control | supports |
| AC-2.7 | Privileged User Accounts | Access Control | supports |
| AC-2.8 | Dynamic Account Management | Access Control | supports |
| AC-2.9 | Restrictions on Use of Shared and Group Accounts | Access Control | supports |
| AC-2.10 | Shared and Group Account Credential Change | Access Control | supports |
| AC-2.11 | Usage Conditions | Access Control | supports |
| AC-2.12 | Account Monitoring for Atypical Usage | Access Control | shows |
| AC-2.13 | Disable Accounts for High-risk Individuals | Access Control | supports |
| AC-3 | Access Enforcement | Access Control | shows |
| AC-3.1 | Restricted Access to Privileged Functions | Access Control | supports |
| AC-3.2 | Dual Authorization | Access Control | shows |
| AC-3.3 | Mandatory Access Control | Access Control | supports |
| AC-3.4 | Discretionary Access Control | Access Control | supports |
| AC-3.5 | Security-relevant Information | Access Control | supports |
| AC-3.6 | Protection of User and System Information | Access Control | supports |
| AC-3.7 | Role-based Access Control | Access Control | supports |
| AC-3.8 | Revocation of Access Authorizations | Access Control | shows |
| AC-3.9 | Controlled Release | Access Control | supports |
| AC-3.10 | Audited Override of Access Control Mechanisms | Access Control | shows |
| AC-3.11 | Restrict Access to Specific Information Types | Access Control | supports |
| AC-3.12 | Assert and Enforce Application Access | Access Control | supports |
| AC-3.13 | Attribute-based Access Control | Access Control | supports |
| AC-3.14 | Individual Access | Access Control | supports |
| AC-3.15 | Discretionary and Mandatory Access Control | Access Control | supports |
| AC-4 | Information Flow Enforcement | Access Control | shows |
| AC-4.1 | Object Security and Privacy Attributes | Access Control | supports |
| AC-4.2 | Processing Domains | Access Control | supports |
| AC-4.3 | Dynamic Information Flow Control | Access Control | shows |
| AC-4.4 | Flow Control of Encrypted Information | Access Control | supports |
| AC-4.5 | Embedded Data Types | Access Control | supports |
| AC-4.6 | Metadata | Access Control | supports |
| AC-4.7 | One-way Flow Mechanisms | Access Control | supports |
| AC-4.8 | Security and Privacy Policy Filters | Access Control | supports |
| AC-4.9 | Human Reviews | Access Control | supports |
| AC-4.10 | Enable and Disable Security or Privacy Policy Filters | Access Control | supports |
| AC-4.11 | Configuration of Security or Privacy Policy Filters | Access Control | supports |
| AC-4.12 | Data Type Identifiers | Access Control | supports |
| AC-4.13 | Decomposition into Policy-relevant Subcomponents | Access Control | supports |
| AC-4.14 | Security or Privacy Policy Filter Constraints | Access Control | supports |
| AC-4.16 | Information Transfers on Interconnected Systems | Access Control | supports |
| AC-4.17 | Domain Authentication | Access Control | supports |
| AC-4.18 | Security Attribute Binding | Access Control | supports |
| AC-4.19 | Validation of Metadata | Access Control | supports |
| AC-4.20 | Approved Solutions | Access Control | supports |
| AC-4.22 | Access Only | Access Control | supports |
| AC-4.23 | Modify Non-releasable Information | Access Control | supports |
| AC-4.24 | Internal Normalized Format | Access Control | supports |
| AC-4.25 | Data Sanitization | Access Control | supports |
| AC-4.26 | Audit Filtering Actions | Access Control | shows |
| AC-4.27 | Redundant/Independent Filtering Mechanisms | Access Control | supports |
| AC-4.28 | Linear Filter Pipelines | Access Control | supports |
| AC-4.29 | Filter Orchestration Engines | Access Control | supports |
| AC-4.30 | Filter Mechanisms Using Multiple Processes | Access Control | supports |
| AC-4.31 | Failed Content Transfer Prevention | Access Control | shows |
| AC-4.32 | Process Requirements for Information Transfer | Access Control | supports |
| AC-5 | Separation of Duties | Access Control | shows |
| AC-6 | Least Privilege | Access Control | shows |
| AC-6.1 | Authorize Access to Security Functions | Access Control | shows |
| AC-6.2 | Non-privileged Access for Nonsecurity Functions | Access Control | supports |
| AC-6.3 | Network Access to Privileged Commands | Access Control | supports |
| AC-6.4 | Separate Processing Domains | Access Control | supports |
| AC-6.5 | Privileged Accounts | Access Control | supports |
| AC-6.6 | Privileged Access by Non-organizational Users | Access Control | supports |
| AC-6.7 | Review of User Privileges | Access Control | supports |
| AC-6.8 | Privilege Levels for Code Execution | Access Control | supports |
| AC-6.9 | Log Use of Privileged Functions | Access Control | shows |
| AC-6.10 | Prohibit Non-privileged Users from Executing Privileged Functions | Access Control | supports |
| AC-7 | Unsuccessful Logon Attempts | Access Control | shows |
| AC-7.1 | Automatic Account Lock | Access Control | supports |
| AC-7.2 | Purge or Wipe Mobile Device | Access Control | supports |
| AC-7.3 | Biometric Attempt Limiting | Access Control | supports |
| AC-7.4 | Use of Alternate Authentication Factor | Access Control | supports |
| AC-8 | System Use Notification | Access Control | supports |
| AC-9 | Previous Logon Notification | Access Control | shows |
| AC-9.1 | Unsuccessful Logons | Access Control | shows |
| AC-9.2 | Successful and Unsuccessful Logons | Access Control | shows |
| AC-9.3 | Notification of Account Changes | Access Control | supports |
| AC-9.4 | Additional Logon Information | Access Control | shows |
| AC-10 | Concurrent Session Control | Access Control | shows |
| AC-11 | Device Lock | Access Control | supports |
| AC-11.1 | Pattern-hiding Displays | Access Control | supports |
| AC-12 | Session Termination | Access Control | shows |
| AC-12.1 | User-initiated Logouts | Access Control | shows |
| AC-12.2 | Termination Message | Access Control | supports |
| AC-12.3 | Timeout Warning Message | Access Control | supports |
| AC-13 | Supervision and Review — Access Control | Access Control | supports |
| AC-14 | Permitted Actions Without Identification or Authentication | Access Control | supports |
| AC-14.1 | Necessary Uses | Access Control | supports |
| AC-15 | Automated Marking | Access Control | supports |
| AC-16 | Security and Privacy Attributes | Access Control | supports |
| AC-16.1 | Dynamic Attribute Association | Access Control | supports |
| AC-16.2 | Attribute Value Changes by Authorized Individuals | Access Control | shows |
| AC-16.3 | Maintenance of Attribute Associations by System | Access Control | supports |
| AC-16.4 | Association of Attributes by Authorized Individuals | Access Control | shows |
| AC-16.5 | Attribute Displays on Objects to Be Output | Access Control | supports |
| AC-16.6 | Maintenance of Attribute Association | Access Control | supports |
| AC-16.7 | Consistent Attribute Interpretation | Access Control | supports |
| AC-16.8 | Association Techniques and Technologies | Access Control | shows |
| AC-16.9 | Attribute Reassignment — Regrading Mechanisms | Access Control | supports |
| AC-16.10 | Attribute Configuration by Authorized Individuals | Access Control | shows |
| AC-17 | Remote Access | Access Control | supports |
| AC-17.1 | Monitoring and Control | Access Control | shows |
| AC-17.2 | Protection of Confidentiality and Integrity Using Encryption | Access Control | shows |
| AC-17.3 | Managed Access Control Points | Access Control | supports |
| AC-17.4 | Privileged Commands and Access | Access Control | supports |
| AC-17.5 | Monitoring for Unauthorized Connections | Access Control | shows |
| AC-17.6 | Protection of Mechanism Information | Access Control | supports |
| AC-17.7 | Additional Protection for Security Function Access | Access Control | supports |
| AC-17.8 | Disable Nonsecure Network Protocols | Access Control | supports |
| AC-17.9 | Disconnect or Disable Access | Access Control | supports |
| AC-17.10 | Authenticate Remote Commands | Access Control | supports |
| AC-18 | Wireless Access | Access Control | supports |
| AC-18.1 | Authentication and Encryption | Access Control | supports |
| AC-18.2 | Monitoring Unauthorized Connections | Access Control | shows |
| AC-18.3 | Disable Wireless Networking | Access Control | supports |
| AC-18.4 | Restrict Configurations by Users | Access Control | supports |
| AC-18.5 | Antennas and Transmission Power Levels | Access Control | supports |
| AC-19 | Access Control for Mobile Devices | Access Control | supports |
| AC-19.1 | Use of Writable and Portable Storage Devices | Access Control | supports |
| AC-19.2 | Use of Personally Owned Portable Storage Devices | Access Control | supports |
| AC-19.3 | Use of Portable Storage Devices with No Identifiable Owner | Access Control | supports |
| AC-19.4 | Restrictions for Classified Information | Access Control | supports |
| AC-19.5 | Full Device or Container-based Encryption | Access Control | supports |
| AC-20 | Use of External Systems | Access Control | supports |
| AC-20.1 | Limits on Authorized Use | Access Control | shows |
| AC-20.2 | Portable Storage Devices — Restricted Use | Access Control | supports |
| AC-20.3 | Non-organizationally Owned Systems — Restricted Use | Access Control | supports |
| AC-20.4 | Network Accessible Storage Devices — Prohibited Use | Access Control | supports |
| AC-20.5 | Portable Storage Devices — Prohibited Use | Access Control | supports |
| AC-21 | Information Sharing | Access Control | supports |
| AC-21.1 | Automated Decision Support | Access Control | supports |
| AC-21.2 | Information Search and Retrieval | Access Control | supports |
| AC-22 | Publicly Accessible Content | Access Control | supports |
| AC-23 | Data Mining Protection | Access Control | supports |
| AC-24 | Access Control Decisions | Access Control | supports |
| AC-24.1 | Transmit Access Authorization Information | Access Control | shows |
| AC-24.2 | No User or Process Identity | Access Control | supports |
| AC-25 | Reference Monitor | Access Control | supports |
| AU-2 | Event Logging | Audit and Accountability | shows |
| AU-2.1 | Compilation of Audit Records from Multiple Sources | Audit and Accountability | shows |
| AU-2.2 | Selection of Audit Events by Component | Audit and Accountability | shows |
| AU-2.3 | Reviews and Updates | Audit and Accountability | supports |
| AU-2.4 | Privileged Functions | Audit and Accountability | supports |
| AU-3 | Content of Audit Records | Audit and Accountability | shows |
| AU-3.1 | Additional Audit Information | Audit and Accountability | shows |
| AU-3.2 | Centralized Management of Planned Audit Record Content | Audit and Accountability | shows |
| AU-3.3 | Limit Personally Identifiable Information Elements | Audit and Accountability | supports |
| AU-4 | Audit Log Storage Capacity | Audit and Accountability | shows |
| AU-4.1 | Transfer to Alternate Storage | Audit and Accountability | supports |
| AU-5 | Response to Audit Logging Process Failures | Audit and Accountability | shows |
| AU-5.1 | Storage Capacity Warning | Audit and Accountability | supports |
| AU-5.2 | Real-time Alerts | Audit and Accountability | supports |
| AU-5.3 | Configurable Traffic Volume Thresholds | Audit and Accountability | supports |
| AU-5.4 | Shutdown on Failure | Audit and Accountability | supports |
| AU-5.5 | Alternate Audit Logging Capability | Audit and Accountability | shows |
| AU-6 | Audit Record Review, Analysis, and Reporting | Audit and Accountability | shows |
| AU-6.1 | Automated Process Integration | Audit and Accountability | supports |
| AU-6.2 | Automated Security Alerts | Audit and Accountability | supports |
| AU-6.3 | Correlate Audit Record Repositories | Audit and Accountability | shows |
| AU-6.4 | Central Review and Analysis | Audit and Accountability | supports |
| AU-6.5 | Integrated Analysis of Audit Records | Audit and Accountability | shows |
| AU-6.7 | Permitted Actions | Audit and Accountability | supports |
| AU-6.8 | Full Text Analysis of Privileged Commands | Audit and Accountability | supports |
| AU-6.9 | Correlation with Information from Nontechnical Sources | Audit and Accountability | supports |
| AU-6.10 | Audit Level Adjustment | Audit and Accountability | shows |
| AU-7 | Audit Record Reduction and Report Generation | Audit and Accountability | shows |
| AU-7.1 | Automatic Processing | Audit and Accountability | supports |
| AU-7.2 | Automatic Sort and Search | Audit and Accountability | supports |
| AU-8 | Time Stamps | Audit and Accountability | supports |
| AU-8.1 | Synchronization with Authoritative Time Source | Audit and Accountability | supports |
| AU-8.2 | Secondary Authoritative Time Source | Audit and Accountability | supports |
| AU-9 | Protection of Audit Information | Audit and Accountability | shows |
| AU-9.1 | Hardware Write-once Media | Audit and Accountability | supports |
| AU-9.3 | Cryptographic Protection | Audit and Accountability | supports |
| AU-9.4 | Access by Subset of Privileged Users | Audit and Accountability | supports |
| AU-9.5 | Dual Authorization | Audit and Accountability | shows |
| AU-9.6 | Read-only Access | Audit and Accountability | supports |
| AU-9.7 | Store on Component with Different Operating System | Audit and Accountability | supports |
| AU-10 | Non-repudiation | Audit and Accountability | supports |
| AU-10.1 | Association of Identities | Audit and Accountability | supports |
| AU-10.2 | Validate Binding of Information Producer Identity | Audit and Accountability | supports |
| AU-10.3 | Chain of Custody | Audit and Accountability | supports |
| AU-10.4 | Validate Binding of Information Reviewer Identity | Audit and Accountability | supports |
| AU-10.5 | Digital Signatures | Audit and Accountability | supports |
| AU-11 | Audit Record Retention | Audit and Accountability | shows |
| AU-11.1 | Long-term Retrieval Capability | Audit and Accountability | supports |
| AU-12 | Audit Record Generation | Audit and Accountability | shows |
| AU-12.1 | System-wide and Time-correlated Audit Trail | Audit and Accountability | shows |
| AU-12.2 | Standardized Formats | Audit and Accountability | supports |
| AU-12.3 | Changes by Authorized Individuals | Audit and Accountability | shows |
| AU-12.4 | Query Parameter Audits of Personally Identifiable Information | Audit and Accountability | shows |
| AU-13 | Monitoring for Information Disclosure | Audit and Accountability | shows |
| AU-13.1 | Use of Automated Tools | Audit and Accountability | supports |
| AU-13.2 | Review of Monitored Sites | Audit and Accountability | supports |
| AU-13.3 | Unauthorized Replication of Information | Audit and Accountability | shows |
| AU-14 | Session Audit | Audit and Accountability | shows |
| AU-14.1 | System Start-up | Audit and Accountability | supports |
| AU-14.2 | Capture and Record Content | Audit and Accountability | supports |
| AU-14.3 | Remote Viewing and Listening | Audit and Accountability | supports |
| AU-15 | Alternate Audit Logging Capability | Audit and Accountability | shows |
| AU-16 | Cross-organizational Audit Logging | Audit and Accountability | shows |
| AU-16.1 | Identity Preservation | Audit and Accountability | supports |
| AU-16.2 | Sharing of Audit Information | Audit and Accountability | shows |
| AU-16.3 | Disassociability | Audit and Accountability | supports |
| CM-2 | Baseline Configuration | Configuration Management | shows |
| CM-2.1 | Reviews and Updates | Configuration Management | supports |
| CM-2.2 | Automation Support for Accuracy and Currency | Configuration Management | supports |
| CM-2.3 | Retention of Previous Configurations | Configuration Management | supports |
| CM-2.4 | Unauthorized Software | Configuration Management | shows |
| CM-2.5 | Authorized Software | Configuration Management | shows |
| CM-2.6 | Development and Test Environments | Configuration Management | supports |
| CM-2.7 | Configure Systems and Components for High-risk Areas | Configuration Management | supports |
| CM-3 | Configuration Change Control | Configuration Management | shows |
| CM-3.1 | Automated Documentation, Notification, and Prohibition of Changes | Configuration Management | supports |
| CM-3.2 | Testing, Validation, and Documentation of Changes | Configuration Management | supports |
| CM-3.3 | Automated Change Implementation | Configuration Management | supports |
| CM-3.4 | Security and Privacy Representatives | Configuration Management | supports |
| CM-3.5 | Automated Security Response | Configuration Management | supports |
| CM-3.6 | Cryptography Management | Configuration Management | supports |
| CM-3.7 | Review System Changes | Configuration Management | supports |
| CM-3.8 | Prevent or Restrict Configuration Changes | Configuration Management | shows |
| CM-4 | Impact Analyses | Configuration Management | supports |
| CM-4.1 | Separate Test Environments | Configuration Management | supports |
| CM-4.2 | Verification of Controls | Configuration Management | supports |
| CM-5 | Access Restrictions for Change | Configuration Management | supports |
| CM-5.1 | Automated Access Enforcement and Audit Records | Configuration Management | shows |
| CM-5.2 | Review System Changes | Configuration Management | supports |
| CM-5.3 | Signed Components | Configuration Management | supports |
| CM-5.4 | Dual Authorization | Configuration Management | shows |
| CM-5.5 | Privilege Limitation for Production and Operation | Configuration Management | supports |
| CM-5.6 | Limit Library Privileges | Configuration Management | supports |
| CM-5.7 | Automatic Implementation of Security Safeguards | Configuration Management | supports |
| CM-6 | Configuration Settings | Configuration Management | supports |
| CM-6.1 | Automated Management, Application, and Verification | Configuration Management | supports |
| CM-6.2 | Respond to Unauthorized Changes | Configuration Management | shows |
| CM-6.3 | Unauthorized Change Detection | Configuration Management | shows |
| CM-6.4 | Conformance Demonstration | Configuration Management | supports |
| CM-7 | Least Functionality | Configuration Management | supports |
| CM-7.1 | Periodic Review | Configuration Management | supports |
| CM-7.2 | Prevent Program Execution | Configuration Management | shows |
| CM-7.3 | Registration Compliance | Configuration Management | supports |
| CM-7.4 | Unauthorized Software — Deny-by-exception | Configuration Management | shows |
| CM-7.5 | Authorized Software — Allow-by-exception | Configuration Management | shows |
| CM-7.6 | Confined Environments with Limited Privileges | Configuration Management | supports |
| CM-7.7 | Code Execution in Protected Environments | Configuration Management | supports |
| CM-7.8 | Binary or Machine Executable Code | Configuration Management | supports |
| CM-7.9 | Prohibiting The Use of Unauthorized Hardware | Configuration Management | shows |
| CM-8 | System Component Inventory | Configuration Management | supports |
| CM-8.1 | Updates During Installation and Removal | Configuration Management | supports |
| CM-8.2 | Automated Maintenance | Configuration Management | supports |
| CM-8.3 | Automated Unauthorized Component Detection | Configuration Management | shows |
| CM-8.4 | Accountability Information | Configuration Management | supports |
| CM-8.5 | No Duplicate Accounting of Components | Configuration Management | supports |
| CM-8.6 | Assessed Configurations and Approved Deviations | Configuration Management | supports |
| CM-8.7 | Centralized Repository | Configuration Management | supports |
| CM-8.8 | Automated Location Tracking | Configuration Management | supports |
| CM-8.9 | Assignment of Components to Systems | Configuration Management | supports |
| CM-9.1 | Assignment of Responsibility | Configuration Management | supports |
| CM-10 | Software Usage Restrictions | Configuration Management | supports |
| CM-10.1 | Open-source Software | Configuration Management | supports |
| CM-11 | User-installed Software | Configuration Management | supports |
| CM-11.1 | Alerts for Unauthorized Installations | Configuration Management | shows |
| CM-11.2 | Software Installation with Privileged Status | Configuration Management | supports |
| CM-11.3 | Automated Enforcement and Monitoring | Configuration Management | shows |
| CM-12 | Information Location | Configuration Management | supports |
| CM-12.1 | Automated Tools to Support Information Location | Configuration Management | supports |
| CM-13 | Data Action Mapping | Configuration Management | supports |
| CM-14 | Signed Components | Configuration Management | supports |
| SC-2 | Separation of System and User Functionality | System and Communications Protection | supports |
| SC-2.1 | Interfaces for Non-privileged Users | System and Communications Protection | supports |
| SC-2.2 | Disassociability | System and Communications Protection | supports |
| SC-3 | Security Function Isolation | System and Communications Protection | supports |
| SC-3.1 | Hardware Separation | System and Communications Protection | supports |
| SC-3.2 | Access and Flow Control Functions | System and Communications Protection | supports |
| SC-3.3 | Minimize Nonsecurity Functionality | System and Communications Protection | supports |
| SC-3.4 | Module Coupling and Cohesiveness | System and Communications Protection | supports |
| SC-3.5 | Layered Structures | System and Communications Protection | supports |
| SC-4 | Information in Shared System Resources | System and Communications Protection | supports |
| SC-4.1 | Security Levels | System and Communications Protection | supports |
| SC-4.2 | Multilevel or Periods Processing | System and Communications Protection | supports |
| SC-5 | Denial-of-service Protection | System and Communications Protection | supports |
| SC-5.1 | Restrict Ability to Attack Other Systems | System and Communications Protection | supports |
| SC-5.2 | Capacity, Bandwidth, and Redundancy | System and Communications Protection | supports |
| SC-5.3 | Detection and Monitoring | System and Communications Protection | shows |
| SC-6 | Resource Availability | System and Communications Protection | supports |
| SC-7 | Boundary Protection | System and Communications Protection | shows |
| SC-7.2 | Public Access | System and Communications Protection | supports |
| SC-7.3 | Access Points | System and Communications Protection | supports |
| SC-7.4 | External Telecommunications Services | System and Communications Protection | supports |
| SC-7.5 | Deny by Default — Allow by Exception | System and Communications Protection | shows |
| SC-7.6 | Response to Recognized Failures | System and Communications Protection | supports |
| SC-7.7 | Split Tunneling for Remote Devices | System and Communications Protection | supports |
| SC-7.8 | Route Traffic to Authenticated Proxy Servers | System and Communications Protection | supports |
| SC-7.9 | Restrict Threatening Outgoing Communications Traffic | System and Communications Protection | supports |
| SC-7.10 | Prevent Exfiltration | System and Communications Protection | shows |
| SC-7.11 | Restrict Incoming Communications Traffic | System and Communications Protection | supports |
| SC-7.12 | Host-based Protection | System and Communications Protection | supports |
| SC-7.13 | Isolation of Security Tools, Mechanisms, and Support Components | System and Communications Protection | supports |
| SC-7.15 | Networked Privileged Accesses | System and Communications Protection | supports |
| SC-7.16 | Prevent Discovery of System Components | System and Communications Protection | shows |
| SC-7.17 | Automated Enforcement of Protocol Formats | System and Communications Protection | supports |
| SC-7.18 | Fail Secure | System and Communications Protection | supports |
| SC-7.19 | Block Communication from Non-organizationally Configured Hosts | System and Communications Protection | supports |
| SC-7.20 | Dynamic Isolation and Segregation | System and Communications Protection | supports |
| SC-7.21 | Isolation of System Components | System and Communications Protection | supports |
| SC-7.22 | Separate Subnets for Connecting to Different Security Domains | System and Communications Protection | supports |
| SC-7.23 | Disable Sender Feedback on Protocol Validation Failure | System and Communications Protection | supports |
| SC-7.24 | Personally Identifiable Information | System and Communications Protection | supports |
| SC-7.25 | Unclassified National Security System Connections | System and Communications Protection | supports |
| SC-7.26 | Classified National Security System Connections | System and Communications Protection | supports |
| SC-7.27 | Unclassified Non-national Security System Connections | System and Communications Protection | supports |
| SC-7.28 | Connections to Public Networks | System and Communications Protection | supports |
| SC-7.29 | Separate Subnets to Isolate Functions | System and Communications Protection | supports |
| SC-8 | Transmission Confidentiality and Integrity | System and Communications Protection | shows |
| SC-8.1 | Cryptographic Protection | System and Communications Protection | supports |
| SC-8.2 | Pre- and Post-transmission Handling | System and Communications Protection | supports |
| SC-8.3 | Cryptographic Protection for Message Externals | System and Communications Protection | supports |
| SC-8.4 | Conceal or Randomize Communications | System and Communications Protection | supports |
| SC-8.5 | Protected Distribution System | System and Communications Protection | supports |
| SC-9 | Transmission Confidentiality | System and Communications Protection | supports |
| SC-10 | Network Disconnect | System and Communications Protection | supports |
| SC-11 | Trusted Path | System and Communications Protection | supports |
| SC-11.1 | Irrefutable Communications Path | System and Communications Protection | supports |
| SC-12 | Cryptographic Key Establishment and Management | System and Communications Protection | supports |
| SC-12.1 | Availability | System and Communications Protection | supports |
| SC-12.2 | Symmetric Keys | System and Communications Protection | supports |
| SC-12.3 | Asymmetric Keys | System and Communications Protection | supports |
| SC-12.4 | PKI Certificates | System and Communications Protection | supports |
| SC-12.5 | PKI Certificates / Hardware Tokens | System and Communications Protection | supports |
| SC-13 | Cryptographic Protection | System and Communications Protection | supports |
| SC-13.1 | FIPS-validated Cryptography | System and Communications Protection | supports |
| SC-13.2 | NSA-approved Cryptography | System and Communications Protection | supports |
| SC-13.3 | Individuals Without Formal Access Approvals | System and Communications Protection | supports |
| SC-13.4 | Digital Signatures | System and Communications Protection | supports |
| SC-14 | Public Access Protections | System and Communications Protection | supports |
| SC-15 | Collaborative Computing Devices and Applications | System and Communications Protection | supports |
| SC-15.2 | Blocking Inbound and Outbound Communications Traffic | System and Communications Protection | supports |
| SC-15.3 | Disabling and Removal in Secure Work Areas | System and Communications Protection | supports |
| SC-15.4 | Explicitly Indicate Current Participants | System and Communications Protection | supports |
| SC-16 | Transmission of Security and Privacy Attributes | System and Communications Protection | supports |
| SC-16.1 | Integrity Verification | System and Communications Protection | shows |
| SC-16.2 | Anti-spoofing Mechanisms | System and Communications Protection | supports |
| SC-16.3 | Cryptographic Binding | System and Communications Protection | supports |
| SC-17 | Public Key Infrastructure Certificates | System and Communications Protection | supports |
| SC-18 | Mobile Code | System and Communications Protection | supports |
| SC-18.1 | Identify Unacceptable Code and Take Corrective Actions | System and Communications Protection | supports |
| SC-18.2 | Acquisition, Development, and Use | System and Communications Protection | supports |
| SC-18.3 | Prevent Downloading and Execution | System and Communications Protection | shows |
| SC-18.4 | Prevent Automatic Execution | System and Communications Protection | shows |
| SC-18.5 | Allow Execution Only in Confined Environments | System and Communications Protection | supports |
| SC-19 | Voice Over Internet Protocol | System and Communications Protection | supports |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | System and Communications Protection | supports |
| SC-20.1 | Child Subspaces | System and Communications Protection | supports |
| SC-20.2 | Data Origin and Integrity | System and Communications Protection | shows |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | System and Communications Protection | supports |
| SC-21.1 | Data Origin and Integrity | System and Communications Protection | shows |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | System and Communications Protection | supports |
| SC-23 | Session Authenticity | System and Communications Protection | shows |
| SC-23.1 | Invalidate Session Identifiers at Logout | System and Communications Protection | shows |
| SC-23.2 | User-initiated Logouts and Message Displays | System and Communications Protection | shows |
| SC-23.3 | Unique System-generated Session Identifiers | System and Communications Protection | shows |
| SC-23.4 | Unique Session Identifiers with Randomization | System and Communications Protection | shows |
| SC-23.5 | Allowed Certificate Authorities | System and Communications Protection | supports |
| SC-24 | Fail in Known State | System and Communications Protection | supports |
| SC-25 | Thin Nodes | System and Communications Protection | supports |
| SC-26 | Decoys | System and Communications Protection | supports |
| SC-26.1 | Detection of Malicious Code | System and Communications Protection | shows |
| SC-27 | Platform-independent Applications | System and Communications Protection | supports |
| SC-28 | Protection of Information at Rest | System and Communications Protection | supports |
| SC-28.1 | Cryptographic Protection | System and Communications Protection | supports |
| SC-28.2 | Offline Storage | System and Communications Protection | supports |
| SC-28.3 | Cryptographic Keys | System and Communications Protection | supports |
| SC-29 | Heterogeneity | System and Communications Protection | supports |
| SC-29.1 | Virtualization Techniques | System and Communications Protection | supports |
| SC-30 | Concealment and Misdirection | System and Communications Protection | supports |
| SC-30.1 | Virtualization Techniques | System and Communications Protection | supports |
| SC-30.2 | Randomness | System and Communications Protection | supports |
| SC-30.3 | Change Processing and Storage Locations | System and Communications Protection | supports |
| SC-30.4 | Misleading Information | System and Communications Protection | supports |
| SC-30.5 | Concealment of System Components | System and Communications Protection | supports |
| SC-31 | Covert Channel Analysis | System and Communications Protection | supports |
| SC-31.1 | Test Covert Channels for Exploitability | System and Communications Protection | supports |
| SC-31.2 | Maximum Bandwidth | System and Communications Protection | supports |
| SC-31.3 | Measure Bandwidth in Operational Environments | System and Communications Protection | supports |
| SC-32 | System Partitioning | System and Communications Protection | supports |
| SC-33 | Transmission Preparation Integrity | System and Communications Protection | shows |
| SC-34 | Non-modifiable Executable Programs | System and Communications Protection | supports |
| SC-34.1 | No Writable Storage | System and Communications Protection | supports |
| SC-34.2 | Integrity Protection on Read-only Media | System and Communications Protection | shows |
| SC-34.3 | Hardware-based Protection | System and Communications Protection | supports |
| SC-35 | External Malicious Code Identification | System and Communications Protection | shows |
| SC-36 | Distributed Processing and Storage | System and Communications Protection | supports |
| SC-36.1 | Polling Techniques | System and Communications Protection | supports |
| SC-36.2 | Synchronization | System and Communications Protection | supports |
| SC-37 | Out-of-band Channels | System and Communications Protection | supports |
| SC-37.1 | Ensure Delivery and Transmission | System and Communications Protection | supports |
| SC-38 | Operations Security | System and Communications Protection | supports |
| SC-39 | Process Isolation | System and Communications Protection | supports |
| SC-39.1 | Hardware Separation | System and Communications Protection | supports |
| SC-39.2 | Separate Execution Domain Per Thread | System and Communications Protection | supports |
| SC-40 | Wireless Link Protection | System and Communications Protection | supports |
| SC-40.1 | Electromagnetic Interference | System and Communications Protection | supports |
| SC-40.2 | Reduce Detection Potential | System and Communications Protection | supports |
| SC-40.3 | Imitative or Manipulative Communications Deception | System and Communications Protection | supports |
| SC-40.4 | Signal Parameter Identification | System and Communications Protection | supports |
| SC-41 | Port and I/O Device Access | System and Communications Protection | supports |
| SC-42 | Sensor Capability and Data | System and Communications Protection | supports |
| SC-42.1 | Reporting to Authorized Individuals or Roles | System and Communications Protection | shows |
| SC-42.2 | Authorized Use | System and Communications Protection | shows |
| SC-42.3 | Prohibit Use of Devices | System and Communications Protection | supports |
| SC-42.4 | Notice of Collection | System and Communications Protection | supports |
| SC-42.5 | Collection Minimization | System and Communications Protection | supports |
| SC-43 | Usage Restrictions | System and Communications Protection | supports |
| SC-44 | Detonation Chambers | System and Communications Protection | supports |
| SC-45 | System Time Synchronization | System and Communications Protection | supports |
| SC-45.1 | Synchronization with Authoritative Time Source | System and Communications Protection | supports |
| SC-45.2 | Secondary Authoritative Time Source | System and Communications Protection | supports |
| SC-46 | Cross Domain Policy Enforcement | System and Communications Protection | supports |
| SC-47 | Alternate Communications Paths | System and Communications Protection | supports |
| SC-48 | Sensor Relocation | System and Communications Protection | supports |
| SC-48.1 | Dynamic Relocation of Sensors or Monitoring Capabilities | System and Communications Protection | shows |
| SC-49 | Hardware-enforced Separation and Policy Enforcement | System and Communications Protection | supports |
| SC-50 | Software-enforced Separation and Policy Enforcement | System and Communications Protection | supports |
| SC-51 | Hardware-based Protection | System and Communications Protection | supports |
| SI-2 | Flaw Remediation | System and Information Integrity | shows |
| SI-2.1 | Central Management | System and Information Integrity | supports |
| SI-2.2 | Automated Flaw Remediation Status | System and Information Integrity | shows |
| SI-2.3 | Time to Remediate Flaws and Benchmarks for Corrective Actions | System and Information Integrity | supports |
| SI-2.4 | Automated Patch Management Tools | System and Information Integrity | supports |
| SI-2.5 | Automatic Software and Firmware Updates | System and Information Integrity | supports |
| SI-2.6 | Removal of Previous Versions of Software and Firmware | System and Information Integrity | supports |
| SI-2.7 | Root Cause Analysis | System and Information Integrity | supports |
| SI-3 | Malicious Code Protection | System and Information Integrity | shows |
| SI-3.1 | Central Management | System and Information Integrity | supports |
| SI-3.2 | Automatic Updates | System and Information Integrity | supports |
| SI-3.3 | Non-privileged Users | System and Information Integrity | supports |
| SI-3.4 | Updates Only by Privileged Users | System and Information Integrity | supports |
| SI-3.5 | Portable Storage Devices | System and Information Integrity | supports |
| SI-3.6 | Testing and Verification | System and Information Integrity | supports |
| SI-3.7 | Nonsignature-based Detection | System and Information Integrity | supports |
| SI-3.8 | Detect Unauthorized Commands | System and Information Integrity | shows |
| SI-3.9 | Authenticate Remote Commands | System and Information Integrity | supports |
| SI-3.10 | Malicious Code Analysis | System and Information Integrity | shows |
| SI-4 | System Monitoring | System and Information Integrity | shows |
| SI-4.1 | System-wide Intrusion Detection System | System and Information Integrity | supports |
| SI-4.2 | Automated Tools and Mechanisms for Real-time Analysis | System and Information Integrity | supports |
| SI-4.3 | Automated Tool and Mechanism Integration | System and Information Integrity | supports |
| SI-4.4 | Inbound and Outbound Communications Traffic | System and Information Integrity | supports |
| SI-4.5 | System-generated Alerts | System and Information Integrity | supports |
| SI-4.6 | Restrict Non-privileged Users | System and Information Integrity | supports |
| SI-4.7 | Automated Response to Suspicious Events | System and Information Integrity | shows |
| SI-4.8 | Protection of Monitoring Information | System and Information Integrity | shows |
| SI-4.9 | Testing of Monitoring Tools and Mechanisms | System and Information Integrity | shows |
| SI-4.10 | Visibility of Encrypted Communications | System and Information Integrity | supports |
| SI-4.11 | Analyze Communications Traffic Anomalies | System and Information Integrity | supports |
| SI-4.12 | Automated Organization-generated Alerts | System and Information Integrity | supports |
| SI-4.13 | Analyze Traffic and Event Patterns | System and Information Integrity | shows |
| SI-4.14 | Wireless Intrusion Detection | System and Information Integrity | supports |
| SI-4.15 | Wireless to Wireline Communications | System and Information Integrity | supports |
| SI-4.16 | Correlate Monitoring Information | System and Information Integrity | shows |
| SI-4.18 | Analyze Traffic and Covert Exfiltration | System and Information Integrity | supports |
| SI-4.19 | Risk for Individuals | System and Information Integrity | supports |
| SI-4.20 | Privileged Users | System and Information Integrity | supports |
| SI-4.21 | Probationary Periods | System and Information Integrity | supports |
| SI-4.22 | Unauthorized Network Services | System and Information Integrity | shows |
| SI-4.23 | Host-based Devices | System and Information Integrity | supports |
| SI-4.24 | Indicators of Compromise | System and Information Integrity | supports |
| SI-4.25 | Optimize Network Traffic Analysis | System and Information Integrity | supports |
| SI-5 | Security Alerts, Advisories, and Directives | System and Information Integrity | supports |
| SI-5.1 | Automated Alerts and Advisories | System and Information Integrity | supports |
| SI-6 | Security and Privacy Function Verification | System and Information Integrity | supports |
| SI-6.1 | Notification of Failed Security Tests | System and Information Integrity | supports |
| SI-6.2 | Automation Support for Distributed Testing | System and Information Integrity | supports |
| SI-6.3 | Report Verification Results | System and Information Integrity | supports |
| SI-7 | Software, Firmware, and Information Integrity | System and Information Integrity | shows |
| SI-7.1 | Integrity Checks | System and Information Integrity | shows |
| SI-7.2 | Automated Notifications of Integrity Violations | System and Information Integrity | shows |
| SI-7.3 | Centrally Managed Integrity Tools | System and Information Integrity | shows |
| SI-7.4 | Tamper-evident Packaging | System and Information Integrity | supports |
| SI-7.5 | Automated Response to Integrity Violations | System and Information Integrity | shows |
| SI-7.6 | Cryptographic Protection | System and Information Integrity | supports |
| SI-7.7 | Integration of Detection and Response | System and Information Integrity | supports |
| SI-7.8 | Auditing Capability for Significant Events | System and Information Integrity | shows |
| SI-7.9 | Verify Boot Process | System and Information Integrity | supports |
| SI-7.10 | Protection of Boot Firmware | System and Information Integrity | supports |
| SI-7.11 | Confined Environments with Limited Privileges | System and Information Integrity | supports |
| SI-7.12 | Integrity Verification | System and Information Integrity | shows |
| SI-7.13 | Code Execution in Protected Environments | System and Information Integrity | supports |
| SI-7.14 | Binary or Machine Executable Code | System and Information Integrity | supports |
| SI-7.15 | Code Authentication | System and Information Integrity | supports |
| SI-7.16 | Time Limit on Process Execution Without Supervision | System and Information Integrity | supports |
| SI-7.17 | Runtime Application Self-protection | System and Information Integrity | supports |
| SI-8 | Spam Protection | System and Information Integrity | supports |
| SI-8.1 | Central Management | System and Information Integrity | supports |
| SI-8.2 | Automatic Updates | System and Information Integrity | supports |
| SI-8.3 | Continuous Learning Capability | System and Information Integrity | supports |
| SI-9 | Information Input Restrictions | System and Information Integrity | supports |
| SI-10 | Information Input Validation | System and Information Integrity | shows |
| SI-10.1 | Manual Override Capability | System and Information Integrity | supports |
| SI-10.2 | Review and Resolve Errors | System and Information Integrity | shows |
| SI-10.3 | Predictable Behavior | System and Information Integrity | supports |
| SI-10.4 | Timing Interactions | System and Information Integrity | supports |
| SI-10.5 | Restrict Inputs to Trusted Sources and Approved Formats | System and Information Integrity | supports |
| SI-10.6 | Injection Prevention | System and Information Integrity | shows |
| SI-11 | Error Handling | System and Information Integrity | shows |
| SI-12 | Information Management and Retention | System and Information Integrity | supports |
| SI-12.1 | Limit Personally Identifiable Information Elements | System and Information Integrity | supports |
| SI-12.3 | Information Disposal | System and Information Integrity | supports |
| SI-13 | Predictable Failure Prevention | System and Information Integrity | shows |
| SI-13.1 | Transferring Component Responsibilities | System and Information Integrity | supports |
| SI-13.2 | Time Limit on Process Execution Without Supervision | System and Information Integrity | supports |
| SI-13.3 | Manual Transfer Between Components | System and Information Integrity | supports |
| SI-13.4 | Standby Component Installation and Notification | System and Information Integrity | supports |
| SI-13.5 | Failover Capability | System and Information Integrity | supports |
| SI-14 | Non-persistence | System and Information Integrity | supports |
| SI-14.1 | Refresh from Trusted Sources | System and Information Integrity | supports |
| SI-14.2 | Non-persistent Information | System and Information Integrity | supports |
| SI-14.3 | Non-persistent Connectivity | System and Information Integrity | supports |
| SI-15 | Information Output Filtering | System and Information Integrity | supports |
| SI-16 | Memory Protection | System and Information Integrity | supports |
| SI-17 | Fail-safe Procedures | System and Information Integrity | supports |
| SI-18 | Personally Identifiable Information Quality Operations | System and Information Integrity | supports |
| SI-18.1 | Automation Support | System and Information Integrity | supports |
| SI-18.2 | Data Tags | System and Information Integrity | supports |
| SI-18.3 | Collection | System and Information Integrity | supports |
| SI-18.4 | Individual Requests | System and Information Integrity | supports |
| SI-18.5 | Notice of Correction or Deletion | System and Information Integrity | supports |
| SI-19 | De-identification | System and Information Integrity | supports |
| SI-19.1 | Collection | System and Information Integrity | supports |
| SI-19.2 | Archiving | System and Information Integrity | supports |
| SI-19.3 | Release | System and Information Integrity | supports |
| SI-19.4 | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers | System and Information Integrity | supports |
| SI-19.5 | Statistical Disclosure Control | System and Information Integrity | supports |
| SI-19.6 | Differential Privacy | System and Information Integrity | supports |
| SI-19.7 | Validated Algorithms and Software | System and Information Integrity | supports |
| SI-19.8 | Motivated Intruder | System and Information Integrity | supports |
| SI-20 | Tainting | System and Information Integrity | supports |
| SI-21 | Information Refresh | System and Information Integrity | supports |
| SI-22 | Information Diversity | System and Information Integrity | supports |
| SI-23 | Information Fragmentation | System and Information Integrity | supports |
ASVS content © OWASP Foundation, CC BY-SA 4.0. CWE is a trademark of The MITRE Corporation; CWE content used per MITRE's terms. NIST SP 800-53 is a work of the U.S. Government, public domain. Sources retrieved from the publishers' official repositories.