NIST 800-53 r5 · Controls catalogue · Family CA
CA-4Security Certification
Security Certification
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 8,680 | Requires verification that authorization checks are present and operational for protected resources. |
CWE-284 | Improper Access Control | 4,832 | Certification requires independent assessment confirming access controls are implemented correctly and effective. |
CWE-863 | Incorrect Authorization | 3,234 | Certification evaluates whether authorization decisions are correctly implemented and enforced. |
CWE-269 | Improper Privilege Management | 2,907 | The control mandates review of privilege assignments to ensure they are appropriate and minimal. |
CWE-306 | Missing Authentication for Critical Function | 2,567 | Certification assesses that critical functions have required authentication controls in place. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,824 | Certification includes checking that permissions on critical resources are correctly assigned. |
CWE-285 | Improper Authorization | 1,230 | The process verifies authorization mechanisms function as intended before system approval. |
CWE-693 | Protection Mechanism Failure | 476 | Requires assessment that protection mechanisms are correctly implemented and producing intended security outcomes. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||