NIST 800-53 r5 · Controls catalogue · Family SC
SC-15Collaborative Computing Devices and Applications
Prohibit remote activation of collaborative computing devices and applications with the following exceptions: {{ insert: param, sc-15_odp }} ; and Provide an explicit indication of use to users physically present at the devices.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,204 | Prevents covert remote capture and exposure of audio/video streams to unauthorized actors. |
CWE-862 | Missing Authorization | 8,680 | Eliminates missing authorization checks for activating devices that can capture sensitive information. |
CWE-284 | Improper Access Control | 4,832 | Directly enforces access control by prohibiting unauthorized remote activation of cameras, mics, and similar devices. |
CWE-306 | Missing Authentication for Critical Function | 2,567 | Treats remote activation of surveillance-capable devices as a critical function that must be disabled or authenticated. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,824 | Forces correct permission settings on device resources so remote parties cannot activate them. |
CWE-285 | Improper Authorization | 1,230 | Requires explicit authorization decisions before any remote activation of collaborative hardware or apps. |
CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | 174 | Blocks unauthorized remote access that would expose private personal information via collaborative devices. |
CWE-356 | Product UI does not Warn User of Unsafe Actions | 32 | Mandates explicit user-visible indication, directly countering absence of warnings for device activation. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2022-50925 | 2.0 | 9.8 | 0.0003 | good |
CVE-2025-23025 | 1.9 | 9.0 | 0.0219 | good |