NIST 800-53 r5 · Controls catalogue · Family SC
SC-24Fail in Known State
Fail to a {{ insert: param, sc-24_odp.02 }} for the following failures on the indicated components while preserving {{ insert: param, sc-24_odp.03 }} in failure: {{ insert: param, sc-24_odp.01 }}.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-754 | Improper Check for Unusual or Exceptional Conditions | 697 | Requires detection of unusual conditions followed by a controlled transition to the defined failure state. |
CWE-755 | Improper Handling of Exceptional Conditions | 662 | Enforces structured response to exceptional conditions so the system cannot remain in an unsafe state. |
CWE-248 | Uncaught Exception | 189 | Prevents abrupt termination from uncaught exceptions by requiring a defined, preserved-state failure mode. |
CWE-703 | Improper Check or Handling of Exceptional Conditions | 146 | Mandates explicit, predictable handling of exceptional conditions rather than undefined continuation. |
CWE-636 | Not Failing Securely ('Failing Open') | 27 | Directly requires transition to a known (secure) state on failure, preventing fail-open behavior. |
CWE-390 | Detection of Error Condition Without Action | 14 | Ensures that detected error conditions trigger an explicit action to reach the known failure state. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-30430 | 2.0 | 9.8 | 0.0052 | good |
CVE-2026-2287 | 2.0 | 9.8 | 0.0007 | good |
CVE-2026-27586 | 1.8 | 9.1 | 0.0013 | good |
CVE-2026-23466 | 1.6 | 7.8 | 0.0001 | good |
CVE-2026-42423 | 1.5 | 7.5 | 0.0005 | good |
CVE-2026-35535 | 1.5 | 7.4 | 0.0001 | good |
CVE-2026-31409 | 1.8 | 8.8 | 0.0003 | good |
CVE-2026-34063 | 1.5 | 7.5 | 0.0005 | good |
CVE-2026-40246 | 1.5 | 7.5 | 0.0002 | good |
CVE-2026-29643 | 1.4 | 7.1 | 0.0001 | partial |