ComplianceNIST 800-53 control

NIST-SC-13 Cryptographic Protection

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-13
ATT&CK techniques mitigated
5

Control statement

a. Determine the [Assignment: cryptographic uses] ; and b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: types of cryptography].

Discussion

Cryptography can be employed to support a variety of security solutions, including the protection of classified information and controlled unclassified information, the provision and implementation of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances but lack the necessary formal access approvals. Cryptography can also be used to support random number and hash generation. Generally applicable cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography. For example, organizations that need to protect classified information may specify the use of NSA-approved cryptography. Organizations that need to provision and implement digital signatures may specify the use of FIPS-validated cryptography. Cryptography is implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

ATT&CK mappings (CTID)

• T1005 Data from Local System • T1025 Data from Removable Media • T1041 Exfiltration Over C2 Channel • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1557.004 Evil Twin

Related

Mitigates · MITRE ATT&CK (5)

  • T1557.004 Evil Twin sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1005 Data from Local System technique
  • T1025 Data from Removable Media technique
  • T1041 Exfiltration Over C2 Channel technique

Related control · Compliance (29)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-7 Unsuccessful Logon Attempts NIST 800-53 control
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-5 Media Transport NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-40 Wireless Link Protection NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (47)

  • NIST-AC-16(8) Association Techniques and Technologies NIST 800-53 enhancement
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-17(10) Authenticate Remote Commands NIST 800-53 enhancement
  • NIST-AC-17(2) Protection of Confidentiality and Integrity Using Encryption NIST 800-53 enhancement
  • NIST-AC-17(4) Privileged Commands and Access NIST 800-53 enhancement
  • NIST-AC-18(1) Authentication and Encryption NIST 800-53 enhancement
  • NIST-AC-19(5) Full Device or Container-based Encryption NIST 800-53 enhancement
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-AU-9(3) Cryptographic Protection NIST 800-53 enhancement
  • NIST-CM-14 Signed Components NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-CP-9(8) Cryptographic Protection NIST 800-53 enhancement
  • NIST-IA-13(1) Protection of Cryptographic Keys NIST 800-53 enhancement
  • NIST-IA-3(1) Cryptographic Bidirectional Authentication NIST 800-53 enhancement
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-MA-4(6) Cryptographic Protection NIST 800-53 enhancement
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-5 Media Transport NIST 800-53 control
  • NIST-SA-4(6) Use of Information Assurance Products NIST 800-53 enhancement
  • NIST-SA-4(7) NIAP-approved Protection Profiles NIST 800-53 enhancement
  • NIST-SA-8(18) Trusted Communications Channels NIST 800-53 enhancement
  • NIST-SA-8(26) Performance Security NIST 800-53 enhancement
  • NIST-SA-9(6) Organization-controlled Cryptographic Keys NIST 800-53 enhancement
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-16(3) Cryptographic Binding NIST 800-53 enhancement
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
Show all 47 ›