SC-23(5): Allowed Certificate Authorities

Control Family:

System And Communications Protection

Parent Control:

SC-23: Session Authenticity

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

PR.PT-4

Threats Addressed:

Spoofing
Tampering

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5:
SC-23(5): Allowed Certificate Authorities

Control Statement

The information system only allows the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.

Supplemental Guidance

Reliance on certificate authorities (CAs) for the establishment of secure sessions includes, for example, the use of Secure Socket Layer (SSL) and/or Transport Layer Security (TLS) certificates. These certificates, after verification by the respective certificate authorities, facilitate the establishment of protected sessions between web clients and web servers.