Cryptographic Protection SC-13

System and Communications Protection · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SC-13 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-13 (Cryptographic Protection) requires the system to use cryptography that meets the laws and standards for its purpose — for U.S. federal Moderate systems that means FIPS-validated (Federal Information Processing Standards) algorithms and modules for the protections you depend on. The control names which cryptography is used and why.

What good looks like

Identify every place cryptography is required — data in transit, data at rest, and authentication.
Use approved, validated algorithms and modules (FIPS 140-validated) for those uses.
Avoid weak or deprecated algorithms such as MD5, DES, SSLv3, or early TLS.
Document the cryptographic uses and configure the operating-system (OS) crypto policy to enforce the approved set.

Framework mapping

NIST CSF 2.0 — PR.DS-02 — Data are protected using validated cryptographic mechanisms
CIS Controls v8 — Control 3 — Data Protection (encrypt data with approved algorithms)

How to move it toward Implemented

SSH provides strong crypto for the admin channel, but SC-13 is not fully met on this asset.
Two gaps: no FIPS-validated cryptography is specified — enable the OS crypto policy / FIPS mode and record the modules in use — and the DVWA app has no TLS at all (fix with HTTPS, see SC-8).
Document the approved algorithm set (and disable weak ciphers in sshd_config), then attach it naming SC-13 to progress from partial toward 'Completed'.