Transmission Confidentiality and Integrity SC-8

System and Communications Protection · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SC-8 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-8 (Transmission Confidentiality and Integrity) requires protecting data in transit so it cannot be read or altered on the wire — normally with encryption such as TLS (Transport Layer Security) or SSH (Secure Shell). At Moderate it applies to information crossing the system boundary, and covers both confidentiality (no eavesdropping) and integrity (no tampering).

What good looks like

Encrypt data in transit end-to-end with TLS, SSH, or IPsec (Internet Protocol Security).
Protect both confidentiality and integrity of what is transmitted, not just one.
Refuse or redirect plaintext protocols — force Hypertext Transfer Protocol Secure (HTTPS) and disable weak ciphers and old TLS versions.
Manage and rotate the certificates and keys behind the encrypted channels (ties to SC-12).

Framework mapping

NIST CSF 2.0 — PR.DS-02 — The confidentiality and integrity of data-in-transit are protected
CIS Controls v8 — Control 3.10 — Encrypt sensitive data in transit
OWASP Top 10:2021 — A02 Cryptographic Failures — Sensitive data must not travel over the network in cleartext

How to move it toward Implemented

The management plane is already met: SSH is key-only and the PlumbWatch dashboard is reached only through an encrypted SSH port-forward.
The open gap is the application plane — DVWA (Damn Vulnerable Web Application) serves plain HTTP on :8080 with no TLS. Put it behind a reverse proxy (nginx or Caddy) that terminates HTTPS, and redirect HTTP to HTTPS.
After TLS is in front of the app, capture a curl -I showing the HTTPS response and HTTP Strict Transport Security (HSTS) header as evidence naming SC-8 to move from partial toward 'Completed'.