{"data":{"id":"SC-08","name":"Transmission Confidentiality and Integrity","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.","supplemental_guidance":"Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques.\n\nOrganizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.","enhancements":[{"id":"SC-08(01)","name":"Cryptographic Protection","statement":"Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.","baselines":["moderate","high"]},{"id":"SC-08(02)","name":"Pre- and Post-transmission Handling","statement":"Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.","baselines":[]},{"id":"SC-08(03)","name":"Cryptographic Protection for Message Externals","statement":"Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].","baselines":[]},{"id":"SC-08(04)","name":"Conceal or Randomize Communications","statement":"Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].","baselines":[]},{"id":"SC-08(05)","name":"Protected Distribution System","statement":"Implement [Assignment: organization-defined protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SC-08","name":"Transmission Confidentiality and Integrity","description":"Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.","discussion":"Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques.\n\nOrganizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.","related_controls":["AC-17","AC-18","AU-10","IA-03","IA-08","IA-09","MA-04","PE-04","SA-04","SA-08","SC-07","SC-16","SC-20","SC-23","SC-28"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.5.10","A.5.14","A.5.33","A.8.20","A.8.21","A.8.26"],"iso_27002_2022":["5.14","8.20","8.21"],"cobit_2019":[],"pci_dss_v4":["2.2.7","4.1","4.2"],"nist_csf_2":["PR.DS-02"],"cis_controls_v8":["CIS 3","CIS 3.10","CIS 12.3","CIS 12.6"],"soc2_tsc":["CC6.1","CC6.7"],"finos_ccc":["CCC-C01"],"iso_42001_2023":[],"iec_62443":["3-3 SR 3.1","3-3 SR 4.1"],"asd_e8":[],"nis2":["Art. 21(2)(h)","Art. 21(2)(j)"],"apra_cps_234":["Para 22-23"],"mas_trm":["10","14"],"pra_op_resilience":["SS2/21-11.1"],"bsi_grundschutz":["APP.3.1","CON.1"],"anssi":["Hygiene.24","RGS.2.3","SecNumCloud.11.1","SecNumCloud.14.2"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.C(63)","IV.D(78)","IV.D(81)"],"gdpr":["Art.5(1)(f)","Art.32(1)(a)","Rec.83"],"dora":["Art.9(3)","Art.9(4)(a)"],"bio2":["5.14","8.20","8.21"],"rbi_csf":["Annex1.4","Annex1.10","ITGRCA.16"],"fisc":["FISC.T4","FISC.T8","FISC.T10","FISC.T11","FISC.T12"],"lgpd_bcb":["BCB.Art.3","BCB.Art.14","BCB.OpenFinance","BCB.PIX","LGPD.Art.33-36","LGPD.Art.46"],"hkma_tme1":["TME1.8.5","TME1.9.1","TME1.10.1","TME1.10.2","TME1.10.3","TME1.11.2"],"mlps_2":["8.1.2.2","8.1.4.7","8.1.4.8","8.4"],"dnb_good_practice":["DNB.12.3","DNB.18.4","DNB.18.5"],"cra":["CRA.I.2e","CRA.I.2f","CRA.II.7"],"swift_cscf":["SWIFT.2.1","SWIFT.2.4A","SWIFT.2.5A","SWIFT.2.6"],"cbb_tm":["TM-8","TM-9"],"cbuae":["CR-5","CR-8"],"nca_ecc":["2-4","2-5","2-8"],"qatar_nia":["CS"],"sama_csf":["3.3","3.4","3.8","4.3"],"uae_ia":["T8"],"bog_cisd":["CISD-IX","CISD-VI","CISD-VIII","CISD-XI","CISD-XII","CISD-XIII"],"bom_ctrm":["3.2","3.4","3.10","3.13"],"cbe_csf":["CTO-2","CTO-3","CTO-5","CTO-6","CTO-8"],"cbn_csf":["Part3.3","Part3.4","Part5.2"],"popia":["s19"],"sa_js2":["JS2-7.2","JS2-8.2","JS2-8.3"],"bcbs_239":["Principle 3","Principle 11"],"bot_cyber":["Ch2.3","Ch2.4","Ch2.7","Ch9.1"],"cpmi_pfmi":["CG.PR","PFMI.P17","PFMI.P22"],"eba_ict":["3.8(b)"],"ecb_croe":["CROE.2.3.3","CROE.2.3.5"],"ffiec_is":["II.C.6","II.C.9","II.C.13","II.C.13(b)","II.C.15(c)","II.C.16","II.C.19"],"hipaa_sr":["§164.312(c)(1)","§164.312(c)(2)","§164.312(e)(1)","§164.312(e)(2)(i)","§164.312(e)(2)(ii)"],"iosco_cyber":["PROT-3","RR-3"],"nydfs_500":["500.15"],"sebi_cscrf":["EMAIL-SEC","PR.CS","PR.DS","PR.NS"],"cmmc_2":["SC"],"nerc_cip":["CIP-012-1"],"nrc_73_54":["RG5.71-A-SC"],"tsa_psd":[],"ieee_1686":["5.5"],"ferc_cip":["Order 2222"],"doe_c2m2":[],"api_1164":["Sec 8"],"awia":[],"iaea_nss":["Sec 5.6"],"pci_pts":["E","I","J"],"fips_140":[],"cbest":["CBEST.9"],"tiber_eu":["TIBER.CONF"],"pci_hsm":["3"],"common_criteria":["CC Part 2 — FCS","CC Part 2 — FDP","CC Part 2 — FPT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.30","§11.70","§11.300(d)"],"fda_cyber":["SA-2","SA-4"],"hitrust_csf":["01.b","09.e","09.f","10.c"],"iso_27799":["10.1","13.1","13.2","H.2","H.5"],"lloyds_ms":["BP2.1","BP2.2","MS6.1","MS8.9","MS13.2"],"naic_ds":["4-encryption","4B"],"nhs_dspt":["NDG-1.1","NDG-9.2","NDG-9.4","NDG-9.6"],"pra_ss1_23":[],"solvency_ii":["Art.49(3)","DR.266-DataSec","EIOPA-Cloud-GL9","EIOPA-ICT-4.6","EIOPA-ICT-4.7"],"owasp_masvs_v2":["MASVS-NETWORK-1","MASVS-NETWORK-2"],"csa_ccm_v4":["CEK-03","DSP-10","DSP-17","IPY-03","IVS-03"],"csa_aicm":["CEK-03","DSP-10","DSP-17","I&S-03","IPY-03"],"ccss_v9":["1.01.4","1.06.4"],"mica":["Art.76(1)","Art.97(1)"],"basel_sco60":["SCO60.71"],"bssc":["GSP-13","NOS-04","TIS-05"],"sec_custody_digital":[],"dpdpa":["Act.8(5)","Rules.6(1)(a)","Rules.Sch1.B.2","Rules.Sch1.B.7","Rules.Sch2"]},"attack_techniques":[{"id":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity protections such as TLS and IPsec encrypt network traffic in transit, preventing adversaries from capturing usable credentials or sensitive data through passive network sniffing on compromised network segments."},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Integrity protections on transmitted data—including TLS certificate validation and mutual authentication—enable detection of proxy interception attempts where adversaries insert themselves into the communication path to relay or modify C2 traffic."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Cryptographic integrity verification of transmitted data directly counters adversary-in-the-middle attacks by ensuring that any interception, modification, or replay of network traffic is detected through failed integrity checks or certificate validation errors."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity controls protect the communication channels used by security tools to report telemetry, ensuring adversaries cannot tamper with or suppress security alerts and log data as they traverse the network."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Protecting the integrity of management protocol transmissions prevents adversaries from intercepting or modifying configuration data in transit between network devices and management stations, ensuring collected configurations have not been tampered with."},{"id":"T1622","name":"Debugger Evasion","tactics":["defense-evasion","discovery"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity mechanisms protect the communication channels used by debugging and analysis tools, making it harder for adversaries to intercept and manipulate debug protocol traffic to evade analysis or inject misleading telemetry."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity controls detect unauthorized traffic duplication by validating data streams end-to-end, revealing discrepancies caused by network taps or port mirroring configurations that silently copy traffic to adversary-controlled destinations."},{"id":"T1090.004","name":"Domain Fronting","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"TLS integrity verification with proper certificate validation detects domain fronting attempts where the SNI header and HTTP Host header diverge, as transmission integrity mechanisms can enforce consistency between transport and application layer routing."},{"id":"T1550.001","name":"Application Access Token","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity protections such as TLS prevent adversaries from intercepting application access tokens in transit, ensuring that stolen tokens cannot be captured through network-level eavesdropping during API authentication exchanges."},{"id":"T1550.004","name":"Web Session Cookie","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Encrypting transmissions and enforcing integrity verification prevents adversaries from capturing web session cookies in transit, blocking a primary vector for session hijacking that enables lateral movement without re-authentication."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity controls on container API communications prevent adversaries from intercepting credentials exchanged between container orchestration components, ensuring that API tokens and service account credentials are not exposed during transit."},{"id":"T1557.001","name":"LLMNR/NBT-NS Poisoning and SMB Relay","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity mechanisms that enforce authenticated and encrypted connections prevent LLMNR/NBT-NS poisoning attacks by ensuring name resolution responses are validated and SMB relay attempts fail against cryptographically protected sessions."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity protections on network transmissions—including encrypted sessions and mutual authentication—render ARP cache poisoning ineffective for credential interception, as captured traffic remains encrypted and integrity-verified end-to-end."},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity controls ensure that DHCP spoofing attacks cannot successfully redirect traffic through adversary-controlled gateways for interception, as encrypted and integrity-verified sessions resist man-in-the-middle manipulation regardless of routing changes."},{"id":"T1557.004","name":"Evil Twin","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"End-to-end transmission integrity protections such as TLS with certificate pinning prevent evil twin wireless access points from successfully intercepting credentials or sensitive data, as integrity verification fails when traffic passes through the rogue AP."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Protecting the integrity of security telemetry transmissions prevents adversaries from blocking or modifying indicators in transit between sensors and SIEM platforms, ensuring that detection events reach security operations without suppression or alteration."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity controls ensure that security tool communications remain protected even during safe mode boot scenarios, preventing adversaries from exploiting reduced security postures to intercept or modify management traffic."},{"id":"T1562.010","name":"Downgrade Attack","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of transmitted data detects and prevents protocol downgrade attacks by enforcing minimum cryptographic standards, ensuring adversaries cannot force connections to weaker protocols that facilitate interception or manipulation."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Protecting SNMP transmission integrity through SNMPv3 authentication and encryption prevents adversaries from intercepting MIB data in transit and blocks injection of forged SNMP responses that could mislead network management systems."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Transmission integrity controls on management protocols ensure that network device configuration dumps cannot be intercepted or modified in transit, preventing adversaries from capturing sensitive configuration data including credentials and ACLs during legitimate management operations."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.5.10, A.5.33, A.8.26 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-005","SP-006","SP-007","SP-008","SP-011","SP-013","SP-015","SP-017","SP-022","SP-023","SP-028","SP-029","SP-030","SP-032","SP-033","SP-039","SP-040","SP-041","SP-042","SP-047","SP-050","SP-051","SP-052","SP-053","SP-054"]}}