{"data":{"id":"SC-23","name":"Session Authenticity","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"Protect the authenticity of communications sessions.","supplemental_guidance":"Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against \"man-in-the-middle\" attacks, session hijacking, and the insertion of false information into sessions.","enhancements":[{"id":"SC-23(01)","name":"Invalidate Session Identifiers at Logout","statement":"Invalidate session identifiers upon user logout or other session termination.","baselines":[]},{"id":"SC-23(02)","name":"User-initiated Logouts and Message Displays","withdrawn":true,"incorporated_into":["AC-12(01)"]},{"id":"SC-23(03)","name":"Unique System-generated Session Identifiers","statement":"Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.","baselines":[]},{"id":"SC-23(04)","name":"Unique Session Identifiers with Randomization","withdrawn":true,"incorporated_into":["SC-23(03)"]},{"id":"SC-23(05)","name":"Allowed Certificate Authorities","statement":"Only allow the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SC-23","name":"Session Authenticity","description":"Protect the authenticity of communications sessions.","discussion":"Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against \"man-in-the-middle\" attacks, session hijacking, and the insertion of false information into sessions.","related_controls":["AU-10","SC-08","SC-10","SC-11"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["PR.AA-04"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":["CCC-C01"],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":["14"],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.12","Hygiene.24","SecNumCloud.10.5"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.C(63)"],"gdpr":["Art.32(1)(a)","Art.32(1)(b)"],"dora":["Art.9(3)"],"bio2":[],"rbi_csf":["Annex1.9"],"fisc":["FISC.T8","FISC.T12"],"lgpd_bcb":["BCB.OpenFinance","BCB.PIX"],"hkma_tme1":["TME1.8.4","TME1.10.1"],"mlps_2":[],"dnb_good_practice":["DNB.18.4"],"cra":[],"swift_cscf":[],"cbb_tm":["TM-8"],"nca_ecc":["2-5"],"qatar_nia":["CS"],"sama_csf":["3.8"],"uae_ia":["T8"],"bog_cisd":["CISD-IX"],"bom_ctrm":["3.13"],"cbe_csf":["CTO-5"],"cbn_csf":["Part5.2"],"bot_cyber":["Ch2.4","Ch8.2","Ch9.1"],"cpmi_pfmi":["PFMI.P22"],"eba_ict":["3.8(b)"],"ffiec_is":["II.C.6","II.C.9","II.C.13(b)","II.C.16"],"hipaa_sr":["§164.312(e)(1)"],"nydfs_500":["500.12"],"cmmc_2":["SC"],"nerc_cip":["CIP-012-2"],"nrc_73_54":["RG5.71-A-SC"],"tsa_psd":[],"ieee_1686":["5.5","5.8"],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":["Sec 5.6"],"pci_pts":["E"],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":["3"],"common_criteria":["CC Part 2 — FRU/FTA/FTP"],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":["§11.30","§11.300(d)"],"fda_cyber":["SA-2"],"hitrust_csf":["01.b"],"iso_27799":["9.5","H.5"],"lloyds_ms":["BP2.1"],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":["MASVS-AUTH-1","MASVS-AUTH-3","MASVS-NETWORK-1","MASVS-NETWORK-2"],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":["GSP-13"],"sec_custody_digital":["SEC-CD-03"],"dpdpa":[],"nist_ai_rmf_1":[],"eu_ai_act":[]},"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-005","SP-016","SP-023","SP-029","SP-030","SP-032","SP-033","SP-039","SP-040","SP-046","SP-048","SP-050"],"attack":{"techniques":20,"route":"/api/v1/controls/SC-23?fields=attack"}}}