NIST is a comprehensive information security standard that provides a catalog of security and privacy controls for information systems and organizations. While initially designed for federal agencies, NIST has become widely adopted in the private sector, especially for organizations handling sensitive data, and serves as a comprehensive standard for information security and privacy protection across various industries.
This article organizes Common Weakness Enumerations (CWEs) relevant to NIST.
Each row in the table below outlines a specific compliance standard, categorized by the following columns:
Compliance Standard: The specific category of the standard to which the CWE is mapped.
Languages: Supported programming languages.
CWE-ID: The relevant CWE for this standard, along with a short description.
NIST CWE Coverage
Compliance Standard
CWE-ID
SC-13: Cryptographic Protection
CWE-325: Missing Cryptographic Step
CWE-326: Inadequate Encryption Strength
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-328: Use of Weak Hash
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-347: Improper Verification of Cryptographic Signature
CWE-780: Use of RSA Algorithm without OAEP
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-1204: Generation of Weak Initialization Vector (IV)
.svg){kind=logo}