If you search the NIST 800-53 catalog for SC-9, Transmission Confidentiality, you will find an entry with no statement and no guidance. That is because the control was withdrawn. Its requirement was folded into SC-8, Transmission Confidentiality and Integrity.
800-53 binds US federal systems, and contractors through their agreements. For everyone else it is a reference catalog. If a questionnaire or an old policy still cites SC-9, treat it as a pointer to SC-8.
What it means in practice
Nothing separate is expected under SC-9. The expectation that data in transit is protected from disclosure now lives in SC-8, together with integrity. If you protect traffic with current TLS, VPN or SSH, and you can show it, you are covering what SC-9 used to ask.
Evidence to collect
Collect the SC-8 evidence: a list of external and internal connections, the protocol and minimum version each one allows, and a scan or config export that proves it. Our SC-8 guide covers this in detail.
Common gaps
- A policy that still lists SC-9 as a separate control with no owner.
- A control matrix with SC-9 marked "implemented" and no evidence attached, because nobody noticed it is withdrawn.
How to implement it
Update your control matrix. Mark SC-9 as withdrawn and incorporated into SC-8, and attach the transmission evidence to SC-8. If a customer's template still asks about SC-9, answer it with your SC-8 evidence and note the withdrawal.
Quick check
Where did SC-9 go?
It was withdrawn in Rev 5 and incorporated into SC-8, Transmission Confidentiality and Integrity.
