diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7edbf50a9..1d7b85b12 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,8 @@ spdk_app_start() now only accepts a single context argument.
 Added asynchronous probe support.  New APIs spdk_nvme_probe_async() and
 spdk_nvme_probe_poll_async() were added to enable this feature.
 
+New API spdk_nvme_ctrlr_get_flags() was added.
+
 ### raid
 
 Added new strip_size_kb rpc param on create to replace the more ambiguous
diff --git a/include/spdk/nvme.h b/include/spdk/nvme.h
index 770710241..e7de9a05d 100644
--- a/include/spdk/nvme.h
+++ b/include/spdk/nvme.h
@@ -308,6 +308,16 @@ struct spdk_nvme_host_id {
 	char hostsvcid[SPDK_NVMF_TRSVCID_MAX_LEN + 1];
 };
 
+/*
+ * Controller support flags
+ *
+ * Used for identifying if the controller supports these flags.
+ */
+enum spdk_nvme_ctrlr_flags {
+	SPDK_NVME_CTRLR_SGL_SUPPORTED			= 0x1, /**< The SGL is supported */
+	SPDK_NVME_CTRLR_SECURITY_SEND_RECV_SUPPORTED	= 0x2, /**< security send/receive is supported */
+};
+
 /**
  * Parse the string representation of a transport ID.
  *
@@ -1309,6 +1319,15 @@ int spdk_nvme_ctrlr_security_receive(struct spdk_nvme_ctrlr *ctrlr, uint8_t secp
 int spdk_nvme_ctrlr_security_send(struct spdk_nvme_ctrlr *ctrlr, uint8_t secp,
 				  uint16_t spsp, uint8_t nssf, void *payload, size_t size);
 
+/**
+ * Get supported flags of the controller.
+ *
+ * \param ctrlr NVMe controller to get flags.
+ *
+ * \return supported flags of this controller.
+ */
+uint64_t spdk_nvme_ctrlr_get_flags(struct spdk_nvme_ctrlr *ctrlr);
+
 /**
  * Attach the specified namespace to controllers.
  *
diff --git a/lib/nvme/nvme_ctrlr.c b/lib/nvme/nvme_ctrlr.c
index 13ed34f61..f289766cc 100644
--- a/lib/nvme/nvme_ctrlr.c
+++ b/lib/nvme/nvme_ctrlr.c
@@ -908,6 +908,10 @@ nvme_ctrlr_identify_done(void *arg, const struct spdk_nvme_cpl *cpl)
 		ctrlr->max_sges = nvme_transport_ctrlr_get_max_sges(ctrlr);
 	}
 
+	if (ctrlr->cdata.oacs.security) {
+		ctrlr->flags |= SPDK_NVME_CTRLR_SECURITY_SEND_RECV_SUPPORTED;
+	}
+
 	nvme_ctrlr_set_state(ctrlr, NVME_CTRLR_STATE_SET_NUM_QUEUES,
 			     ctrlr->opts.admin_timeout_ms);
 }
@@ -2812,3 +2816,9 @@ spdk_nvme_ctrlr_security_send(struct spdk_nvme_ctrlr *ctrlr, uint8_t secp,
 
 	return 0;
 }
+
+uint64_t
+spdk_nvme_ctrlr_get_flags(struct spdk_nvme_ctrlr *ctrlr)
+{
+	return ctrlr->flags;
+}
diff --git a/lib/nvme/nvme_internal.h b/lib/nvme/nvme_internal.h
index ec9f8162f..1e01f5a21 100644
--- a/lib/nvme/nvme_internal.h
+++ b/lib/nvme/nvme_internal.h
@@ -160,13 +160,6 @@ enum nvme_payload_type {
 	NVME_PAYLOAD_TYPE_SGL,
 };
 
-/*
- * Controller support flags.
- */
-enum spdk_nvme_ctrlr_flags {
-	SPDK_NVME_CTRLR_SGL_SUPPORTED		= 0x1, /**< The SGL is supported */
-};
-
 /**
  * Descriptor for a request data payload.
  */