CM-14

Configuration ManagementRev 5organization

Signed Components

Control Statement

Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Supplemental Guidance

Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.

Related Controls (4)

CM-7 SC-12 SC-13 SI-7

CCI Identifiers (2)

CCI-003992Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.CCI-003993Defines the software and firmware for preventing installation without verification that the component has been digitally signed.

Linked STIG Checks (103)

Across 51 STIGs. Click to expand.