CM-14 Signed Components
Guidance: nonePolicy clause: noneWhat these mean
cm14ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Not in a baseline | Organization | None |
Related controls: CM-7, SC-12, SC-13, SI-7
Control statement
Section titled “Control statement”Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
NIST discussion
Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for CM-14
Determine if:
- CM-14[01] the installation of [Assignment: organization-defined software components] is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization;
- CM-14[02] the installation of [Assignment: organization-defined firmware components] is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.
Examine: Configuration management policy; procedures addressing digitally signed certificates for software and firmware components; configuration management plan; system security plan; system design documentation; change control records; system component inventory; system security plan; other relevant documents or records.
Interview: Organizational personnel with responsibilities for verifying digitally signed certificates for software and firmware component installation; organizational personnel with information security responsibilities; system/network administrators; system developers.
Test: Organizational processes governing information location; mechanisms enforcing policies and methods for governing information location; automated tools supporting or implementing digitally signatures for software and firmware components; automated tools supporting or implementing verification of digital signatures for software and firmware component installation.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.