ComplianceNIST 800-53 control
NIST-CM-14 Signed Components
- Framework
- NIST SP 800-53 rev5 (5.2.0)
- Family
- CM Configuration Management
- Control
- CM-14
Control statement
Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Discussion
Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.
Related
Related control · Compliance (4)
- NIST-CM-7 Least Functionality NIST 800-53 control
- NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
- NIST-SC-13 Cryptographic Protection NIST 800-53 control
- NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
Referenced by Compliance · has member (1)
- NIST-CM Configuration Management NIST 800-53 family