id: "CM-14" title: "Signed Components" family: "CM" family_name: "Configuration Management" sort_id: "cm-14" priority: "P1" implementation_level: "system"
Statement
Prevent the installation of {{ insert: param, cm-14_prm_1 }} without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Guidance
Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.
Assessment Objective: the installation of {{ insert: param, cm-14_odp.01 }} is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization;
Assessment Objective: the installation of {{ insert: param, cm-14_odp.02 }} is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.
Configuration management policy
procedures addressing digitally signed certificates for software and firmware components
configuration management plan
system security plan
system design documentation
change control records
system component inventory
system security plan
other relevant documents or records
Organizational personnel with responsibilities for verifying digitally signed certificates for software and firmware component installation
organizational personnel with information security responsibilities
system/network administrators
system developers
Organizational processes governing information location
mechanisms enforcing policies and methods for governing information location
automated tools supporting or implementing digitally signatures for software and firmware components
automated tools supporting or implementing verification of digital signatures for software and firmware component installation