---

id: "SI-07(15)" title: "Code Authentication" family: "SI" family_name: "System and Information Integrity" sort_id: "si-07.15" priority: "P1" implementation_level: "system" parent: "SI-07" enhancement: True

---

Statement

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: {{ insert: param, si-07.15_odp }}.

Guidance

Cryptographic authentication includes verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.

Assessment Objective

cryptographic mechanisms are implemented to authenticate {{ insert: param, si-07.15_odp }} prior to installation.

System and information integrity policy

system and information integrity procedures

procedures addressing software, firmware, and information integrity

system design documentation

system configuration settings and associated documentation

cryptographic mechanisms and associated documentation

system audit records

system security plan

other relevant documents or records

Organizational personnel responsible for software, firmware, and/or information integrity

organizational personnel with information security responsibilities

system/network administrators

system developer

Cryptographic mechanisms authenticating software and firmware prior to installation