Detections
Analytics
800-53|CM-5(3)
Title
SIGNED COMPONENTSDescription
The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.Supplemental
Software and firmware components prevented from installation unless signed with recognized and approved certificates include, for example, software and firmware version updates, patches, service packs, device drivers, and basic input output system (BIOS) updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures, is a method of code authentication.Reference Item Details
Reference: NIST 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations
Related: CM-7,SC-13,SI-7
Category: CONFIGURATION MANAGEMENT
Parent Title: ACCESS RESTRICTIONS FOR CHANGE
Family: CONFIGURATION MANAGEMENT
Baseline Impact: HIGH
Audit Items
View all Reference Audit Items