Assessment Objective
Determine if:
- CM-14[01] the installation of [Assignment: software components] is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization;
- CM-14[02] the installation of [Assignment: firmware components] is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing digitally signed certificates for software and firmware components
- configuration management plan
- system security plan
- system design documentation
- change control records
- system component inventory
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for verifying digitally signed certificates for software and firmware component installation
- organizational personnel with information security responsibilities
- system/network administrators
- system developers
Test
- Organizational processes governing information location
- mechanisms enforcing policies and methods for governing information location
- automated tools supporting or implementing digitally signatures for software and firmware components
- automated tools supporting or implementing verification of digital signatures for software and firmware component installation
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | CM-14 Signed Components |