CM-14 Signed Components
All changes in this version
Title
Signed Components
Control
Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Discussion
Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.
Parameters
cm-14_prm_1: organization-defined software and firmware components
cm-14_odp.01: software components
cm-14_odp.02: firmware components
Related controls
cm-7, sc-12, sc-13, si-7
STIG rules that implement this control 19
Apple macOS 15 (Sequoia) V1R8
- APPL-15-002060 CAT I The macOS system must apply gatekeeper settings to block applications from unidentified developers.
- APPL-15-002064 CAT I The macOS system must enable gatekeeper.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-002060 CAT I The macOS system must apply gatekeeper settings to block applications from unidentified developers.
- APPL-26-002064 CAT I The macOS system must enable gatekeeper.
Application Security and Development V6R5
- APSC-DV-001430 CAT II The application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-214010 CAT III Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) prevents the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-300001 CAT III Ubuntu 24.04 LTS Advance Package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-001020 CAT II RHEL 10 must ensure cryptographic verification of vendor software packages.
- RHEL-10-001030 CAT I RHEL 10 must check the GNU Privacy Guard (GPG) signature of software packages originating from external software repositories before installation.
- RHEL-10-001040 CAT I RHEL 10 must check the GNU Privacy Guard (GPG) signature of locally installed software packages before installation.
- RHEL-10-001050 CAT I RHEL 10 must have GNU Privacy Guard (GPG) signature verification enabled for all software repositories.
- RHEL-10-200500 CAT II RHEL 10 must have the "subscription-manager" package installed.
- RHEL-10-701050 CAT I RHEL 10 must prevent the loading of a new kernel for later execution.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-213020 CAT II RHEL 9 must prevent the loading of a new kernel for later execution.
- RHEL-09-214010 CAT II RHEL 9 must ensure cryptographic verification of vendor software packages.
- RHEL-09-214015 CAT I RHEL 9 must check the GPG signature of software packages originating from external software repositories before installation.
- RHEL-09-214020 CAT I RHEL 9 must check the GPG signature of locally installed software packages before installation.
- RHEL-09-214025 CAT I RHEL 9 must have GPG signature verification enabled for all software repositories.
- RHEL-09-215010 CAT II RHEL 9 subscription-manager package must be installed.