{"data":{"id":"CM-14","name":"Signed Components","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.","supplemental_guidance":"Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.","enhancements":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"CM-14","name":"Signed Components","description":"Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.","discussion":"Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.","related_controls":["CM-07","SC-12","SC-13","SI-07"],"baseline_low":null,"baseline_moderate":null,"baseline_high":null,"baseline_privacy":null,"new_in_rev5":true,"changes_from_rev4":"New control in Rev 5."}},"compliance_mappings":{"iso_27001_2022":["A.8.9","A.8.19"],"iso_27002_2022":["8.9","8.19"],"cobit_2019":["BAI06","BAI10","DSS05"],"pci_dss_v4":["6.2","11.5","11.6"],"nist_csf_2":["PR.PS-05"],"cis_controls_v8":["CIS 2","CIS 2.6"],"soc2_tsc":[],"finos_ccc":["CCC-C07"],"iso_42001_2023":["A.7.5"],"iec_62443":["3-3 SR 3.1","3-3 SR 3.4"],"asd_e8":["E8-1","E8-1 ML3","E8-3 ML3"],"nis2":["Art. 21(2)(e)"],"apra_cps_234":[],"mas_trm":["6"],"pra_op_resilience":[],"bsi_grundschutz":["NET.3.1","OPS.1.1.3","SYS.1.1"],"anssi":["Hygiene.18","Hygiene.20","Hygiene.33","Hygiene.34","SecNumCloud.13.1","SecNumCloud.13.2","SecNumCloud.15.4"],"osfi_b13":["B-13.2.2","B-13.2.3"],"finma_circular":["IV.A(36)","IV.A(37)","IV.A(39)","IV.C(64)","V(109)","V(110)"],"gdpr":[],"dora":["Art.9(4)(e)"],"bio2":["8.9","8.19"],"rbi_csf":["Annex1.2","Annex1.6"],"fisc":["FISC.O3","FISC.T6"],"lgpd_bcb":[],"hkma_tme1":["TME1.3.2","TME1.4.1","TME1.4.3"],"mlps_2":[],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"cbb_tm":["TM-7"],"cbuae":["CR-6"],"nca_ecc":["2-3"],"qatar_nia":["OS","SD"],"sama_csf":["3.2","3.5"],"uae_ia":["T7","T10"],"bog_cisd":["CISD-SDLC"],"bom_ctrm":["3.6","3.11"],"cbe_csf":["CTO-4"],"sa_js2":["JS2-SA"],"bot_cyber":["Ch2.1"],"eba_ict":["3.6.3"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.C.17"],"iosco_cyber":["PROT-6"],"sebi_cscrf":["PR.ES","PR.IP"],"cmmc_2":["CM"],"nerc_cip":["CIP-013-2"],"nrc_73_54":["RG5.71-A-SI","RG5.71-C-SR"],"tsa_psd":[],"ieee_1686":["5.3"],"ferc_cip":["Order 829"],"doe_c2m2":[],"api_1164":["Sec 7"],"awia":[],"iaea_nss":["Sec 5.4"],"pci_pts":["B","F"],"fips_140":["FIPS 140-3 §7.5"],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FCS","CC Part 2 — FPT"],"isae_3402":[],"fca_sysc_13":["SYSC 13.7.4"],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":["MS8.4"],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.8","EIOPA-ICT-4.11"],"owasp_masvs_v2":["MASVS-RESILIENCE-1","MASVS-RESILIENCE-2"],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":["NOS-02"],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-028","SP-040","SP-041","SP-050"]}}