CM-14 says prevent the installation of the components you define unless they are verified as digitally signed with a certificate the organization recognizes and approves.
800-53 binds US federal systems and others by contract. For everyone else it is a reference, and software supply chain questions in customer reviews often point at it.
What it means in practice
The guidance lists what can fall under the control. Software and firmware updates, patches, service packs, device drivers and BIOS updates. You choose which types or specific items apply. The method is code authentication, meaning a signature plus your own verification of it.
Two parts matter. The certificate must be one you approve, and the install must actually be blocked when verification fails.
Evidence to collect
- The list of component types in scope.
- The list of approved signing certificates or publishers.
- Configuration showing enforcement, such as operating system signing policy or package manager signature checks.
- A test record showing an unsigned component was rejected.
Common gaps
- Signature checks are off in a package manager or CI step.
- The approved certificate list has never been reviewed.
- Firmware and driver updates are out of scope by accident.
How to implement it
Turn on signature verification in the tools you already use. Pin approved publishers. Test with an unsigned package once a quarter and keep the result.
Quick check
Is checking that a signature exists enough?
No. The certificate must be recognized and approved by your organization, and installation must be prevented when verification fails.
