# CM-14 — Signed Components

- **Control ID:** CM-14
- **Family:** [CM](/md/families/CM.md)
- **Baselines:** No content available.
- **Enhancement of:** No content available.

## Description

Prevent the installation of \[assignment\] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

## Discussion

Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

No content available.

## Related controls

- [CM-7](/md/controls/CM-7.md)
- [SC-12](/md/controls/SC-12.md)
- [SC-13](/md/controls/SC-13.md)
- [SI-7](/md/controls/SI-7.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.