SI-7(15)

Requirement

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].

Discussion

Cryptographic authentication includes verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for software, firmware, and/or information integrity; organizational personnel with information security responsibilities; system/network administrators; system developer].

Test

[SELECT FROM: Cryptographic mechanisms authenticating software and firmware prior to installation].

ID	Assessment Objectives
SI-07(15)	cryptographic mechanisms are implemented to authenticate <SI-07(15)_ODP software or firmware components> prior to installation.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!