| Compliance |
The following 4 compliance controls are associated with this Policy definition 'Restrict unauthorized software and firmware installation' (4ee5975d-2507-5530-a20a-83a725889c6f)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
CM-5(3) |
FedRAMP_High_R4_CM-5(3) |
FedRAMP High CM-5 (3) |
Configuration Management |
Signed Components |
Shared |
n/a |
The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Supplemental Guidance: Software and firmware components prevented from installation unless signed with recognized and approved certificates include, for example, software and firmware version updates, patches, service packs, device drivers, and basic input output system (BIOS) updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures, is a method of code authentication. Related controls: CM-7, SC-13, SI-7. |
link |
1 |
| FedRAMP_Moderate_R4 |
CM-5(3) |
FedRAMP_Moderate_R4_CM-5(3) |
FedRAMP Moderate CM-5 (3) |
Configuration Management |
Signed Components |
Shared |
n/a |
The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Supplemental Guidance: Software and firmware components prevented from installation unless signed with recognized and approved certificates include, for example, software and firmware version updates, patches, service packs, device drivers, and basic input output system (BIOS) updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures, is a method of code authentication. Related controls: CM-7, SC-13, SI-7. |
link |
1 |
| NIST_SP_800-171_R2_3 |
.4.5 |
NIST_SP_800-171_R2_3.4.5 |
NIST SP 800-171 R2 3.4.5 |
Configuration Management |
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Any changes to the hardware, software, or firmware components of systems can potentially have significant effects on the overall security of the systems. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes, including upgrades and modifications. Access restrictions for change also include software libraries. Access restrictions include physical and logical access control requirements, workflow automation, media libraries, abstract layers (e.g., changes implemented into external interfaces rather than directly into systems), and change windows (e.g., changes occur only during certain specified times). In addition to security concerns, commonly-accepted due diligence for configuration management includes access restrictions as an essential part in ensuring the ability to effectively manage the configuration. [SP 800-128] provides guidance on configuration change control. |
link |
6 |
| NIST_SP_800-53_R4 |
CM-5(3) |
NIST_SP_800-53_R4_CM-5(3) |
NIST SP 800-53 Rev. 4 CM-5 (3) |
Configuration Management |
Signed Components |
Shared |
n/a |
The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Supplemental Guidance: Software and firmware components prevented from installation unless signed with recognized and approved certificates include, for example, software and firmware version updates, patches, service packs, device drivers, and basic input output system (BIOS) updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures, is a method of code authentication. Related controls: CM-7, SC-13, SI-7. |
link |
1 |
|