CCI-001748

The organization defines critical firmware components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.

Implementation Guidance

DoD has defined the critical firmware components as any firmware components when the vendor provides digitally signed products.

Validation Procedures

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the critical firmware components as any firmware components when the vendor provides digitally signed products.

Compelling Evidence

Automatically Compliant

The controls below (if any) were marked by NIST as being related to CCI-001748.