CVE-2026-57910

Requires assessing authenticity and integrity of acquired assets, which commonly relies on signature verification but is limited to pre-acquisition.

Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.

Digital signatures are explicitly cited to protect integrity of data-at-rest, so proper verification directly mitigates the weakness.

Digital signatures are explicitly cited to protect integrity of data-in-transit, so proper verification directly mitigates the weakness.

Mandating integrity checks, digital signatures, and origin tracing for ICT components directly reduces the chance that code or firmware lacking an integrity check will be accepted into the organisation’s environment.

Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.

Mandating authentication for network services and critical functions stops attackers from invoking sensitive operations without credentials, closing gaps where authentication is absent for important capabilities.

Establishing approved cryptographic solutions and usage practices lowers the probability that signature-verification steps will be omitted or incorrectly implemented.

Security engineering principles insist on authentication and authorization for every critical function, eliminating entry points that lack any access control mechanism.

The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.