The UEM Agent must not install policies if the policy-signing certificate is deemed invalid.

It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy.

Satisfies: FMT_POL_EXT.2.2

Verify the UEM Agent does not install policies if the policy-signing certificate is deemed invalid.

If the UEM Agent installs policies when the policy-signing certificate is deemed invalid, this is a finding.

Configure the UEM Agent to not install policies if the policy-signing certificate is deemed invalid.