ASD ISM 0677 Ensure file integrity through signature validation
What it says
Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFiles with digital signatures or checksums must be verified at system boundaries to ensure integrity.
This control ensures that when files are transferred in or out of your organisation, they're checked for authenticity using digital signatures or checksums. This matters because if files are tampered with during transfer, it could lead to data corruption, security breaches, or even legal issues if sensitive information is involved.
Free. Save your status, tasks and notes.
Why it matters
If signatures or checksums aren't validated at gateways/CDSs, tampered or malicious files can pass unnoticed, leading to compromise or data leakage.
How to implement
The IT team should establish a process for verifying digital signatures and checksums on all files crossing system boundaries.
They can do this by installing and configuring software that automatically checks these signatures whenever a file is imported or exported.
System owners should ensure staff are trained to recognise and report any files that fail signature checks.
Regular training sessions with practical examples can help staff quickly identify and escalate these issues to the IT team.
Managers should set up regular reviews of the file integrity checking process to ensure it remains effective.
Hold monthly meetings to discuss any failed checks and improvements needed in the verification process.
Procurement teams must ensure that any new gateway or file transfer solution supports digital signature and checksum verification.
They should specify this requirement during the purchasing process by consulting with vendors and verifying product capabilities.
HR should ensure clear communication of policies regarding file integrity to all employees.
This can be done by incorporating information about digital signatures and checksums into the onboarding process and presenting it in an accessible format like an easy-to-read guide or a quick reference card.
Keep it running
At each gateway/CDS, automatically verify digital signatures or cryptographic checksums on import/export and alert/quarantine files that fail validation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Records of file integrity checks conducted in the last six months.
Look at
The frequency and outcomes of these checks.
Good evidence
Record will show regular checks with documented results, including any incidents of failed checks and corrective actions taken.
- Check 2 of 5What an auditor asks for
Look at
How the software responds to both valid and tampered files.
Good evidence
Demonstration will show the software accurately identifying and flagging files that do not pass the checks.
- Check 3 of 5What an auditor asks for
Ask for
The training materials used for staff education on file integrity verification.
Look at
The content for clarity on recognising signature failed alerts. Good materials will be easy to understand and provide clear steps for reporting issues.
- Check 4 of 5What an auditor asks for
Look at
What issues were discussed and what corrective actions were planned. Good reports indicate active monitoring and improvements to the process.
- Check 5 of 5What an auditor asks for
Ask for
Procurement documents for recent file transfer systems purchases.
Look at
Specifications requiring digital signature or checksum verification capabilities.
Good evidence
Procurement record will clearly show that verification capabilities were considered essential.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-0677 requires that files crossing system boundaries via gateways or CDSs have their digital signatures or cryptographic checksums validated to assure integrity. Annex A 5.14 requires organisations to define and implement rules and procedures for information transfer, within which signature/checksum validation is a concrete integrity control for file transfers. Annex A 5.14 is broader (policy/procedural coverage across transfer methods), while ISM-0677 is a specific technical validation requirement at transfer boundaries.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.