ASD ISM 1374 Use SHA-2 certificates for secure TLS connections
What it says
SHA-2-based certificates are used for TLS connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse secure certificates to prevent eavesdropping on data sent over the internet.
When you use the internet to send or receive information, there's always a risk someone could be snooping on that data. Using SHA-2 certificates for your website's secure connections helps keep your information safe from prying eyes, like encrypting your messages so only the intended recipient can read them.
Free. Save your status, tasks and notes.
Why it matters
Without SHA-2 TLS certificates, attackers can exploit weak/legacy hashes to impersonate services or intercept traffic, increasing risk of data breach and loss of trust.
How to implement
IT Manager: Ensure your website and servers are using SHA-2 certificates.
Check with your web hosting provider or certificate authority to upgrade from older certificates to SHA-2 if necessary. This ensures your online communications are properly encrypted.
Procurement Officer: Purchase SSL/TLS certificates that use SHA-2 encryption.
When buying a new certificate, confirm with the supplier that it supports this standard to avoid insecure connections.
IT Team: Regularly update the server's certificate settings.
Set a reminder to review your certificates every year and ensure they're using SHA-2. This keeps your server's communications secure.
System Administrator: Test your system to ensure SHA-2 certificates are active.
Use online tools or software to scan your website's certificates and confirm they are SHA-2 compliant, fixing any errors found.
Business Owner: Educate staff on the importance of secure connections.
Hold a simple training session to explain how using SHA-2 helps protect the business and customer data when online.
Keep it running
Regularly verify TLS certificates use SHA-2 (e.g., SHA-256/SHA-384) and replace any SHA-1-signed certificates; enforce this via scanner checks and CA policy.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current SSL/TLS certificates: Request copies of the active certificates used by your organisation's servers.
Look at
The certificate details that specify SHA-2 encryption.
Good evidence
All certificates show SHA-2 as their hashing algorithm.
- Check 2 of 5What an auditor asks for
Ask for
A server configuration report: Request a report showing the server settings for encryption protocols.
Look at
The list of supported encryption methods.
Good evidence
The report confirms only SHA-2 certificates are accepted for secure connections.
- Check 3 of 5What an auditor asks for
Ask for
Supplier verification documents: Request documentation from the certificate authority confirming the issue of SHA-2 certificates.
Look at
The certificates' details to ensure they match your company and are recent.
Good evidence
Documents show your organisation's name and SHA-2 compliance.
- Check 4 of 5What an auditor asks for
Ask for
An IT maintenance log: Request the log showing the last audit or review of certificate configurations.
Look at
Records indicating regular checks of TLS settings.
Good evidence
Log entries confirm regular checks and upgrades to SHA-2 when necessary.
- Check 5 of 5What an auditor asks for
Ask for
A staff training record: Request evidence of recent training sessions on secure connections.
Look at
Attendance lists and training materials.
Good evidence
Records verify that training included information on SHA-2 and its security benefits.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1374 requires that SHA-2-based certificates are used for TLS connections to protect data in transit from eavesdropping. ISO/IEC 27001:2022 Annex A 8.24 requires the organisation to define and implement rules for cryptography and cryptographic key management, which includes selecting approved algorithms and managing certificate/key lifecycles. ISM-1374 is a specific, prescriptive cryptographic requirement (SHA-2 for TLS certificates) within the broader cryptography governance and key management expectations of Annex A 8.24.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.