ASD ISM 1764 Use NIST P-384 curve for ECDSA signatures
What it says
When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse the NIST P-384 or P-521 curves, preferably P-384, for secure digital signatures.
This control is about using a specific type of digital signature to keep online communications safe. It suggests using a secure mathematical curve, known as NIST P-384, when creating digital signatures. If we don't follow this advice, our sensitive messages or transactions could be tampered with or forged, leading to potential security breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without NIST P-384/P-521 for ECDSA, weaker curve choices can reduce signature strength, increasing forgery risk and undermining integrity.
How to implement
System administrators should verify that current digital signature protocols use the NIST P-384 curve.
To do this, check the configuration files on servers and update any older protocols to include the NIST P-384 option if they don't already.
The IT security team should ensure that all new software acquisitions that require digital signatures support the NIST P-384 curve.
When evaluating software, request detailed security documentation to confirm this support before making a purchase.
IT managers should conduct regular training sessions for IT staff to discuss the importance of using approved cryptographic algorithms, like NIST P-384, and demonstrate how to configure systems accordingly.
Include practical examples and dedicate time for questions.
The organisation's policy writers should update internal security policies to mandate the use of the NIST P-384 curve for digital signatures.
Clearly outline this requirement in the corporate IT security manual and circulate it across relevant teams.
IT support teams should develop a checklist for system audits that includes a step to verify the use of the NIST P-384 curve in digital signature setups.
Include this check in regular maintenance schedules to ensure compliance.
Keep it running
Enforce ECDSA curve policy to use NIST P-384 (preferred) or P-521; audit TLS/cert profiles and app crypto libs to block other curves after upgrades.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The digital signature configuration report: Request a report that lists the cryptographic settings used for digital signatures across organisational systems.
Look at
Whether the NIST P-384 curve is listed.
Good evidence
Shows systems configured with NIST P-384 for digital signatures.
- Check 2 of 5What an auditor asks for
Ask for
To see recent purchase orders for cryptographic software: Request documentation of recent software acquisitions that deal with digital signatures.
Look at
Clauses specifying support for NIST P-384.
Good evidence
Includes contracts or purchase orders with NIST P-384 support clearly mentioned.
- Check 3 of 5What an auditor asks for
Ask for
IT training records: Request attendance logs and training materials from recent IT staff training sessions about cryptographic protocols.
Look at
Whether NIST P-384 was covered in the materials.
Good evidence
Includes detailed materials and training logs showing staff participation.
- Check 4 of 5What an auditor asks for
Ask for
Organisational security policy documents: Request to see the latest IT security policy manual.
Look at
Sections discussing digital signature protocols and confirm NIST P-384 is specified.
Good evidence
Includes explicit instructions in the policy document mandating the use of NIST P-384.
- Check 5 of 5What an auditor asks for
Ask for
To observe an internal audit checklist process: Request to sit in on a routine IT audit.
Look at
The checklist used and see if NIST P-384 compliance is part of the routine checks.
Good evidence
Includes a checklist with a dedicated item for verifying the use of NIST P-384.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1764 requires that when ECDSA is used for digital signatures, organisations use strong approved elliptic curves (preferably NIST P-384, or P-521). Annex A 8.24 requires organisations to define and implement rules for the effective use of cryptography and cryptographic key management, under which algorithm and parameter choices (such as approved ECDSA curves) would be specified. ISM-1764 is a specific technical requirement about ECDSA curve selection, while Annex A 8.24 is broader and covers governance and management of cryptography and keys more generally.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.