ASD ISM 1766 Ensure secure hashing with SHA-2 algorithm
What it says
When using SHA-2 for hashing, an output size of at least 224 bits is used, preferably SHA-384 or SHA-512.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse at least 224-bit SHA-2 hash, with SHA-384 or SHA-512 being preferred, to ensure strong security.
This control is about ensuring that when you use digital fingerprints (hashes) for storing or verifying data, you use a strong method called SHA-2 with output of at least 224 bits, but ideally 384 or 512 bits. This matters because weaker methods can be cracked by hackers, meaning your information could be tampered with or stolen without you knowing.
Free. Save your status, tasks and notes.
Why it matters
Using hashes weaker than SHA-2 (>=224-bit) can enable collision attacks, undermining data integrity and trust in files and signatures.
How to implement
IT Team: Ensure the software your organisation uses for hashing includes SHA-2 with at least 224-bit output capability.
This could involve checking the settings or configurations of any application that handles passwords or sensitive data to verify it uses SHA-2.
Procurement Officer: When purchasing new software, verify that it supports SHA-2 hashing methods, preferably with 384 or 512-bit output.
Include this requirement in the checklist during the procurement process.
System Administrator: Regularly update systems to ensure they maintain compatibility with the latest secure hashing standards, including SHA-2.
This can be done by scheduling regular software updates and patches.
Security Officer: Document and monitor how SHA-2 hashing is implemented within your various data systems to ensure compliance.
This could include maintaining records of the configurations and regularly reviewing them.
Compliance Manager: Conduct regular assessments to ensure SHA-2 algorithms are in use.
This involves reviewing the organisational policies and practices concerning data security and hashing protocols.
Keep it running
Ensure all systems use SHA-2 with at least 224-bit output and prioritise SHA-384 or SHA-512 for enhanced security.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The hash algorithm configuration report: Request the current configuration of data processing applications.
Look at
The details on the algorithm used.
Good evidence
Confirmation that SHA-2 with at least 224 bits is configured.
- Check 2 of 5What an auditor asks for
Ask for
Software specifications: Obtain documentation for all critical systems in use.
Look at
Mentions of hashing methods within these specs.
Good evidence
Mention of SHA-2 usage and specifying preferred bit lengths (384 or 512).
- Check 3 of 5What an auditor asks for
Ask for
Procurement records: Request recent software procurement documents.
Look at
Specifications about cryptography standards.
Good evidence
Records showing SHA-2 with recommended bit lengths as a purchase requirement.
- Check 4 of 5What an auditor asks for
Ask for
Policy documentation: Obtain the organisation's data security policy.
Look at
Sections related to cryptographic practices.
Good evidence
Policies explicitly requiring the use of SHA-2 hashing algorithms.
- Check 5 of 5What an auditor asks for
Ask for
A compliance audit report: Request the latest audit report on data security compliance.
Look at
Sections addressing hashing algorithms.
Good evidence
Auditor's confirmation of SHA-2 implementation conforming to organisational policy.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1766 requires organisations to use SHA-2 hashing with an output size of at least 224 bits (preferably SHA-384 or SHA-512) to ensure secure hashing. This relates directly to ISO/IEC 27001:2022 Annex A 8.24, which requires rules for effective use of cryptography and cryptographic key management to be defined and implemented, within which approved hash algorithms and minimum strengths would normally be specified. Annex A 8.24 is broader because it covers cryptography governance across many use cases (e.g., encryption, signatures, key management), while ISM-1766 is a specific technical requirement about SHA-2 hash strength.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.