Skip to content
Cryptography
ASD ISMISM-1768

ASD ISM 1768 Use appropriate SHA-2 output size for hashing

What it says

When using SHA-2 for hashing, an output size of at least 384 bits is used, preferably SHA-384 or SHA-512.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use SHA-2 with at least 384-bit output for secure data hashing.

When you use hashing to secure your data, it's like putting a unique fingerprint on it. This control means you should use a strong type of fingerprint called SHA-2 with at least 384 bits. If you don't, your data could be vulnerable to attacks, making it possible for someone to tamper with or steal sensitive information.

Why it matters

Using weaker SHA-2 output sizes (e.g., SHA-256) increases collision risk, enabling attackers to forge hashes and undermine integrity checks on sensitive data.

How to implement

  1. The IT team should ensure that any system or application doing data hashing is set up to use SHA-2 with at least 384 bits.

    They can do this by checking and updating the system settings or code configurations where hashing occurs.

  2. Managers should include a discussion about data hashing in their regular security reviews, focusing on whether systems use the recommended SHA-2 standard.

    They should set up meetings with IT to confirm hashing outputs are compliant.

  3. The procurement officer should verify that new software products purchased by the organisation support SHA-2 with a minimum of 384-bit output.

    They can do this by requesting documentation from vendors during the buying process.

  4. System administrators should routinely check logs and system settings to ensure hash algorithms have not been unintentionally changed to less secure versions.

    They can use scripts or monitoring software to automate these checks.

  5. Training coordinators should schedule regular sessions to remind staff about the importance of using strong hash functions.

    This helps maintain awareness and ensures the staff recognises the importance of SHA-2 in data protection.

Keep it running

Confirm all hashing uses SHA-384 or SHA-512 (no SHA-224/256) by reviewing configs, libraries and code paths; update legacy defaults and prevent downgrades.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    The system's configuration documentation: This document should detail the hashing algorithms in use across systems.

    Look at

    The specific algorithm names and their output size of at least 384 bits.

    Good evidence

    Would be a clear mention of SHA-384 or SHA-512 being used.

  2. Check 2 of 4What an auditor asks for

    Good evidence

    Includes logs showing hash strings with appropriate lengths reflecting the recommended algorithms.

  3. Check 3 of 4What an auditor asks for

    Ask for

    To see a list of security policies: Ensure there is a policy requiring SHA-2 with a minimum 384 bit-size for hashing.

    Look at

    Explicit references to this requirement within the document. An adequate policy would directly state the usage of SHA-384 or SHA-512.

    Good evidence

    Will have this requirement clearly written in the contract or SLA terms.

  4. Check 4 of 4What an auditor asks for

    Ask for

    The IT team for evidence of staff training on hashing algorithms: This could be training materials or attendance records. Check that the materials cover the importance of using SHA-2 with a 384-bit minimum size.

    Good evidence

    Includes dated training documentation with these specifics.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.