Skip to content
Software development
ASD ISMISM-1797

ASD ISM 1797 Ensure software updates are securely signed

What it says

Installers, patches and updates are digitally signed or provided with cryptographic checksums as part of software development.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Make sure software updates and patches are securely signed to verify they are authentic and untampered.

Ensuring software updates are securely signed means making sure the updates you install are safe and come from a trusted source. This is important because if updates aren't verified for authenticity, hackers could take control of your systems by sneaking malicious software in through those updates.

Why it matters

Unchecked software updates can enable attackers to inject malicious code, compromising systems and causing data breaches.

How to implement

  1. IT team should check current software update practices: Make sure every software update process includes a step to confirm that updates come with a digital signature.

    This can be done by checking the update's signature before it's applied.

  2. Software developers should integrate code-signing certificates into their development process: Ensure every piece of software released by your organisation includes a digital signature.

    This involves obtaining trusted certificates from a reputable provider and using them to sign your software.

  3. Procurement should verify vendor security practices: Whenever purchasing new software solutions, ask vendors how they handle software update authentication.

    Only proceed with suppliers who can confirm they use secure update processes.

  4. Managers should arrange training for staff on recognising authentic software updates: Hold workshops for your team to explain the signs of legitimate software updates and what to do if they think an update might be suspicious.

  5. IT team should regularly review digital signatures and certificates: Schedule routine checks on the validity of certificates and replace them if they're close to expiry.

    Use tools that automatically alert you when signatures or certificates are invalid.

Keep it running

Verify update signatures or cryptographic checksums before install; quarantine and report any unsigned or mismatched packages.

Evidence and audit

  1. Check 1 of 3What an auditor asks for

    Ask for

    A list of all software used by the organisation and their update procedures.

    Look at

    How each update source is verified and whether digital signatures are routinely checked. Good practice includes having documented procedures for all major software, with confirmations of signature checks.

  2. Check 2 of 3What an auditor asks for

    Ask for

    Records of staff training sessions on software update verification.

    Look at

    Details on content covered and employee attendance. Good records include dated training materials and signed attendance sheets.

  3. Check 3 of 3What an auditor asks for

    Ask for

    Vendor security assurances: Check vendor agreements and communications for clauses about software update security.

    Good evidence

    Includes explicit vendor commitments to secure update practices and evidence of regular audits or security reviews.

Mappings

Closest match in ISO/IEC 27001: A.8.19, Secure software installation procedures, which this control covers in full and more.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.8.19Secure software installation proceduresBroader than
  • A.8.25Secure development lifecyclePartially meets
  • A.5.21Managing information security in the ICT supply chainSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.