Skip to content
Software development
ASD ISMISM-2027

ASD ISM 2027 Verify software artefacts with digital signatures

What it says

All software artefacts are verified by a digital signature, or a secure hash provided over a secure channel, before being imported into the authoritative source for software.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure all software is authenticated with a digital signature or secure hash before use.

This control is about making sure that the software your business uses is legitimate and hasn't been tampered with. Think of it as checking the seal on a jar of jam; if you don't verify it's unbroken, you might end up with something spoiled or fake. Skipping this step could lead to malware entering your systems, resulting in data breaches or financial losses.

Why it matters

Without verifying artefacts via digital signatures or trusted hashes, malicious code can be imported into the software source, causing compromise or data loss.

How to implement

  1. IT team should include digital signature verification in their software procurement process.

    They can do this by requiring vendors to provide digital signatures with every software package. The IT team should verify these signatures against the known signatures of trusted providers before deploying the software.

  2. Procurement officers should request secure hashes from vendors when buying new software.

    To do this, write into the contract that suppliers must provide the hash through a secure email or a verified portal, and ensure it's checked by the IT department upon receipt.

  3. System administrators should implement tools that automatically check software signatures and hashes before installation.

    They can integrate these tools into the system's update process to ensure that unverified software doesn't get installed.

  4. Managers should run training sessions for staff who handle software to explain the importance of verifying digital signatures.

    This involves arranging for an IT professional to demonstrate what to check for and how often these checks should occur.

  5. Regularly audit the software asset register by designating an IT team member to ensure all entries have verified digital signatures.

    They should review this quarterly, updating the register and removing any unverified software from systems if necessary.

Keep it running

Maintain trusted signing keys/certificates and hash sources; verify signatures or hashes before import, and quarantine/reject any artefact with mismatches.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    A list of all software installed within the last year along with their verification records.

    Look at

    Timestamped entries for digital signature verification or hash checks.

    Good evidence

    List will have all software documented with accompanying records showing successful verification.

  2. Check 2 of 5What an auditor asks for

    Look at

    Attendance sheets and training materials provided. Good evidence includes participation details along with a summary of what was taught.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Contracts or purchase orders that include requirements for digital signatures or hashes.

    Look at

    The clauses that specify these security requirements. A well-defined contract will clearly state these verification requirements and any process for compliance.

  4. Check 4 of 5What an auditor asks for

    Look at

    The log entries for evidence of checking and successful verification.

    Good evidence

    Log will show a timeline with entries confirming each piece of software was verified before use.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see the checklist or procedure document for verifying software artefacts.

    Look at

    The steps outlined and who is responsible for each.

    Good evidence

    Procedure will have clear steps, responsible persons, and a review date.

Mappings

Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.5.21Managing information security in the ICT supply chainPartially meets
  • A.5.19Managing information security in supplier relationshipsDepends on
  • A.8.19Secure software installation proceduresDepends on
ASD Essentials

ASD Essentials for enterprise IT: 1 mapping

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.