PS.2.1 Make software integrity verification information available to software acquirers.

Statement

Make software integrity verification information available to software acquirers.

Example 1:

Post cryptographic hashes for release files on a well-secured website.

Example 2:

Use an established certificate authority for code signing so that consumers’ operating systems or other tools and services can confirm the validity of signatures before use.

Example 3:

Periodically review the code signing processes, including certificate renewal, rotation, revocation, and protection.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final