PS.2.1 Make software integrity verification information available to software acquirers.

Statement

Make software integrity verification information available to software acquirers.

Example 1:

Post cryptographic hashes for release files on a well-secured website.

Example 2:

Use an established certificate authority for code signing so that consumers’ operating systems or other tools and services can confirm the validity of signatures before use.

Example 3:

Periodically review the code signing processes, including certificate renewal, rotation, revocation, and protection.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final