PS.2.1 Make software integrity verification information available to software acquirers.

Statement

Make software integrity verification information available to software acquirers.

Example 1:

Post cryptographic hashes for release files on a well-secured website.

Example 2:

Use an established certificate authority for code signing so that consumers’ operating systems or other tools and services can confirm the validity of signatures before use.

Example 3:

Periodically review the code signing processes, including certificate renewal, rotation, revocation, and protection.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final