PR.PS-05.254
Does your organization have a process to verify the authenticity and integrity of software before installation?
Explanation
Software integrity verification is the subject, specifically whether you confirm that software comes from a legitimate source and has not been tampered with before it is installed. This includes checking digital signatures, verifying checksums, downloading from official repositories or vendor websites, and confirming software hasn't been modified in transit.
Evidence could include a documented software verification procedure, screenshots of checksum verification processes, logs showing signature verification, or a software installation policy that mandates source and integrity verification steps.
Implementation Example
Verify the source of new software and the software's integrity before installing it
ID: PR.PS-05.254
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Installation and execution of unauthorized software are prevented
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
