PR.PS-05.254

Does your organization have a process to verify the authenticity and integrity of software before installation?

Explanation

This question assesses whether your organization validates that software comes from legitimate sources and hasn't been tampered with before installation. This includes checking digital signatures, verifying checksums, downloading from official repositories or vendor websites, and confirming software hasn't been modified in transit. Evidence could include a documented software verification procedure, screenshots of checksum verification processes, logs showing signature verification, or a software installation policy that mandates source and integrity verification steps.

Implementation Example

Verify the source of new software and the software's integrity before installing it

ID: PR.PS-05.254

Context

Function: PR: PROTECT
Category: PR.PS: Platform Security
Sub-Category: Installation and execution of unauthorized software are prevented

ResponseHub is the product I wish I had when I was a CTO

Previously I was co-founder and CTO of Progression, a VC backed HR-tech startup used by some of the biggest names in tech.

As our sales grew, security questionnaires quickly became one of my biggest pain-points. They were confusing, hard to delegate and arrived like London busses - 3 at a time!

I'm building ResponseHub so that other teams don't have to go through this. Leave the security questionnaires to us so you can get back to closing deals, shipping product and building your team.

Neil Cameron

Founder, ResponseHub