Code Signing
What is Code Signing?
The process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed.
Terms that appear alongside code signing
Each of these is named in at least one of the same controls as code signing. The number is how many controls name both.
- integrity 7 shared controls
- owasp 3 shared controls
- integrity verification 3 shared controls
- fips 2 shared controls
- data integrity 2 shared controls
- boot integrity 2 shared controls
- software bill of materials 2 shared controls
- baseline 2 shared controls
Frameworks that govern code signing
What the standards actually require on code signing
Requirements naming code signing across 6 standards, quoted from the control text.
Restrict script execution to authorised scripts (for example specific PowerShell or Python files) using controls such as code signing and version control, blocking all others. Reassess at least every six months.
cis-controls-v8-1::2.7 · Allowlist Authorized Scripts →The project establishes a development environment and practices sufficient for the assurance requirements, applied to the whole system and not only its security components: security engineering principles, secure coding and safe language standards, source and...
canada-itsg-33-it-security-risk-management::A2-3.7.1 · 3.7.1 Establish a secure development environment →Where code signing is used, the maker has procedural and technical controls against unauthorised access to or change of the private signing keys;
iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.1 · E27 5.1 Controls for private keys (IEC 62443-4-1 SM-8) →NSS-17 + NSS-42-G require system integrity protection through configuration management + change management + baseline control + hardening.
IAEA-NSS17-SystemIntegrity-Configuration-Change-Management · IAEA NSS-17 - System Integrity + Configuration Management + Change Management + Baseline + Hardening →A process shall be employed to protect private keys used for code signing and product identity from unauthorized access or modification, covering their generation, storage, use and revocation.
iec-62443::SM-8 · Controls for private keys →Security Dimension 6 Data Integrity per X.805 Clause 6.6: Data Integrity keeps data correct and accurate. Data are shielded from being altered, deleted, created or copied without authorization, and any such unauthorized activity is made detectable.
X805-Dim6-Data-Integrity-Correctness-Accuracy-Unauthorized-Modification-Deletion-Detection · ITU-T X.805 Security Dimension 6 - Data Integrity + Correctness + Accuracy + Unauthorized Modification Prevention + Deletion Detection + Hashing + HMAC + Digital Signatures + Merkle Trees + Blockchain Integrity + File Integrity Monitoring (FIM) →Questions people ask about code signing
What is Code Signing?
Why is Code Signing important for compliance?
Which compliance frameworks address Code Signing?
Where can I learn more about Code Signing?
See how Code Signing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.