Skip to content

Code Signing

What is Code Signing?

The process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed.

Information Security

Terms that appear alongside code signing

Each of these is named in at least one of the same controls as code signing. The number is how many controls name both.

Frameworks that govern code signing

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on code signing

Requirements naming code signing across 6 standards, quoted from the control text.

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems1 control

UR E27 requires equipment manufacturers to provide Software Bill of Materials (SBOM) and demonstrate secure development. SBOM contents per CISA SBOM Minimum Elements + SPDX or CycloneDX format: component name + version + supplier + license + dependency relatio...

IACS-UR-E27-SBOM-SecureDev-TypeApproval-SoftwareIntegrity · IACS UR E27 - Software Bill of Materials + Secure Development Lifecycle + Type Approval + Software Integrity →
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)1 control

NSS-17 + NSS-42-G require system integrity protection through configuration management + change management + baseline control + hardening.

IAEA-NSS17-SystemIntegrity-Configuration-Change-Management · IAEA NSS-17 - System Integrity + Configuration Management + Change Management + Baseline + Hardening →
ITU-T X.805 - Security Architecture for End-to-End Communications1 control

Security Dimension 6 Data Integrity per X.805 Clause 6.6: Data Integrity ensures the correctness or accuracy of data. The data is protected against unauthorized modification + deletion + creation + replication and provides an indication of these unauthorized a...

X805-Dim6-Data-Integrity-Correctness-Accuracy-Unauthorized-Modification-Deletion-Detection · ITU-T X.805 Security Dimension 6 - Data Integrity + Correctness + Accuracy + Unauthorized Modification Prevention + Deletion Detection + Hashing + HMAC + Digital Signatures + Merkle Trees + Blockchain Integrity + File Integrity Monitoring (FIM) →
MITRE ATT&CK1 control

Apply ATT&CK Mitigations (M-IDs) for prevention and risk reduction. M1015 Active Directory Configuration + M1018 User Account Management + M1027 Password Policies + M1056 Account Use Policies + M1017 User Training + M1036 Account Use Policies + M1042 Disable o...

MITRE-ATTACK-Mitigations-M-IDs-Active-Directory-User-Account-Management-Password-Policies-Network-Segmentation · MITRE ATT&CK Mitigations + M-IDs + Active Directory + User Account + Password + Network Segmentation + Application Control →
NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)1 control

Implement FIPS 205 SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) based on SPHINCS+ for long-term signatures + use cases requiring cryptographic agility independent of lattice assumptions.

PQC-4 · FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature →
OWASP ASVS1 control

Per OWASP ASVS V10: protect against malicious code. Requirements include (a) integrate static + dynamic + interactive application security testing in CI/CD pipeline + (b) maintain dependency inventory + SBOM + scan for vulnerabilities + license issues + malici...

OWASPASVS-10 · Malicious Code Verification (V10) →

Questions people ask about code signing

What is Code Signing?
The process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed.
Why is Code Signing important for compliance?
Code Signing is a key concept in Information Security. Understanding code signing helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Code Signing?
Code Signing appears in the requirement text of IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems, IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1), ITU-T X.805 - Security Architecture for End-to-End Communications, MITRE ATT&CK, NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205). Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Code Signing?
Explore our compliance framework pages to see how code signing applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Code Signing applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.