Digital Signatures policy

[warmanaMOJ]

Need guidance on using digital signatures. This could be for contracts, for example.

The aim is to be able to eliminate the pen from the end-to-end process, and remove any dependancy on people being in the office to sign things off.

Need to consider three main categories of document:

• Word
• PDF
• Any other document object

Possible mechanisms include:

• embedding a digitised version of a physical signature
• using an existing signature mechanism within a tool or application
• signing a finished document 'as-is'

The guidance should be considered (validated) by:

• Crypto Guardian
• Security Engineering
• Operational Security