NIST SP 800-167 Guide to Application Whitelisting 2.2.1b: Base the whitelist on publisher signatures combined with cryptographic hashes, and keep hashes current

What does 2.2.1b require?

The organisation chooses products whose rules combine digital signature or publisher identity with cryptographic hashes, the pairing that gives the most accurate and complete control, while weighing the maintenance burden. Where publisher trust is used, the limits are understood: it cannot single out one application from a vendor's set and it lets old vulnerable versions run. Where hashes are used, each legitimate patch is verified by its signature and its new hash added, and hashes of superseded vulnerable versions are removed, because an unmaintained hash list either breaks software or lets vulnerable builds execute. Internal applications may be anchored to an organisation-issued signing key or cross-signed with the vendor.