Script Signing

Unsigned remote PowerShell is a recurring audit finding for MSPs. Trustholm enforces tenant signing policy before script execution, verifies cryptographic signatures, and records attribution in the security audit plane.

Policy enforcement: Administrators require signed scripts for production execution when policy demands it. Unsigned scripts are blocked at queue dispatch-not silently at the agent with ambiguous errors. Policy changes themselves generate audit events.

PowerShell IDE workflow: Authors edit in the Monaco-based IDE, submit through approval workflows, and publish versions tied to identity. Platform script catalog lets tenants duplicate published platform examples into their library for customization.

Dual-custody (four-eyes): On by default per tenant, the user who submits a script for approval cannot approve it in Script Management - even if they are Tenant Admin. API returns ERR_DUAL_CUSTODY_VIOLATION on bypass attempts; security audit records script.dual_custody.denied. Disable only in dev tenants when policy allows and document the exception in your SSP.

Platform built-in operations: Some product features resolve script content by reserved tags on published platform scripts (for example built-in agent restart). Centralizing behavior in the catalog avoids per-tenant duplicated unsigned snippets.

Cryptographic verification: Agents verify signatures against tenant trust stores and policy before execution. Customer PKI maturity varies-document whether codesigning certificates come from internal CA, public CA, or HSM-backed processes in your SSP.

Audit trail: Publish, approve, queue, and execute events correlate in security audit export. Assessors can answer who ran what, which script version, and under which signing policy for a datetime window.

Limitations: HSM integration depth depends on customer deployment models. We document signing workflows; we do not claim universal hardware security module support across all tenants.

Change control pairing: Signing proves integrity at execution-not peer review by itself. Attach ITSM tickets to publish events in your process documentation. Assessors cross-check export timestamps with change records.

Revocation and compromise: Document certificate revocation procedures when CA compromise occurs. Trustholm blocks failed verification until trust store updates-run tabletop exercises for rapid cert rollover with NOC and authoring teams.

Signing program maturity model

Stage 1: allow unsigned in dev tenants only. Stage 2: enforce signing on production tenants for new scripts.

Stage 3: migrate legacy scripts from incumbent RMM with deadline. Stage 4: correlate every publish with ITSM change ticket ID in runbook if not in export schema.

Stage 5: annual technician interview spot-checks on signing policy. Assessors reward staged honesty over claiming day-one perfection.

HSM depth varies-document your PKI architecture without implying vendor manages private keys unless contracted.

PKI operations calendar

Sync cert expiry with change advisory board. Pre-stage renewed certs in test tenant before production rollover. Document break-glass unsigned prohibition even during incidents unless SSP explicitly allows emergency exception with retroactive review.

Signing evidence sampler

Monthly internal sample: pick five random script executions, trace publish→approve→run in export, attach ITSM ticket IDs. Escalate missing correlation to engineering and process owners within five business days.

Unsigned exception governance

If emergency unsigned runs are permitted, require post-incident review within 48 hours, retroactive signing where possible, and SSP appendix describing exception criteria-assessors probe exception discipline heavily. Track exception count monthly and escalate repeat offenders to engineering leadership.

Catalog duplication audit trail: When tenants duplicate platform scripts, publish and signing events should appear in export for customized copies-not only for net-new authoring. Review duplication frequency quarterly to detect shadow libraries bypassing approval workflows.

PKI compromise tabletop: Run annual exercise simulating CA compromise: revoke trust store entries, verify blocked execution, and measure time to redeploy renewed certificates across representative agent scope. Document outcomes in security committee minutes.

Assessor sampling methodology: When auditors request random script samples, define selection criteria in advance-risk tier, date range, customer scope-to avoid ad hoc picks that miss unsigned exceptions. Include methodology paragraph in evidence binder cover sheet.

Technician attestation: Annual spot interviews should confirm technicians cannot bypass signing via unofficial RMM libraries for tier-one scripts. Document interview summaries in internal compliance folder-not customer-facing unless assessor requests.

Pair signing metrics with unsigned-blocked counts in operations review dashboards. Present signing compliance trend quarterly to vCISO council with explicit dev-tenant exclusion footnotes.

When customers request HSM integration depth, respond with customer-managed PKI deployment appendix-do not imply universal hardware security module support. Maintain sample signed script manifest and blocked unsigned attempt log for annual assessor walkthrough kits.