8 APRIL NEW ZEALAND GAZETTE 879

d) If the verification procedure detects an error, the EGM will enter an unrecoverable RAM
error requiring a full RAM clear;

e) On each processor restart, the program contents of the secondary storage media must
either be re-created or re-verified.

Note : These requirements should not be seen as an impediment to the use of future
technologies or alternative use of existing technologies which feature designs based on
adequate software verification and security measures.

PSD Verification

3.2.15 All PSDs (program storage devices) in the executable address space of a critical processor
must be validated at least every time the CPU is reset. Parity and checksum methods are not
acceptable.

3.2.16 RAM and PSD space that is not critical to machine security (e.g. video or sound ROM) are not
required to be validated.

Unused Program Memory Storage

3.2.17 The integrity of the operation of the device must be protected from nefarious or accidental use
of the unused portions of the program memory storage media. Specific requirements that apply
to particular types of storage media are discussed in the following paragraphs.

ROM Program Storage

3.2.18 All unused areas of ROM must be written with the inverse of the erased state which for most
EPROMs is zero bits (00 hex), rather than one bits (FF hex). Other effective means of filling
unused areas with programming will be considered on a case by case basis.

Write Once Read Many (WORM) Program Storage

3.2.19 A WORM (e.g. CD-ROM) used as a program or fixed data storage device must be written such
that only the actual program and data required is written to the WORM.

3.2.20 The operational software must provide an integrity check method to verify that there are no
additional or missing program or data records/files on the WORM.

3.2.21 There must be an ability to conduct an integrity check independent of the device’s operational
software to verify that there are no additional or missing program or data records/files on the
WORM (e.g. inserting a CD-ROM in another PC which then conducts a full signature check and
directory search check over the CD-ROM space).

3.2.22 Old approved versions of programs may be held on a WORM. However, it must be possible to
clearly identify which files belong to which version of the program.

3.2.23 The method of changing to different versions of the program, including reverting to an older
version must be approved.

Read/Write Storage Media

3.2.24 A Read/Write Storage device (e.g. Disk or Tape) used for storage of program or fixed data must
be written in such a way that only the actual program and fixed data required by the program is
written to the storage device.

3.2.25 The operational software must provide an integrity check method to verify that there are no
additional or missing program or fixed data records/files on the storage device.

3.2.26 There must be an ability to conduct an integrity check independent of the device’s operational
software to verify that there are no additional or missing program or data records/files on the
storage device. For example, attach and boot from an external floppy disk which initiates a full
signature and directory search check over the entire device storage space.

3.2.27 All methods of integrity check must have the ability to identify files/records that are variable data
and exclude them from the signature calculation.