Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Use of digital certificate for signing the files which are auto-generated by the applications that belong to a sister-concern entity that is into products/services to the other sister-concern entity which is into Finance.
Is this something mandated by various regulatory frameworks?
Certainly there are ways to digitally sign invoices you're exchanging between two entities. What forms there are depend on what formats the invoices are in (for example, PDFs may have embedded signatures). It's also possible to use a generic digital signature, such as with CMS, OpenPGP, or OpenSSH. Any of these can be acceptable depending on your needs and requirements, which you haven't stated.
Whether this is necessary depends on the approach. If you plan to submit a large number of invoices that are automatically paid, then you may opt for a machine-readable format with a detached signature. If, however, you're sending one large invoice at the end of the month and it will be manually processed, it may not be needed.
I can't speak for all regulatory frameworks across all domains, but typically regulatory frameworks want you to have effective controls. That means that you have the appropriate number of responsible humans having oversight over what is being done (in this case, paying money) and that the things being done are responsible, legal, and what your policy said was supposed to be done. That may mean more than digital signatures if you're paying things automatically; for example, you may need to do spot audits to verify that the invoices are legitimate and that the amounts being paid are reasonable, and that the funds are being paid to the right place. If the invoices suddenly start requesting 50% more funds that are all being paid to an anonymous account in the Cayman Islands, that should be detected and investigated promptly, even if they're all validly digitally signed.
In some cases, a regulatory framework may dictate the form of those effective controls, such as by specifying a particular cryptographic suite or a particular set of policies to require. However, others do not. You'd need to consult your particular regulatory requirements to verify.
Thus, digital signatures on invoices between related parties can be helpful and valuable as a tool, but they are not necessarily a requirement (as far as I'm aware) nor are they a 100% foolproof solution.
