# Clause 2 One normative reference is added

One normative reference is added, ISO/IEC 29192-5, the lightweight cryptography part on hash functions. A normative reference is not a suggestion. Where a mechanism clause points at the hash list, the lightweight part is now part of the approved supply, and the hash inventory is the evidence.

## What it asks

Add the lightweight hash part to the set of hash standards your approved list may draw on, and show for each mechanism whether it draws on it. Where a mechanism clause names only the main hash part, that narrower list still governs, and the new reference does not widen it.

## What the amendment does

Adds one entry to Clause 2.

## Who it binds

The owner of the approved cryptographic product list, with procurement.

## Evidence an auditor samples

- The approved hash list, showing both hash parts and their status (cryptography standard)
- The mechanism to hash mapping, one row per mechanism (design note)
- The supplier statement for each hash implementation in use (procurement file)

## The test you can run

Pick a mechanism that now names the lightweight part. Ask which hash implementation satisfies it. If the answer is a product not on the approved list, the reference is not operational.

## Common failures

- The reference is added to the bibliography of a policy but never to the approved product list.
- A lightweight hash is approved for a mechanism whose clause does not name it.

## How to close it

Treat each normative reference as a procurement line. The reference exists so that a hash implementation can be named, so the record should name one, with a version and a supplier.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, Clause 2. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.