# Bibliography The bibliography, and the standards it pulls in

The bibliography names the hash, signature and encoding standards the mechanisms rely on. It is where an approved product list finds the supporting standards it has to add, and where a procurement team discovers that a mechanism brings a family of documents with it.

## What it asks

Map every bibliography entry that the mechanisms in use rely on to an approved standard and a product, and record the gaps. Where an entry is informative, say so, and do not let a supporting standard enter the approved list without its own review.

## What the revision does

The fourth edition will update the bibliography against the revised references. The revised list is not public.

## Who it binds

The owner of the approved standards list and procurement.

## Evidence an auditor samples

- The bibliography mapping, one row per entry relied on (cryptography standard)
- The approved product for each supporting standard (procurement file)
- The gap list, with an owner for each open entry (risk register)

## The test you can run

Pick a mechanism in use and list the bibliography entries it depends on. If any has no approved product, the mechanism has an unowned dependency.

## Common failures

- Supporting standards are assumed to be covered by the main approval.
- An informative entry is treated as a requirement and stalls a deployment.

## How to close it

Treat the bibliography as a dependency list and review it with the mechanism. The mechanism is only as approved as the standards it leans on, and the gaps are where an assessor will look.

## Source

ISO/IEC 9798-5:2009(E), Bibliography, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.