SI-7 Software, Firmware, and Information Integrity
Control
Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information] ; and
Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].
Discussion
Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.
Control enhancements (17)
- SI-7(1)Integrity ChecksMODERATEHIGH
- SI-7(2)Automated Notifications of Integrity ViolationsHIGH
- SI-7(3)Centrally Managed Integrity Tools
- SI-7(4)Tamper-evident Packaging
- SI-7(5)Automated Response to Integrity ViolationsHIGH
- SI-7(6)Cryptographic Protection
- SI-7(7)Integration of Detection and ResponseMODERATEHIGH
- SI-7(8)Auditing Capability for Significant Events
- SI-7(9)Verify Boot Process
- SI-7(10)Protection of Boot Firmware
- SI-7(11)Confined Environments with Limited Privileges
- SI-7(12)Integrity Verification
- SI-7(13)Code Execution in Protected Environments
- SI-7(14)Binary or Machine Executable Code
- SI-7(15)Code AuthenticationHIGH
- SI-7(16)Time Limit on Process Execution Without Supervision
- SI-7(17)Runtime Application Self-protection
Related controls
Need SI-7 implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.