Navigate

SI-7

SI-7: Software, Firmware, And Information Integrity

The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].

Supplemental

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity (e.g., tampering). Software includes, for example, operating systems (with key internal components such as kernels, drivers), middleware, and applications. Firmware includes, for example, the Basic Input Output System (BIOS). Information includes metadata such as security attributes associated with information. State-of-the-practice integrity-checking mechanisms (e.g., parity checks, cyclical redundancy checks, cryptographic hashes) and associated tools can automatically monitor the integrity of information systems and hosted applications.

CIA Levels
Confidentiality	unknown
Integrity	moderate
Availability	unknown

Overlays
Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to SI-7.

Control	Description
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [Assignment: organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SC-8	The information system protects the [Selection (one or more): confidentiality; integrity] of transmitted information.
SC-13	The information system implements [Assignment: organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
SI-3	The organization: SI-3a.: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; SI-3b.: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; SI-3c.: Configures malicious code protection mechanisms to: SI-3c.1.: Perform periodic scans of the information system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection (one or more); endpoint; network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and SI-3c.2.: [Selection (one or more): block malicious code; quarantine malicious code; send alert to administrator; [Assignment: organization-defined action]] in response to malicious code detection; and SI-3d.: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

Enhancements

The controls below (if any) add on to the requirements of SI-7.

Control	Description
SI-7 (1)	The information system performs an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].
SI-7 (2)	The organization employs automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.
SI-7 (3)	The organization employs centrally managed integrity verification tools.
SI-7 (4)	[Withdrawn: Incorporated into SA-12].
SI-7 (5)	The information system automatically [Selection (one or more): shuts the information system down; restarts the information system; implements [Assignment: organization-defined security safeguards]] when integrity violations are discovered.
SI-7 (6)	The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-7 (7)	The organization incorporates the detection of unauthorized [Assignment: organization-defined security-relevant changes to the information system] into the organizational incident response capability.
SI-7 (8)	The information system, upon detection of a potential integrity violation, provides the capability to audit the event and initiates the following actions: [Selection (one or more): generates an audit record; alerts current user; alerts [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].
SI-7 (9)	The information system verifies the integrity of the boot process of [Assignment: organization-defined devices].
SI-7 (10)	The information system implements [Assignment: organization-defined security safeguards] to protect the integrity of boot firmware in [Assignment: organization-defined devices].
SI-7 (11)	The organization requires that [Assignment: organization-defined user-installed software] execute in a confined physical or virtual machine environment with limited privileges.
SI-7 (12)	The organization requires that the integrity of [Assignment: organization-defined user-installed software] be verified prior to execution.
SI-7 (13)	The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles].
SI-7 (14)	The organization: SI-7 (14)(a): Prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code; and SI-7 (14)(b): Provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.
SI-7 (15)	The information system implements cryptographic mechanisms to authenticate [Assignment: organization-defined software or firmware components] prior to installation.
SI-7 (16)	The organization does not allow processes to execute without supervision for more than [Assignment: organization-defined time period].

Related CCIs

The CCIs below are tied to SI-7.

CCI	Definition
CCI-002703	The organization defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.
CCI-002704	The organization employs integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information.