SI-7: Software, Firmware, and Information Integrity
Control Family:
CSF v1.1 References:
PF v1.0 References:
Threats Addressed:
Baselines:
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- SI-7: Software, Firmware, And Information Integrity
Control Statement
- Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information] ; and
- Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].
Supplemental Guidance
Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms-including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools-can automatically monitor the integrity of systems and hosted applications.
OT Discussion
The organization determines whether the use of integrity verification applications would adversely impact operation of the ICS and employs compensating controls (e.g., manual integrity verifications that do not affect performance). Control Enhancements: (1) OT Discussion: The organization ensures that the use of integrity verification applications does not adversely impact the operational performance of the OT.
Control Enhancements
SI-7(1): Integrity Checks
Baseline(s):
- Moderate
- High
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Assignment (one or more): at startup, at [Assignment: organization-defined transitional states or security-relevant events] , [Assignment: organization-defined frequency] ].
SI-7(2): Automated Notifications of Integrity Violations
Baseline(s):
- High
- OT High (SP 800-82r3)
Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.
SI-7(3): Centrally Managed Integrity Tools
Baseline(s):
Employ centrally managed integrity verification tools.
SI-7(5): Automated Response to Integrity Violations
Baseline(s):
- High
- OT High (SP 800-82r3)
Automatically [Assignment (one or more): shut down the system, restart the system, implement [Assignment: organization-defined controls] ] when integrity violations are discovered.
SI-7(6): Cryptographic Protection
Baseline(s):
Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-7(7): Integration of Detection and Response
Baseline(s):
- Moderate
- High
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined changes].
SI-7(8): Auditing Capability for Significant Events
Baseline(s):
Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Assignment (one or more): generate an audit record, alert current user, alert [Assignment: organization-defined personnel or roles] , [Assignment: organization-defined other actions] ].
SI-7(9): Verify Boot Process
Baseline(s):
Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components].
SI-7(10): Protection of Boot Firmware
Baseline(s):
Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].
SI-7(12): Integrity Verification
Baseline(s):
Require that the integrity of the following user-installed software be verified prior to execution: [Assignment: organization-defined user-installed software].
SI-7(15): Code Authentication
Baseline(s):
- High
- OT High (SP 800-82r3)
Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].
SI-7(16): Time Limit on Process Execution Without Supervision
Baseline(s):
Prohibit processes from executing without supervision for more than [Assignment: organization-defined time period].
SI-7(17): Runtime Application Self-protection
Baseline(s):
Implement [Assignment: organization-defined controls] for application self-protection at runtime.