PR.DS-8: Integrity checking mechanisms are used to verify hardware integrity

PF v1.0 References:

Threats Addressed:

Warning icon.

Subcategory is withdrawn in the next version of this framework and incorporated into: ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use, DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.

Description

[csf.tools Note: Subcategories do not have detailed descriptions.]

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

SA-10: Developer Configuration Management

Require the developer of the system, system component, or system service to: Perform configuration management during system, component, or service [Assignment (one or more): design, development, implementation, operation, disposal]; Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items]; Implement only organization-approved changes to the system, component, or service; Document approved changes…

Critical Security Controls Version 8.1

16: Application Software Security

Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.

16.14: Conduct Threat Modeling

Conduct threat modeling. Threat modeling is the process of identifying and addressing application security design flaws within a design, before code is created. It is conducted through specially trained individuals who evaluate the application design and gauge security risks for each entry point and access level. The goal is to map out the application, architecture, and infrastructure in a structured way to understand its weaknesses.

NIST Special Publication 800-53 Revision 4

SA-10: Developer Configuration Management

The organization requires the developer of the information system, system component, or information system service to: Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation]; Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management]; Implement only organization-approved changes to the system,…

Cloud Controls Matrix v3.0.1

CCC-01: New Development / Acquisition

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network, and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization’s business leadership or other accountable business role or function.