SI-7: Software, Firmware, And Information Integrity
Control Family:
PF v1.0 References:
Threats Addressed:
Next Version:
- NIST Special Publication 800-53 Revision 5:
- SI-7: Software, Firmware, and Information Integrity
Control Statement
The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].
Supplemental Guidance
Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity (e.g., tampering). Software includes, for example, operating systems (with key internal components such as kernels, drivers), middleware, and applications. Firmware includes, for example, the Basic Input Output System (BIOS). Information includes metadata such as security attributes associated with information. State-of-the-practice integrity-checking mechanisms (e.g., parity checks, cyclical redundancy checks, cryptographic hashes) and associated tools can automatically monitor the integrity of information systems and hosted applications.
Control Enhancements
SI-7(1): Integrity Checks
Baseline(s):
- Moderate
- High
The information system performs an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].
SI-7(2): Automated Notifications Of Integrity Violations
Baseline(s):
- High
The organization employs automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.
SI-7(3): Centrally-Managed Integrity Tools
Baseline(s):
The organization employs centrally managed integrity verification tools.
SI-7(5): Automated Response To Integrity Violations
Baseline(s):
- High
The information system automatically [Selection (one or more): shuts the information system down; restarts the information system; implements [Assignment: organization-defined security safeguards]] when integrity violations are discovered.
SI-7(6): Cryptographic Protection
Baseline(s):
The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-7(7): Integration Of Detection And Response
Baseline(s):
- Moderate
- High
The organization incorporates the detection of unauthorized [Assignment: organization-defined security-relevant changes to the information system] into the organizational incident response capability.
SI-7(8): Auditing Capability For Significant Events
Baseline(s):
The information system, upon detection of a potential integrity violation, provides the capability to audit the event and initiates the following actions: [Selection (one or more): generates an audit record; alerts current user; alerts [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].
SI-7(9): Verify Boot Process
Baseline(s):
The information system verifies the integrity of the boot process of [Assignment: organization-defined devices].
SI-7(10): Protection Of Boot Firmware
Baseline(s):
The information system implements [Assignment: organization-defined security safeguards] to protect the integrity of boot firmware in [Assignment: organization-defined devices].
SI-7(11): Confined Environments With Limited Privileges
Baseline(s):
The organization requires that [Assignment: organization-defined user-installed software] execute in a confined physical or virtual machine environment with limited privileges.
SI-7(12): Integrity Verification
Baseline(s):
The organization requires that the integrity of [Assignment: organization-defined user-installed software] be verified prior to execution.
SI-7(13): Code Execution In Protected Environments
Baseline(s):
The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles].
SI-7(14): Binary Or Machine Executable Code
Baseline(s):
- High
The organization: Prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code; and Provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.
SI-7(15): Code Authentication
Baseline(s):
The information system implements cryptographic mechanisms to authenticate [Assignment: organization-defined software or firmware components] prior to installation.
SI-7(16): Time Limit On Process Execution W/O Supervision
Baseline(s):
The organization does not allow processes to execute without supervision for more than [Assignment: organization-defined time period].