SI-7(5): Automated Response to Integrity Violations
Control Family:
Parent Control:
CSF v1.1 References:
PF v1.0 References:
Threats Addressed:
Baselines:
- High
- OT High (SP 800-82r3)
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- SI-7(5): Automated Response To Integrity Violations
Control Statement
Automatically [Assignment (one or more): shut down the system, restart the system, implement [Assignment: organization-defined controls] ] when integrity violations are discovered.
Supplemental Guidance
Organizations may define different integrity-checking responses by type of information, specific information, or a combination of both. Types of information include firmware, software, and user data. Specific information includes boot firmware for certain types of machines. The automatic implementation of controls within organizational systems includes reversing the changes, halting the system, or triggering audit alerts when unauthorized modifications to critical security files occur.
OT Discussion
Shutting down and restarting the ICS may not always be feasible upon identification of an anomaly. These actions should be scheduled according to ICS operational requirements.