{"data":{"id":"SI-07","name":"Software, Firmware, and Information Integrity","family":"SI","family_name":"System and Information Integrity","withdrawn":false,"description":"a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and\nb. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].","supplemental_guidance":"Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.","enhancements":[{"id":"SI-07(01)","name":"Integrity Checks","statement":"Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].","baselines":["moderate","high"]},{"id":"SI-07(02)","name":"Automated Notifications of Integrity Violations","statement":"Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.","baselines":["high"]},{"id":"SI-07(03)","name":"Centrally Managed Integrity Tools","statement":"Employ centrally managed integrity verification tools.","baselines":[]},{"id":"SI-07(04)","name":"Tamper-evident Packaging","withdrawn":true,"incorporated_into":["SR-09"]},{"id":"SI-07(05)","name":"Automated Response to Integrity Violations","statement":"Automatically [Selection (one or more): shut the system down; restart the system; implement [Assignment: organization-defined controls]] when integrity violations are discovered.","baselines":["high"]},{"id":"SI-07(06)","name":"Cryptographic Protection","statement":"Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.","baselines":[]},{"id":"SI-07(07)","name":"Integration of Detection and Response","statement":"Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].","baselines":["moderate","high"]},{"id":"SI-07(08)","name":"Auditing Capability for Significant Events","statement":"Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].","baselines":[]},{"id":"SI-07(09)","name":"Verify Boot Process","statement":"Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components].","baselines":[]},{"id":"SI-07(10)","name":"Protection of Boot Firmware","statement":"Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].","baselines":[]},{"id":"SI-07(11)","name":"Confined Environments with Limited Privileges","withdrawn":true,"incorporated_into":["CM-07(06)"]},{"id":"SI-07(12)","name":"Integrity Verification","statement":"Require that the integrity of the following software be verified prior to execution: [Assignment: organization-defined software].","baselines":[]},{"id":"SI-07(13)","name":"Code Execution in Protected Environments","withdrawn":true,"incorporated_into":["CM-07(07)"]},{"id":"SI-07(14)","name":"Binary or Machine Executable Code","withdrawn":true,"incorporated_into":["CM-07(08)"]},{"id":"SI-07(15)","name":"Code Authentication","statement":"Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].","baselines":["high"]},{"id":"SI-07(16)","name":"Time Limit on Process Execution Without Supervision","statement":"Prohibit processes from executing without supervision for more than [Assignment: organization-defined time period].","baselines":[]},{"id":"SI-07(17)","name":"Runtime Application Self-protection","statement":"Implement [Assignment: organization-defined controls] for application self-protection at runtime.","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SI-07","name":"Software, Firmware, and Information Integrity","description":"a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and\nb. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].","discussion":"Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.","related_controls":["AC-04","CM-03","CM-07","CM-08","MA-03","MA-04","RA-05","SA-08","SA-09","SA-10","SC-08","SC-12","SC-13","SC-28","SC-37","SI-03","SR-03","SR-04","SR-05","SR-06","SR-09","SR-10","SR-11"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Control text adds requirement to take actions when unauthorized changes are detected Parameter added for specifying organization-defined actions Discussion includes additional examples"}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":["11.5","11.6"],"nist_csf_2":["ID.RA-09","PR.DS-01","PR.DS-02","PR.DS-10","PR.PS-02","DE.CM-09","RC.RP-03","RC.RP-05"],"cis_controls_v8":["CIS 13.2","CIS 13.7"],"soc2_tsc":["CC6.6","CC6.6-POF2","CC6.8"],"finos_ccc":[],"iso_42001_2023":["A.6.2.4","A.6.2.6"],"iec_62443":["3-3 SR 3.1","3-3 SR 3.4"],"asd_e8":["E8-3 ML3"],"nis2":[],"apra_cps_234":["Para 22-23"],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.20","Hygiene.34","SecNumCloud.13.6"],"osfi_b13":["B-13.3.2","B-13.3.3"],"finma_circular":["IV.B.d(59)","IV.C(64)","IV.D(78)"],"gdpr":["Art.5(1)(d)","Art.5(1)(f)","Art.32(1)(b)"],"dora":["Art.9(4)(b)","Art.9(4)(e)"],"bio2":[],"rbi_csf":["Annex1.5","Annex1.13"],"fisc":["FISC.T7","FISC.T12","FISC.T14"],"lgpd_bcb":["BCB.Art.3","LGPD.Art.46"],"hkma_tme1":["TME1.4.3","TME1.7.3","TME1.10.2"],"mlps_2":["8.1.2.3","8.1.3.6","8.1.4.4","8.1.4.6","8.1.4.7"],"dnb_good_practice":[],"cra":["CRA.I.2b","CRA.I.2c","CRA.I.2f","CRA.II.7"],"swift_cscf":["SWIFT.6.2","SWIFT.6.3"],"cbuae":["CR-7"],"nca_ecc":["2-3","5-1"],"qatar_nia":["OS"],"sama_csf":["3.3"],"uae_ia":["T7"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.6"],"cbe_csf":["CTO-7"],"cbn_csf":["Part3.3"],"popia":["s16","s19"],"sa_js2":["JS2-7.2","JS2-8.4","JS2-8.5"],"bcbs_239":["Principle 3","Principle 7"],"bot_cyber":["Ch2.6","Ch9.1"],"cpmi_pfmi":["CG.DE","CG.PR","PFMI.P17"],"eba_ict":["3.4.4"],"ecb_croe":["CROE.2.3.3","CROE.2.4"],"ffiec_is":["II.C.12","III.B"],"hipaa_sr":["§164.312(c)(1)","§164.312(c)(2)","§164.312(e)(2)(i)"],"iosco_cyber":["PROT-3","PROT-6","RR-3","TEST-5"],"nydfs_500":["500.8"],"sebi_cscrf":["PR.ES","PR.IP"],"cmmc_2":["SI"],"nerc_cip":["CIP-003-9","CIP-007-6","CIP-010-4","CIP-012-2","CIP-013-2"],"nrc_73_54":["RG5.71-A-SI"],"tsa_psd":[],"ieee_1686":["5.3"],"ferc_cip":[],"doe_c2m2":[],"api_1164":["Sec 7"],"awia":[],"iaea_nss":["Sec 5.4"],"pci_pts":["B","F","L"],"fips_140":["FIPS 140-3 §7.5","FIPS 140-3 §7.10"],"cbest":[],"tiber_eu":[],"pci_hsm":["8"],"common_criteria":["CC Part 2 — FPT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.1","SYSC 13.7.4"],"fda_21_cfr_11":["§11.10(b)","§11.10(f)","§11.70"],"fda_cyber":["SA-3","ST-1"],"hitrust_csf":["09.c","11.c"],"iso_27799":[],"lloyds_ms":["MS8.4","MS8.10"],"naic_ds":["4B","5"],"nhs_dspt":[],"pra_ss1_23":["P3.2","P4.3"],"solvency_ii":["EIOPA-ICT-4.8","Pillar3-Reporting"],"owasp_masvs_v2":["MASVS-RESILIENCE-1","MASVS-RESILIENCE-2","MASVS-RESILIENCE-3","MASVS-RESILIENCE-4"],"csa_ccm_v4":["CCC-04","CCC-07"],"csa_aicm":["AIS-09","AIS-13","AIS-14","CCC-04","CCC-07","MDS-06","MDS-08"],"ccss_v9":["1.01.3","1.02.4"],"mica":["Art.88(1)"],"basel_sco60":["SCO60.11","SCO60.14","SCO60.21","SCO60.23","SCO60.51","SCO60.52","SCO60.65","SCO60.71"],"bssc":["NOS-02","TIS-05"],"sec_custody_digital":["SEC-CD-09","SEC-CD-13"],"dpdpa":["Act.8(5)","Rules.Sch1.B.7"],"nist_ai_rmf_1":["MAP 3.5","MANAGE 3.2"],"eu_ai_act":["Art.14(1)-(3)","Art.15(5)","Art.55(1)(d)"]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: nist_csf_2 ID.RA-09, PR.DS-01, PR.DS-02, PR.DS-10, PR.PS-02 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0. 2026-10-26: nerc_cip CIP-003-9, CIP-007-6, CIP-010-4, CIP-012-1, CIP-013-2 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"detective","used_by_patterns":["SP-001","SP-002","SP-016","SP-023","SP-025","SP-026","SP-028","SP-029","SP-031","SP-033","SP-034","SP-036","SP-039","SP-040","SP-041","SP-050","SP-052","SP-053"],"attack":{"techniques":207,"route":"/api/v1/controls/SI-07?fields=attack"}}}