SI-7 Software, firmware, and information integrity
Requires integrity verification tools to be employed to detect unauthorized changes to organization-defined software, firmware and information, and requires organization-defined actions to be taken when such unauthorized
system holds itEvidence a system already holds
- Integrity monitoring tool configuration and coverage report · SIEM / log platform
- Alerts generated by integrity checks and the response records · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Defined list of software, firmware and information subject to integrity verification · Document repository
- Documented actions to be taken on detection of unauthorized change · Document repository
First move
Common gaps auditors find
- Integrity monitoring produces constant noise from routine change and is therefore ignored
- Firmware excluded because tooling only covers the operating system layer
- No defined response, so detections are acknowledged and closed without investigation
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSI-6 Security and Privacy Function Verification. Verify the correct operation of [organization-defined]; Perform the verification of the functions specified in SI-6a [organization-defined]; Alert [organization-defined] to failed security and privacy verification tests; and [organization-defined] when anomalies · SI-8 Spam Protection. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and Update spam protection mechanisms when new releases are available in accordance with organizational configuration