Software, Firmware, and Information Integrity SI-7

System and Information Integrity · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SI-7 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Information Integrity family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SI-7 (Software, Firmware, and Information Integrity) is about catching unauthorized changes to the files that matter — system binaries, configuration, and key data. You run integrity-verification tools that take a trusted baseline and then flag anything that changes without permission, and you decide what to do when they alert. It is a technical control in the Moderate baseline.

What good looks like

Choose an integrity-verification tool — on Linux, AIDE (Advanced Intrusion Detection Environment) or Tripwire builds a baseline of file hashes.
Cover the files that matter: system binaries, /etc configuration, boot files, and any sensitive data stores.
Store the baseline safely — ideally read-only or off the host — so an attacker cannot quietly rewrite it too.
Run checks on a schedule and compare against the baseline to surface added, changed, or removed files.
Decide the response when a real change is flagged: investigate, restore from a known-good copy, and re-baseline only after you trust the change.

Framework mapping

NIST CSF 2.0 — DE.CM-09 — Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
CIS Controls v8 — Control 2 — Inventory and Control of Software Assets

How to move it toward Implemented

Install AIDE and build the first baseline (aideinit, then move aide.db.new into place as aide.db), keeping a copy of that database off the host.
Schedule a daily check (aide --check) via cron so changes are reported, and confirm package files are intact with debsums -c or dpkg --verify.
Run a check by hand, make one small authorized change, and confirm AIDE flags it — then save the dated report.
Attach that AIDE report as hardening evidence on the asset, naming SI-7 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.