# SI-7 — Software, Firmware, and Information Integrity

- **Control ID:** SI-7
- **Family:** [SI](/md/families/SI.md)
- **Baselines:** moderate, high
- **Enhancement of:** No content available.

## Description

Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: \[assignment\] ; and Take the following actions when unauthorized changes to the software, firmware, and information are detected: \[assignment\].

## Discussion

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [DE.CM-09](/md/csf/DE.CM-09.md) — DE.CM-09
- [ID.RA-09](/md/csf/ID.RA-09.md) — The authenticity and integrity of hardware and software are assessed prior to acquisition and use
- [PR.DS-01](/md/csf/PR.DS-01.md) — The confidentiality, integrity, and availability of data-at-rest are protected
- [PR.DS-02](/md/csf/PR.DS-02.md) — The confidentiality, integrity, and availability of data-in-transit are protected
- [PR.DS-10](/md/csf/PR.DS-10.md) — PR.DS-10
- [PR.PS-02](/md/csf/PR.PS-02.md) — PR.PS-02

## Related controls

- [AC-4](/md/controls/AC-4.md)
- [CM-3](/md/controls/CM-3.md)
- [CM-7](/md/controls/CM-7.md)
- [CM-8](/md/controls/CM-8.md)
- [MA-3](/md/controls/MA-3.md)
- [MA-4](/md/controls/MA-4.md)
- [RA-5](/md/controls/RA-5.md)
- [SA-8](/md/controls/SA-8.md)
- [SA-9](/md/controls/SA-9.md)
- [SA-10](/md/controls/SA-10.md)
- [SC-8](/md/controls/SC-8.md)
- [SC-12](/md/controls/SC-12.md)
- [SC-13](/md/controls/SC-13.md)
- [SC-28](/md/controls/SC-28.md)
- [SC-37](/md/controls/SC-37.md)
- [SI-3](/md/controls/SI-3.md)
- [SR-3](/md/controls/SR-3.md)
- [SR-4](/md/controls/SR-4.md)
- [SR-5](/md/controls/SR-5.md)
- [SR-6](/md/controls/SR-6.md)
- [SR-9](/md/controls/SR-9.md)
- [SR-10](/md/controls/SR-10.md)
- [SR-11](/md/controls/SR-11.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.