>myctrl.tools
Preferences
Under active development — Content is continuously updated and improved
Compare

SI-7 (01)—Software, Firmware, and Information Integrity | Integrity Checks

Moderate
High

>Control Description

Perform an integrity check of ⚙organization-defined software, firmware, and information [Selection (one or more): at startup; at ⚙organization-defined transitional states or security-relevant events; ⚙organization-defined frequency].

>FedRAMP Baseline Requirements

No FedRAMP-specific parameter values or requirements for this baseline.

>Discussion

Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of new hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort.

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What policies and procedures govern integrity checks?
  • •Who is responsible for monitoring system and information integrity?
  • •How frequently are integrity monitoring processes reviewed and updated?

Technical Implementation:

  • •What technical controls detect and respond to integrity checks issues?
  • •How are integrity violations identified and reported?
  • •What automated tools support system and information integrity monitoring?

Evidence & Documentation:

  • •Can you provide recent integrity monitoring reports or alerts?
  • •What logs demonstrate that SI-7(1) is actively implemented?
  • •Where is evidence of integrity monitoring maintained and for how long?

Ask AI

Configure your API key to use AI features.