[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-7":3},{"item":4,"lessons":18,"controls":69,"related":100},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-7","SI-7","Software, Firmware, and Information Integrity",273,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must use integrity verification tools to detect unauthorised changes to defined software, firmware and information, and take defined actions when such changes are found.\n\n**In practice.** This includes file integrity monitoring on critical servers, code signing and signature verification for software and updates, secure boot for firmware, and integrity checks in build and deployment pipelines. Auditors expect a list of what is monitored, tool configuration, alerts generated by unexpected changes and how they were handled. Supply chain frameworks such as SLSA address related integrity concerns for software builds.\n\n**Common gaps.** Integrity monitoring tools often produce so much noise from routine changes that alerts are ignored. Build pipelines and update mechanisms are frequently not covered, even though they are a known attack route.","a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined organization-defined software, firmware, and information] ; and\n  b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined organization-defined actions].\nDiscussion: Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input\u002FOutput System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},282,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"compromised-update-server-grounds-german-military-drones","Compromised Update Server Grounds German Military Drones","2026-11-13T18:20:23.075+00:00",{"slug":26,"title":27,"published_at":28},"unauthenticated-ray-agent-enables-hidden-gpu-crypto-mining-via-rootkit","Unauthenticated Ray Agent Enables Hidden GPU Crypto Mining via Rootkit","2026-11-13T16:21:40.741+00:00",{"slug":30,"title":31,"published_at":32},"faulty-update-triggers-global-microsoft-outage-echoing-crowdstrike-incident","Faulty Update Triggers Global Microsoft Outage, Echoing CrowdStrike Incident","2026-11-13T14:20:22.59+00:00",{"slug":34,"title":35,"published_at":36},"endpoint-management-platforms-weaponized-against-the-enterprises-they-protect","Endpoint Management Platforms Weaponized Against the Enterprises They Protect","2026-11-12T16:22:00.568+00:00",{"slug":38,"title":39,"published_at":40},"gsocket-abused-for-persistent-linux-server-access-via-cron-systemd-and-kernel-exploits","GSocket Abused for Persistent Linux Server Access via Cron, systemd, and Kernel Exploits","2026-11-12T10:20:57.284+00:00",{"slug":42,"title":43,"published_at":44},"ebpf-rootkits-a-stealthy-new-threat-evading-traditional-linux-defenses","eBPF Rootkits: A Stealthy New Threat Evading Traditional Linux Defenses","2026-11-11T16:21:00.402+00:00",{"slug":46,"title":47,"published_at":48},"sleeper-agents-can-be-hidden-in-ai-models-by-editing-just-a-few-neurons","Sleeper Agents Can Be Hidden in AI Models by Editing Just a Few Neurons","2026-11-11T01:20:24.17+00:00",{"slug":50,"title":51,"published_at":52},"turlas-cereal-malware-silently-harvests-emails-from-exchange-servers","Turla's Cereal Malware Silently Harvests Emails from Exchange Servers","2026-11-10T14:21:42.016+00:00",{"slug":54,"title":55,"published_at":56},"hardware-wallet-implant-highlights-reseller-supply-chain-risk","Hardware Wallet Implant Highlights Reseller Supply Chain Risk","2026-10-30T16:20:28.963+00:00",{"slug":58,"title":59,"published_at":60},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":62,"title":63,"published_at":64},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",{"slug":66,"title":67,"published_at":68},"unpatched-collabora-rce-flaw-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora RCE Flaw Lets Attackers Backdoor Nextcloud Servers","2026-10-15T22:20:38.386+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",149,{"slug":76,"name":77,"problem":78,"stories":79},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",90,{"slug":81,"name":82,"problem":83,"stories":84},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",74,{"slug":86,"name":87,"problem":88,"stories":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",71,{"slug":91,"name":92,"problem":93,"stories":94},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",42,{"slug":96,"name":97,"problem":98,"stories":99},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",33,[101,107,113,119,124,129,134,139],{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","2","Control 2","Inventory and Control of Software Assets",161,{"family":108,"item":109,"code":110,"title":111,"together":112},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",113,{"family":114,"item":115,"code":116,"title":117,"together":118},"gdpr","32","Article 32","Security of processing",111,{"family":120,"item":121,"code":122,"title":122,"together":123},"itil","overview","ITIL",106,{"family":102,"item":125,"code":126,"title":127,"together":128},"7","Control 7","Continuous Vulnerability Management",105,{"family":102,"item":130,"code":131,"title":132,"together":133},"16","Control 16","Application Software Security",94,{"family":102,"item":135,"code":136,"title":137,"together":138},"13","Control 13","Network Monitoring and Defense",72,{"family":102,"item":140,"code":141,"title":142,"together":143},"4","Control 4","Secure Configuration of Enterprise Assets and Software",61]