What it asks for. The organisation must use integrity verification tools to detect unauthorised changes to defined software, firmware and information, and take defined actions when such changes are found.
In practice. This includes file integrity monitoring on critical servers, code signing and signature verification for software and updates, secure boot for firmware, and integrity checks in build and deployment pipelines. Auditors expect a list of what is monitored, tool configuration, alerts generated by unexpected changes and how they were handled. Supply chain frameworks such as SLSA address related integrity concerns for software builds.
Common gaps. Integrity monitoring tools often produce so much noise from routine changes that alerts are ignored. Build pipelines and update mechanisms are frequently not covered, even though they are a known attack route.