[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-7":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-7","SI-7","Software, Firmware, and Information Integrity",273,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must use integrity verification tools to detect unauthorised changes to defined software, firmware and information, and take defined actions when such changes are found.\n\n**In practice.** This includes file integrity monitoring on critical servers, code signing and signature verification for software and updates, secure boot for firmware, and integrity checks in build and deployment pipelines. Auditors expect a list of what is monitored, tool configuration, alerts generated by unexpected changes and how they were handled. Supply chain frameworks such as SLSA address related integrity concerns for software builds.\n\n**Common gaps.** Integrity monitoring tools often produce so much noise from routine changes that alerts are ignored. Build pipelines and update mechanisms are frequently not covered, even though they are a known attack route.","a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined organization-defined software, firmware, and information] ; and\n  b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined organization-defined actions].\nDiscussion: Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input\u002FOutput System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":25,"title":26,"published_at":27},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",{"slug":29,"title":30,"published_at":31},"unpatched-collabora-rce-flaw-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora RCE Flaw Lets Attackers Backdoor Nextcloud Servers","2026-10-15T22:20:38.386+00:00",{"slug":33,"title":34,"published_at":35},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","2026-10-15T16:21:36.544+00:00",{"slug":37,"title":38,"published_at":39},"incomplete-patches-leave-backup-software-open-to-active-exploitation","Incomplete Patches Leave Backup Software Open to Active Exploitation","2026-10-15T10:21:36.587+00:00",{"slug":41,"title":42,"published_at":43},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",{"slug":45,"title":46,"published_at":47},"cisco-secure-email-gateway-flaw-exploited-in-the-wild-patch-immediately","Cisco Secure Email Gateway Flaw Exploited in the Wild — Patch Immediately","2026-10-15T08:20:47.7+00:00",{"slug":49,"title":50,"published_at":51},"olvx-cybercrime-marketplace-operator-charged-after-500k-in-stolen-data-sales","OLVX Cybercrime Marketplace Operator Charged After $500K in Stolen Data Sales","2026-10-14T22:20:20.643+00:00",{"slug":53,"title":54,"published_at":55},"unpatched-collabora-code-app-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora CODE App Lets Attackers Backdoor Nextcloud Servers","2026-10-14T20:20:54.985+00:00",{"slug":57,"title":58,"published_at":59},"npm-trusted-publishing-flaw-exposed-1500-packages-to-hijacking","npm Trusted Publishing Flaw Exposed 1,500+ Packages to Hijacking","2026-10-13T18:21:16.112+00:00",{"slug":61,"title":62,"published_at":63},"docker-hub-flaw-enabled-image-tampering-and-user-impersonation","Docker Hub Flaw Enabled Image Tampering and User Impersonation","2026-10-13T16:20:46.354+00:00",{"slug":65,"title":66,"published_at":67},"helpdesk-0-days-exploited-within-hours-as-ai-evading-malware-emerges","Helpdesk 0-Days Exploited Within Hours as AI-Evading Malware Emerges","2026-10-12T18:20:36.878+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",143,{"slug":75,"name":76,"problem":77,"stories":78},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",89,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",73,{"slug":85,"name":86,"problem":87,"stories":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",70,{"slug":90,"name":91,"problem":92,"stories":93},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",42,{"slug":95,"name":96,"problem":97,"stories":98},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",32,[100,106,112,118,123,128,133,138],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","2","Control 2","Inventory and Control of Software Assets",160,{"family":107,"item":108,"code":109,"title":110,"together":111},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",113,{"family":113,"item":114,"code":115,"title":116,"together":117},"gdpr","32","Article 32","Security of processing",111,{"family":119,"item":120,"code":121,"title":121,"together":122},"itil","overview","ITIL",106,{"family":101,"item":124,"code":125,"title":126,"together":127},"7","Control 7","Continuous Vulnerability Management",105,{"family":101,"item":129,"code":130,"title":131,"together":132},"16","Control 16","Application Software Security",93,{"family":101,"item":134,"code":135,"title":136,"together":137},"13","Control 13","Network Monitoring and Defense",71,{"family":101,"item":139,"code":140,"title":141,"together":142},"4","Control 4","Secure Configuration of Enterprise Assets and Software",58]