SA-10 (1) - Software / Firmware Integrity Verification [FSv1.1]

This control is based on IBM Cloud Framework for Financial Services v1.1.

Control requirements

SA-10 (1) - 0: The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.

Implementation guidance

See the resources that follow to learn more about how to implement this control.

Development processes and software integrity

NIST supplemental guidance

This control enhancement allows organizations to detect unauthorized changes to software and firmware components through the use of tools, techniques, and/or mechanisms provided by developers. Integrity checking mechanisms can also address counterfeiting of software and firmware components. Organizations verify the integrity of software and firmware components, for example, through secure one-way hashes provided by developers. Delivered software and firmware components also include any updates to such components.