---
name: framework-financial-services-controls-si-7
title: SI-7 - Software, Firmware, and Information Integrity
description: 'Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: _[Assignment: organization-defined software, firmware, and information]_.'
last-updated: 2025-02-26
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services-controls?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# SI-7 - Software, Firmware, and Information Integrity
{: #si-7}

## Control requirements
{: #control-requirements}



### SI-7 (a)


Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: _[Assignment: organization-defined software, firmware, and information]_.


### SI-7 (b)


Take the following actions when unauthorized changes to the software, firmware, and information are detected: _[Assignment: organization-defined actions]_.









## Implementation guidance
{: #implementation-guidance}

See the resources that follow to learn more about how to implement this control.


- [Development processes and software integrity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-development-processes&format=markdown)






## NIST supplemental guidance
{: #nist-supplemental-guidance}

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.