SI-07 Software And Information Integrity
System and Information Integrity
Low Moderate High
Description
The information system detects and protects against unauthorized changes to software and information.
Supplemental Guidance
The organization employs integrity verification applications on the information system to look for evidence of information tampering, errors, and omissions. The organization employs good software engineering practices with regard to commercial off-the-shelf integrity mechanisms (e.g., parity checks, cyclical redundancy checks, cryptographic hashes) and uses tools to automatically monitor the integrity of the information system and the applications it hosts.
Changes from Rev 4
Control text adds requirement to take actions when unauthorized changes are detected Parameter added for specifying organization-defined actions Discussion includes additional examples
MITRE ATT&CK Techniques (209)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.
Initial Access 6 Execution 22 Persistence 59 Privilege Escalation 41 Defense Evasion 94 Credential Access 21 Discovery 1 Lateral Movement 5 Collection 19 Command & Control 1 Exfiltration 1 Impact 15
Show all 209 techniques grouped by tactic
Initial Access
Execution
T1047 Windows Management Instrumentation T1059 Command and Scripting Interpreter T1072 Software Deployment Tools T1129 Shared Modules T1203 Exploitation for Client Execution T1204 User Execution T1569 System Services T1609 Container Administration Command T1053.006 Systemd Timers T1059.001 PowerShell T1059.002 AppleScript T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1059.008 Network Device CLI T1059.010 AutoHotKey & AutoIT T1059.011 Lua T1204.002 Malicious File T1204.003 Malicious Image T1569.002 Service Execution
Persistence
T1037 Boot or Logon Initialization Scripts T1133 External Remote Services T1136 Create Account T1176 Browser Extensions T1505 Server Software Component T1525 Implant Internal Image T1542 Pre-OS Boot T1543 Create or Modify System Process T1546 Event Triggered Execution T1554 Compromise Host Software Binary T1556 Modify Authentication Process T1574 Hijack Execution Flow T1037.002 Login Hook T1037.003 Network Logon Script T1037.004 RC Scripts T1037.005 Startup Items T1053.006 Systemd Timers T1098.001 Additional Cloud Credentials T1098.002 Additional Email Delegate Permissions T1098.003 Additional Cloud Roles T1136.001 Local Account T1136.002 Domain Account T1136.003 Cloud Account T1505.001 SQL Stored Procedures T1505.002 Transport Agent T1505.004 IIS Components T1542.001 System Firmware T1542.003 Bootkit T1542.004 ROMMONkit T1542.005 TFTP Boot T1543.002 Systemd Service T1546.002 Screensaver T1546.004 Unix Shell Configuration Modification T1546.006 LC_LOAD_DYLIB Addition T1546.008 Accessibility Features T1546.009 AppCert DLLs T1546.010 AppInit DLLs T1546.013 PowerShell Profile T1547.002 Authentication Package T1547.003 Time Providers T1547.004 Winlogon Helper DLL T1547.005 Security Support Provider T1547.006 Kernel Modules and Extensions T1547.008 LSASS Driver T1547.013 XDG Autostart Entries T1556.001 Domain Controller Authentication T1556.003 Pluggable Authentication Modules T1556.004 Network Device Authentication T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1574.001 DLL Search Order Hijacking T1574.004 Dylib Hijacking T1574.006 Dynamic Linker Hijacking T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.012 COR_PROFILER T1574.013 KernelCallbackTable T1574.014 AppDomainManager
Privilege Escalation
T1037 Boot or Logon Initialization Scripts T1068 Exploitation for Privilege Escalation T1543 Create or Modify System Process T1546 Event Triggered Execution T1548 Abuse Elevation Control Mechanism T1574 Hijack Execution Flow T1611 Escape to Host T1037.002 Login Hook T1037.003 Network Logon Script T1037.004 RC Scripts T1037.005 Startup Items T1053.006 Systemd Timers T1098.001 Additional Cloud Credentials T1098.002 Additional Email Delegate Permissions T1098.003 Additional Cloud Roles T1543.002 Systemd Service T1546.002 Screensaver T1546.004 Unix Shell Configuration Modification T1546.006 LC_LOAD_DYLIB Addition T1546.008 Accessibility Features T1546.009 AppCert DLLs T1546.010 AppInit DLLs T1546.013 PowerShell Profile T1547.002 Authentication Package T1547.003 Time Providers T1547.004 Winlogon Helper DLL T1547.005 Security Support Provider T1547.006 Kernel Modules and Extensions T1547.008 LSASS Driver T1547.013 XDG Autostart Entries T1548.004 Elevated Execution with Prompt T1548.006 TCC Manipulation T1574.001 DLL Search Order Hijacking T1574.004 Dylib Hijacking T1574.006 Dynamic Linker Hijacking T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.012 COR_PROFILER T1574.013 KernelCallbackTable T1574.014 AppDomainManager
Defense Evasion
T1027 Obfuscated Files or Information T1036 Masquerading T1070 Indicator Removal T1112 Modify Registry T1127 Trusted Developer Utilities Proxy Execution T1211 Exploitation for Defense Evasion T1216 System Script Proxy Execution T1218 System Binary Proxy Execution T1220 XSL Script Processing T1221 Template Injection T1222 File and Directory Permissions Modification T1542 Pre-OS Boot T1548 Abuse Elevation Control Mechanism T1553 Subvert Trust Controls T1556 Modify Authentication Process T1562 Impair Defenses T1574 Hijack Execution Flow T1599 Network Boundary Bridging T1601 Modify System Image T1647 Plist File Modification T1027.002 Software Packing T1027.007 Dynamic API Resolution T1027.008 Stripped Payloads T1027.009 Embedded Payloads T1036.001 Invalid Code Signature T1036.005 Match Legitimate Name or Location T1070.001 Clear Windows Event Logs T1070.002 Clear Linux or Mac System Logs T1070.003 Clear Command History T1070.007 Clear Network Connection History and Configurations T1070.008 Clear Mailbox Data T1070.009 Clear Persistence T1070.010 Relocate Malware T1127.002 ClickOnce T1216.001 PubPrn T1216.002 SyncAppvPublishingServer T1218.001 Compiled HTML File T1218.002 Control Panel T1218.003 CMSTP T1218.004 InstallUtil T1218.005 Mshta T1218.008 Odbcconf T1218.009 Regsvcs/Regasm T1218.010 Regsvr32 T1218.011 Rundll32 T1218.012 Verclsid T1218.013 Mavinject T1218.014 MMC T1218.015 Electron Applications T1222.001 Windows File and Directory Permissions Modification T1222.002 Linux and Mac File and Directory Permissions Modification T1542.001 System Firmware T1542.003 Bootkit T1542.004 ROMMONkit T1542.005 TFTP Boot T1548.004 Elevated Execution with Prompt T1548.006 TCC Manipulation T1550.001 Application Access Token T1550.004 Web Session Cookie T1553.001 Gatekeeper Bypass T1553.003 SIP and Trust Provider Hijacking T1553.005 Mark-of-the-Web Bypass T1553.006 Code Signing Policy Modification T1556.001 Domain Controller Authentication T1556.003 Pluggable Authentication Modules T1556.004 Network Device Authentication T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1562.001 Disable or Modify Tools T1562.002 Disable Windows Event Logging T1562.004 Disable or Modify System Firewall T1562.006 Indicator Blocking T1562.009 Safe Mode Boot T1562.010 Downgrade Attack T1562.011 Spoof Security Alerting T1562.012 Disable or Modify Linux Audit System T1564.003 Hidden Window T1564.004 NTFS File Attributes T1564.006 Run Virtual Instance T1564.008 Email Hiding Rules T1564.009 Resource Forking T1564.010 Process Argument Spoofing T1574.001 DLL Search Order Hijacking T1574.004 Dylib Hijacking T1574.006 Dynamic Linker Hijacking T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.012 COR_PROFILER T1574.013 KernelCallbackTable T1574.014 AppDomainManager T1599.001 Network Address Translation Traversal T1601.001 Patch System Image T1601.002 Downgrade System Image
Credential Access
T1003 OS Credential Dumping T1040 Network Sniffing T1212 Exploitation for Credential Access T1552 Unsecured Credentials T1556 Modify Authentication Process T1557 Adversary-in-the-Middle T1558 Steal or Forge Kerberos Tickets T1003.003 NTDS T1056.002 GUI Input Capture T1552.004 Private Keys T1556.001 Domain Controller Authentication T1556.003 Pluggable Authentication Modules T1556.004 Network Device Authentication T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1557.002 ARP Cache Poisoning T1557.004 Evil Twin T1558.002 Silver Ticket T1558.003 Kerberoasting T1558.004 AS-REP Roasting T1558.005 Ccache Files
Discovery
Lateral Movement
Collection
T1114 Email Collection T1119 Automated Collection T1185 Browser Session Hijacking T1213 Data from Information Repositories T1530 Data from Cloud Storage T1557 Adversary-in-the-Middle T1602 Data from Configuration Repository T1056.002 GUI Input Capture T1114.001 Local Email Collection T1114.002 Remote Email Collection T1114.003 Email Forwarding Rule T1213.001 Confluence T1213.002 Sharepoint T1213.004 Customer Relationship Management Software T1213.005 Messaging Applications T1557.002 ARP Cache Poisoning T1557.004 Evil Twin T1602.001 SNMP (MIB Dump) T1602.002 Network Device Configuration Dump
Command & Control
Exfiltration
Impact
T1485 Data Destruction T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1491 Defacement T1495 Firmware Corruption T1561 Disk Wipe T1565 Data Manipulation T1485.001 Lifecycle-Triggered Deletion T1491.001 Internal Defacement T1491.002 External Defacement T1561.001 Disk Content Wipe T1561.002 Disk Structure Wipe T1565.001 Stored Data Manipulation T1565.002 Transmitted Data Manipulation T1565.003 Runtime Data Manipulation
Compliance Mappings
CIS Controls v8
CIS 13.2CIS 13.7
NIST CSF 2.0
DE.CM-09RC.RP-03RC.RP-05
SOC 2 TSC
CC6.6CC6.6-POF2CC6.8
PCI DSS v4.0.1
11.511.6
CSA CCM v4
CCC-04CCC-07
CSA AICM v1
AIS-09AIS-13AIS-14CCC-04CCC-07MDS-06MDS-08
ISO 42001:2023
A.6.2.4A.6.2.6
IEC 62443
3-3 SR 3.13-3 SR 3.4
APRA CPS 234
Para 22-23
ASD Essential Eight
E8-3 ML3
ANSSI
Hygiene.20Hygiene.34SecNumCloud.13.6
FINMA Circular 2023/1
IV.B.d(59)IV.C(64)IV.D(78)
OSFI B-13
B-13.3.2B-13.3.3
EU GDPR
Art.32(1)(b)Art.5(1)(d)Art.5(1)(f)
EU DORA
Art.9(4)(b)Art.9(4)(e)
RBI CSF
Annex1.5Annex1.13
FISC Security Guidelines
FISC.T12FISC.T14FISC.T7
LGPD + BCB 4893
BCB.Art.3LGPD.Art.46
HKMA TM-E-1
TME1.10.2TME1.4.3TME1.7.3
MLPS 2.0
8.1.2.38.1.3.68.1.4.48.1.4.68.1.4.7
EU CRA
CRA.I.2bCRA.I.2cCRA.I.2fCRA.II.7
SWIFT CSCF
SWIFT.6.2SWIFT.6.3
SAMA CSF
3.3
NCA ECC
2-35-1
UAE IA
T7
Qatar NIA
OS
CBUAE
CR-7
CBE CSF
CTO-7
SA JS2
JS2-7.2JS2-8.4JS2-8.5
CBN CSF
Part3.3
BoG CISD
CISD-VI
POPIA
s16s19
BoM CTRM
3.6
IOSCO Cyber Resilience
PROT-3PROT-6RR-3TEST-5
BCBS 239
Principle 3Principle 7
CPMI-IOSCO PFMI
CG.DECG.PRPFMI.P17
FFIEC IS
II.C.12III.B
NYDFS 500
500.8
HIPAA Security Rule
§164.312(c)(1)§164.312(c)(2)§164.312(e)(2)(i)
ECB CROE
CROE.2.3.3CROE.2.4
EBA ICT Guidelines
3.4.4
SEBI CSCRF
PR.ESPR.IP
BOT Cyber Resilience
Ch2.6Ch9.1
CMMC 2.0
SI
10 CFR 73.54
RG5.71-A-SI
IEEE 1686-2022
5.3
API 1164
Sec 7
IAEA NSS 17-T
Sec 5.4
PCI PTS v6
BFL
FIPS 140-3
FIPS 140-3 §7.10FIPS 140-3 §7.5
PCI HSM
8
Common Criteria
CC Part 2 — FPT
ISAE 3402
Clause 4
Solvency II
EIOPA-ICT-4.8Pillar3-Reporting
Lloyd's Minimum Standards
MS8.10MS8.4
NAIC Insurance Data Security
4B5
PRA SS1/23
P3.2P4.3
FCA SYSC 13
SYSC 13.7.1SYSC 13.7.4
HITRUST CSF v11
09.c11.c
FDA 21 CFR Part 11
§11.10(b)§11.10(f)§11.70
FDA Cybersecurity Guidance
SA-3ST-1
OWASP MASVS v2.1
MASVS-RESILIENCE-1MASVS-RESILIENCE-2MASVS-RESILIENCE-3MASVS-RESILIENCE-4
CCSS v9.0
1.01.31.02.4
MiCA
Art.88(1)
Basel SCO60
SCO60.11SCO60.14SCO60.21SCO60.23SCO60.51SCO60.52SCO60.65SCO60.71
BSSC Standards
NOS-02TIS-05
SEC Custody (Digital Assets)
SEC-CD-09SEC-CD-13
ISO 17799 (legacy)
12.2.112.2.212.2.4
COBIT 4.1 (legacy)
PO2.4AI2.4DS5.9