id: "SI-07(12)" title: "Integrity Verification" family: "SI" family_name: "System and Information Integrity" sort_id: "si-07.12" priority: "P1" implementation_level: "system" parent: "SI-07" enhancement: True
Statement
Require that the integrity of the following user-installed software be verified prior to execution: {{ insert: param, si-07.12_odp }}.
Guidance
Organizations verify the integrity of user-installed software prior to execution to reduce the likelihood of executing malicious code or programs that contains errors from unauthorized modifications. Organizations consider the source of the software, ensuring the software and updates come from authorized sources and/or sites, and the practicality of approaches to verifying software integrity, including the availability of trustworthy checksums from software developers and vendors.
Assessment Objective
the integrity of {{ insert: param, si-07.12_odp }} is verified prior to execution.
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
integrity verification records
system audit records
system security plan
other relevant documents or records
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
Software, firmware, and information integrity verification tools
mechanisms supporting and/or implementing verification of the integrity of user-installed software prior to execution