Software, Firmware, and Information Integrity

frameworkNIST SP 800-53 Rev 5.2 sectionSI System and Information Integrity csf 2.0DE.CM-09 ID.RA-09 PR.DS-01 PR.DS-02 PR.DS-10 PR.PS-02 topicsData Protection frameworks7 4 0

Official texta. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined organization-defined software, firmware, and information]; and
b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined organization-defined actions].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SI-7 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.DS-01 PR.DS-02 PR.DS-10	The confidentiality, integrity, and availability of data-at-rest are protected; The confidentiality, integrity, and availability of data-in-transit are protected…	Crosswalk	Same topic: Data Protection 3 loosely related (not mappings) DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-09: related, not a mapping ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use Loosely related Only shares CSF ID.RA-09: related, not a mapping PR.PS-02 Software is maintained, replaced, and removed commensurate with risk Loosely related Only shares CSF PR.PS-02: related, not a mapping
ISO 27001	A.5.14 A.8.10 A.8.11	Information transfer; Information deletion…	Crosswalk	Same topic: Data Protection 37 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 29 more in the downloads
CIS v8.1	CIS 3.11 CIS 3.1 CIS 3.4 CIS 3.5 CIS 3.12	Encrypt Sensitive Data at Rest; Establish and Maintain a Data Management Process…	Crosswalk	Same topic: Data Protection 24 loosely related (not mappings) CIS 2.2 Ensure Authorized Software is Currently Supported Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.6 Encrypt Data on End-User Devices Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.9 Encrypt Data on Removable Media Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 9.1 Ensure Use of Only Fully Supported Browsers and Email Clients Loosely related Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping …and 16 more in the downloads
SOC 2	C1.2 CC6.5	Disposing of confidential information; Protection of data when assets are disposed of	Editorial	Same topic: Data Protection (editorial pick) 6 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF PR.PS-02: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-09: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF ID.RA-09: related, not a mapping
PCI DSS	3.2.1 3.3.1 3.4.1	Account data storage minimised, with retention and disposal; Sensitive authentication data not kept after authorisation…	Crosswalk	Same topic: Data Protection 32 loosely related (not mappings) 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.CM-09, ID.RA-09: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.DS-02: related, not a mapping 3.5.1 PAN rendered unreadable wherever stored Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 24 more in the downloads
CMMC	SC.L2-3.13.16 MP.L2-3.8.3	Data at Rest; Media Disposal	Crosswalk	Same topic: Data Protection 35 loosely related (not mappings) SI.L2-3.14.2 Malicious Code Protection Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.4 Update Malicious Code Protection Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 27 more in the downloads
HIPAA	§164.312(c)§164.310(d)(2)(i)§164.312(c)(2)§164.312(e)(2)(i)	Integrity; Disposal…	Crosswalk	Same topic: Data Protection NIST HIPAA → SP 800-53 crosswalk 26 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF ID.RA-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(iv) Encryption and Decryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(e)(2)(ii) Encryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-09, PR.DS-10: related, not a mapping …and 18 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Editorial	Same topic: Data Protection (editorial pick) 3 loosely related (not mappings) Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF ID.RA-09: related, not a mapping
NIS2	12.2 12.3	Handling of assets; Removable media policy	Crosswalk	Same topic: Data Protection 5 loosely related (not mappings) 6.6 Security patch management Loosely related Only shares CSF DE.CM-09, PR.PS-02: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF ID.RA-09: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF PR.PS-02: related, not a mapping
Essential Eight	ISM-1488 ISM-0109 ISM-0304 ISM-0843	Microsoft Office macros in files originating from the internet are blocked; Event logs from workstations are analysed in a timely manner to detect cyber security……	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.DS-02, PR.PS-02: related, not a mapping +35 more loosely related (not mappings) ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF PR.PS-02: related, not a mapping ISM-1490 Application control is implemented on internet-facing servers Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 31 more in the downloads
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)	Protection and prevention; Protection and prevention…	Editorial	Same topic: Data Protection (editorial pick) 9 loosely related (not mappings) Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.9(4)(f) Protection and prevention Loosely related Only shares CSF PR.PS-02: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF ID.RA-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF ID.RA-09: related, not a mapping …and 1 more in the downloads
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Data Protection (editorial pick) 2 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF ID.RA-09: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF ID.RA-09: related, not a mapping
Cyber Essentials	CE 3 CE 5	Security Update Management; Malware protection	Loosely related	No mapping. Only shares CSF PR.PS-02, DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.