SI-7(12)

Requirement

Require that the integrity of the following user-installed software be verified prior to execution: [Assignment: organization-defined user-installed software].

Discussion

Organizations verify the integrity of user-installed software prior to execution to reduce the likelihood of executing malicious code or programs that contains errors from unauthorized modifications. Organizations consider the practicality of approaches to verifying software integrity, including the availability of trustworthy checksums from software developers and vendors.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity; system design documentation; system configuration settings and associated documentation; integrity verification records; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for software, firmware, and/or information integrity; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Software, firmware, and information integrity verification tools; mechanisms supporting and/or implementing verification of the integrity of user-installed software prior to execution].

ID	Assessment Objectives
SI-07(12)	the integrity of <SI-07(12)_ODP user-installed software> is verified prior to execution.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!