SI-7(6)

Requirement

Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

Discussion

Cryptographic mechanisms used to protect integrity include digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated documentation; records of detected unauthorized changes to software, firmware, and information; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for software, firmware, and/or information integrity; organizational personnel with information security responsibilities; system/network administrators; system developer].

Test

[SELECT FROM: Software, firmware, and information integrity verification tools; cryptographic mechanisms implementing software, firmware, and information integrity].

ID	Assessment Objectives
SI-07(06)[01]	cryptographic mechanisms are implemented to detect unauthorized changes to software;
SI-07(06)[02]	cryptographic mechanisms are implemented to detect unauthorized changes to firmware;
SI-07(06)[03]	cryptographic mechanisms are implemented to detect unauthorized changes to information.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!