Integrity Monitoring
What is Integrity Monitoring?
Continuous surveillance of systems and data to detect unauthorized modifications, ensuring that information and configurations remain in their authorized state.
Terms that appear alongside integrity monitoring
Each of these is named in at least one of the same controls as integrity monitoring. The number is how many controls name both.
- integrity 21 shared controls
- file integrity monitoring 8 shared controls
- audit 7 shared controls
- nist 6 shared controls
- attestation 4 shared controls
- baseline 4 shared controls
- cybersecurity 4 shared controls
- compliance 4 shared controls
Frameworks that govern integrity monitoring
What the standards actually require on integrity monitoring
Requirements naming integrity monitoring across 6 standards, quoted from the control text.
Audit logs must be covered by file integrity monitoring or by change-detection tooling so that existing log data cannot be altered without an alert being raised. Applies to all entities.
10.3.4 · 10.3.4 File integrity monitoring on audit logs →Security Dimension 6 Data Integrity per X.805 Clause 6.6: Data Integrity keeps data correct and accurate. Data are shielded from being altered, deleted, created or copied without authorization, and any such unauthorized activity is made detectable.
X805-Dim6-Data-Integrity-Correctness-Accuracy-Unauthorized-Modification-Deletion-Detection · ITU-T X.805 Security Dimension 6 - Data Integrity + Correctness + Accuracy + Unauthorized Modification Prevention + Deletion Detection + Hashing + HMAC + Digital Signatures + Merkle Trees + Blockchain Integrity + File Integrity Monitoring (FIM) →Monitor the integrity of DER device settings, control logic, and configuration files to detect unauthorized changes.
DER-DE-03 · Integrity Monitoring of DER Settings →Enforcement checks that security configurations match the baseline. Level 1: checks performed regularly. Level 2 (a and b): checks at least weekly and file-integrity monitoring that compares and alerts on unauthorised changes to critical systems, configuration...
mtcs-singapore::14.10 · Enforcement checks →When using a software-based isolation mechanism to share a physical server's hardware, integrity monitoring and centralised event logging is performed for the isolation mechanism and underlying operating system.
ISM-1607 · Monitoring and logging isolation mechanisms →Detect and respond to unauthorized configuration changes through file integrity monitoring, registry monitoring, change correlation with approved tickets, and alerting on deviations not tied to an approved change record.
SecCM-MONITOR-5 · Unauthorized Change Detection →Questions people ask about integrity monitoring
What is Integrity Monitoring?
Why is Integrity Monitoring important for compliance?
Which compliance frameworks address Integrity Monitoring?
Where can I learn more about Integrity Monitoring?
See how Integrity Monitoring applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.