home/glossary/system integrity check

system integrity check

nounid 163587·updated Sep 1, 2026
verified

A periodic or on-demand security verification process that examines a computing system's files, configurations, software, and runtime state against a known-good trusted baseline to confirm that no unauthorized or undetected alterations have occurred. It detects unauthorized changes — such as those caused by malware, intrusions, or misconfiguration — by comparing current values against known-good reference values, usually cryptographic hashes. Mechanically, this typically involves hashing executables, scripts, libraries, and other critical artifacts and checking them against a stored baseline, so that replacement by a malicious file causes an immediate failure. In practice, it supports incident detection and forensic investigation and demonstrates compliance with frameworks such as PCI DSS, which explicitly requires file integrity monitoring on critical systems.

MWE

Source

document
NIST SP 800-171 Rev 3 - Protecting CUI in Nonfederal Systems
found in
proposed during MWE review
element
e0214
proposed by
dorianc@moxywolf.com
discovery
ManualCuration
system integritythe sentence this term was read in
Where the definition came fromawaiting curator confirmation

generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.

A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.

A web lookup ran when this term was proposed

A security verification process that evaluates whether a computing system's components — including OS files, application binaries, configurations, and firmware — remain unaltered from a known-good baseline, typically by comparing cryptographic hashes of current states against reference values. The underlying property being tested is whether a system performs its intended function in an unimpaired manner, free from unauthorized manipulation, whether intentional or accidental. In practice, integrity checking exposes changes that signature-based antivirus might miss and supports incident detection, forensic investigation, and compliance demonstrations with frameworks such as PCI DSS, which explicitly requires file integrity monitoring on critical systems. Implementations range from automated tools that hash executables and libraries at startup and compare them against a baseline, to continuous monitoring systems that alert when any component is replaced — for example, by a malicious executable — causing an immediate integrity-check failure.

Advisory only. A term this product ships is defined by an authority document, not by a search result.

Proposed during multiword review of this document in the CKI mapping queue.

Attested in

NIST SP 800-171 Rev 3 - Protecting CUI in Nonfederal Systems1 citation · 1 confirmed by a reviewer · observed 2026-09-01 under anchor/0.9/36451/2026-09-01
03.01.07.b ¶ 1

Classifications

Entity Type

Process92%llm-generatedllm:claude-haiku-4-5

Sensitivity

Regulated88%manual reviewr:sens.regulated.framework.v1

Information Class

unclassified

Variants

plural
system integrity checks
possessive
system integrity check's
pluralpossessive
system integrity checks'

Framework definitions

NIST SP 800-171r31 senseview framework →
§1 · attested_usage_reviewer_confirmed
No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.
Increment 2: attested in 800-171r3 without a glossary definition.
Legacy lexicon import1 senseview framework →
§1 · web_lookup_draft
A periodic or on-demand security verification process that examines a computing system's files, configurations, software, and runtime state against a known-good trusted baseline to confirm that no unauthorized or undetected alterations have occurred. It detects unauthorized changes — such as those caused by malware, intrusions, or misconfiguration — by comparing current values against known-good reference values, usually cryptographic hashes. Mechanically, this typically involves hashing executables, scripts, libraries, and other critical artifacts and checking them against a stored baseline, so that replacement by a malicious file causes an immediate failure. In practice, it supports incident detection and forensic investigation and demonstrates compliance with frameworks such as PCI DSS, which explicitly requires file integrity monitoring on critical systems.
DR-088 backfill from the noun definition column

Outgoing relationships

No outgoing triples
This term is not the subject of any RDF-style relationship yet.

Incoming relationships

No incoming triples
No other term currently asserts a relationship to this one.