SI-07 Software, Firmware, and Information Integrity

Self-assessed, not audited

We hold no certification or authorization. The status below is our own assessment, kept as OSCAL in Git; it is not an auditor's finding. "Planned" means not built.

Control statement

• a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and

• b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].

Guidance

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.

Implementation

Flux GitOps

Integrity of what Flux applies: the FluxInstance sync does not verify commit signatures or OCI artifact signatures (no verify block). Planned.

Status: planned.

Evidence:

• https://github.com/zeta-reticuli-inc/talos-platform/blob/main/clusters/proxmox/flux-system/flux-instance.yaml

Talos node

Boot integrity: Secure Boot UKI signed by Sidero Labs, immutable read-only SquashFS root; TPM enrolment fails if Secure Boot is off. Partial: no remote attestation of PCR values yet, and the lab swtpm makes measurements only as trustworthy as the host.

Status: partial.

Evidence:

• Lula validation si-7-talos-secure-boot
• https://github.com/zeta-reticuli-inc/talos-multicloud/blob/main/talos/schematic.yaml
• Manual check: talosctl -n <node> get securitystate -o yaml (secureBootState: true)

Signed agent task records

Integrity of task outputs: verification fails if any byte of a subject or the predicate changes. Partial: example only, not produced by the running agent.

Status: partial.

Evidence:

• https://github.com/zeta-reticuli-inc/agents/blob/main/evidence/README.md

All controls. Source: OSCAL component definition reti-platform and NIST SP 800-53 Rev 5 (public domain).