NIST file integrity monitoring
Know when a critical file changes, and show who checked it.
NIST CSF 2.0 asks you to monitor your software and data for adverse events, and SP 800-53 SI-7 asks for a tool that detects unauthorized changes. Alertica does both from outside your servers, alerts the people you choose, and records who reviewed each alert and why. There's a free plan that never expires.
- Agentless, nothing to install
- Maps to CSF 2.0 and SI-7
Who it's for
Small IT teams that follow NIST and need to show it, without running a security platform.
Built for
- US companies that use NIST CSF 2.0 as their framework, for customers, insurers or the board
- Teams mapping to SP 800-53 for a customer or a contract
- Linux and Unix servers, file exchanges and backup targets reachable over SFTP
What Alertica covers in NIST
Five CSF 2.0 outcomes and SI-7 with two of its enhancements. Where a control needs more than a file monitor, the last column says what.
| Control | What it asks | What Alertica does | What you still do |
|---|---|---|---|
| DE.CM-09 Monitor software and data | Monitor hardware, software, runtime environments and their data to find potentially adverse events. | Watches the files and folders you choose and alerts on changes, new files, deletions and files that never arrive. | Monitor networks and logins too (DE.CM-01, DE.CM-03). |
| PR.DS-01 Data at rest | Protect the integrity of data at rest. NIST's example is cryptographic hashes. | Compares a SHA-256 fingerprint of each watched file on every scan. | Encrypt the data and control who can reach it. |
| PR.PS-01 Configuration management | Apply configuration management. NIST's example is monitoring software for deviations from approved baselines. | Alerts when a config file changes, so drift from your baseline shows up the next scan. | Set and approve the baseline. |
| DE.AE-02 Analyze events | Analyze potentially adverse events to understand what happened. | Each alert is acknowledged with who, when and a required note saying what they found. | Do the analysis, and escalate what needs it. |
| PR.DS-11 Backups | Create, protect, maintain and test backups. | Alerts when the nightly backup doesn't arrive, shrinks sharply, or changes once stored. | Test restores. NIST's example is at least once a year. |
| SI-7 Integrity verification | Use integrity verification tools to detect unauthorized changes to software and information, and act on them. | Detects added, deleted and changed files across the scope you set, contents included. | Define the actions to take, and take them. |
| SI-7(1) Integrity checks | Run integrity checks at startup, at defined events, or at a defined frequency. | Runs on a schedule, daily on Pro and hourly on Enterprise. | Set the frequency in your system security plan. |
| SI-7(2) Automated notifications | Notify named people automatically when an integrity check finds a discrepancy. | Emails or texts the people on the rule. Each alert keeps who it went to. | Keep the contact list current. |
What your auditor sees
Auditors test a period, not a day. They pick dates and ask what happened on each one. Alertica keeps the answer for every date.
-
Every alert, with who reviewed it
Each alert is acknowledged with a name, a time and a required note. That note is your record for DE.AE-02 and the action SI-7 asks you to take.
-
Twelve months of history
Pro keeps a year of alerts and scans, so any date your auditor picks has its record.
-
Proof it ran every week
Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. It shows the frequency you set for SI-7(1) held, week by week.
-
Audit-ready evidence in one download
Pick the audit period and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter.
Why from outside the server
-
Nothing to install
No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.
-
Nothing to switch off
An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.
-
Only fingerprints leave
Alertica works out a fingerprint of each file on your server. File contents never leave it.
-
One console for every server
Every server's rules and alerts in one place, with nothing on each host to keep updated.
Live in three steps
-
Connect a server
Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.
-
Set your rules
Pick a folder and say what matters. We set up the rules to match SI-7 with you on Pro.
-
Choose who hears about it
Add the people who should get alerts, by email, SMS or Slack. Each one is kept for your auditor.
Questions about NIST
What Alertica covers in CSF 2.0 and SP 800-53.
-
Does Alertica make us NIST compliant?
NIST CSF describes outcomes and, in NIST's words, "does not prescribe how outcomes should be achieved". Alertica supports the outcomes in the table. For SP 800-53 it covers SI-7 and its enhancements 1 and 2 on the files you choose.
-
Is Alertica FedRAMP authorized?
No. If your system needs a FedRAMP-authorized cloud service, Alertica can't be part of it.
-
What does Alertica record for each change?
What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.
-
Do you copy our files?
No. Alertica works out a fingerprint of each file on your server and reads back only that, with the file's name, size and date. File contents never leave the server.
-
How often does Alertica check?
Weekly on Free, daily on Pro and hourly on Enterprise. Each scan is kept in history, so the frequency you set is on record.
Set up SI-7 with our team
Tell us what your framework asks for. We'll set up the rules to match it with you and go through the first scan together.