# Integrity

**In short:** Integrity means a system protects its state and data from unauthorized modification or deletion. It is one of several security sub-characteristics in ISO/IEC 25010, alongside confidentiality, non-repudiation, accountability and authenticity.

## Explanation

Integrity is a security sub-characteristic in the ISO/IEC 25010 quality model (see ISO/IEC 25010 Product Quality Model). It says the system's state and data must be protected from unauthorized modification or deletion.

Integrity sits next to other security sub-characteristics. Each answers a different question:

- **Confidentiality:** can only authorized parties access the data? Confidentiality is about access. Integrity is about changes and deletion.
- **Non-repudiation:** can we prove that an action or event took place? See Nonrepudiation.
- **Accountability:** can we trace an entity's actions uniquely back to that entity? See Accountability.
- **Authenticity:** can we prove that a subject or resource has the identity it claims? See Authenticity.

Detection is part of the picture too. NIST SP 800-53 control SI-7, in the system and information integrity family, requires integrity verification tools. These tools detect unauthorized changes to software, firmware and information. So a system should do more than block bad changes. It should also be able to notice them.

## Example

An online shop stores customer orders. Only the order service may change an order's status. A support agent may view orders but not edit them. A scheduled check compares stored files against known-good versions and raises an alert when something differs. The team writes the integrity goal in its quality requirements: no unauthorized change to an order goes unnoticed.



## Checks

- The document states which data and system state must be protected from unauthorized modification or deletion.
- Integrity is treated separately from confidentiality, which covers who may access data.
- The document describes how unauthorized changes to software and information are detected.

## Related

- [Security](https://arc.fuet.ch/concepts/quality-attributes/security.md)
- [Confidentiality](https://arc.fuet.ch/concepts/quality-attributes/confidentiality.md)
- [Nonrepudiation](https://arc.fuet.ch/concepts/quality-attributes/nonrepudiation.md)
- [Accountability](https://arc.fuet.ch/concepts/quality-attributes/accountability.md)
- [Authenticity](https://arc.fuet.ch/concepts/quality-attributes/authenticity.md)
- [ISO/IEC 25010 Product Quality Model](https://arc.fuet.ch/concepts/quality-attributes/iso-iec-25010-quality-model.md)
- [Security Tactic](https://arc.fuet.ch/concepts/tactics/security-tactics.md)
- [Security Scenario](https://arc.fuet.ch/concepts/quality-attributes/security-scenario.md)

## Sources

- [ISO 25010](https://iso25000.com/index.php/en/iso-25000-standards/iso-25010?start=6) — iso25000.com, accessed 2026-11-09
- [System and Information Integrity - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/reference/controls/system-and-information-integrity/) — fedramp.gov, accessed 2026-11-09