---
{
  "title": "Integrity",
  "summary": "Keep information and actions consistent with authorized, trustworthy states.",
  "topic": "foundations",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    1
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: An Introduction to Information Security",
      "url": "https://csrc.nist.gov/pubs/sp/800/12/r1/final"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Integrity concerns protection against improper modification or destruction and the trustworthiness of information and processing. It includes byte-level consistency and business correctness. Hashes can detect changed bytes, while authorization, validated transactions, review, and audit records help ensure changes are legitimate. A system must distinguish an authorized update from tampering rather than assuming any change is bad.

## In practice

A salary change is approved, applied through a controlled process, and recorded. A matching file hash alone would not establish that the salary value was appropriate.

## A common misunderstanding

Integrity is broader than “the file did not change.” A correct system often needs authorized changes.

## Check your understanding

Which controls help establish authorized change?

**Think it through:** Permission checks, approvals, valid transactions, and traceable audit records.

## Correct change is part of the requirement

A fictional training provider records assessment scores. A score may legitimately change after an appeal, but only through an approved process. Preventing every change would preserve old bytes while failing the business requirement. Integrity therefore involves both the correctness of the value and the legitimacy of the process that produced it.

Different evidence answers different questions. A file hash can help show that a saved export has not changed since a particular trusted reference was recorded. An approval record can show who authorized a score amendment. An application validation rule can prevent a score outside the permitted range. None of these alone establishes the entire story.

Pay attention to intermediate calculations and imports. A correctly authorized user may upload a spreadsheet with columns shifted by one position. The resulting records can be wrong without anyone attempting malicious modification. Reconciliation, previews, and checks on expected totals help catch such failures before they become authoritative data.

## Review one amendment end to end

Using dummy learner records, describe a score correction from request through review, update, and audit trail. Identify who may request it, who may approve it, what evidence supports the change, and how the original value remains traceable where required. Include a rejected request and a duplicate submission.

Now ask what happens if the update succeeds but logging fails, or if two reviewers approve conflicting versions. These cases expose integrity requirements hidden behind a simple edit button. A useful design keeps the accepted transaction, its authorization, and its recorded outcome consistent. The goal is trustworthy information and processing, not merely detecting that some bytes differed at two points in time.

## Keep exploring

- [[cia-triad]]
- [[hashing]]
- [[clark-wilson]]
- [[change-control]]