File Integrity Monitoring (FIM).

A security control that detects unexpected changes to critical operating-system, application, and configuration files by comparing them to a known-good cryptographic baseline. It belongs to the Defense & Operations category of cybersecurity.

A security control that detects unexpected changes to critical operating-system, application, and configuration files by comparing them to a known-good cryptographic baseline.

File Integrity Monitoring (FIM) maintains cryptographic hashes (SHA-256 or stronger) of sensitive files, registry keys, or configuration objects and alerts when their content or metadata changes outside of an approved change window. Classic implementations include Gene Kim's Tripwire (1992), AIDE, OSSEC, Wazuh, Samhain, and modern offerings in Trend Micro, Tenable, Qualys, Splunk and most EDR platforms. FIM is explicitly required by PCI DSS v4.0 requirement 11.5.2 (formerly 11.5), HIPAA, and SOX. Effective FIM defines a tight scope (system binaries, web roots, sudoers, /etc, registry hives, scheduled tasks), integrates with change management to suppress approved updates, and forwards events to a SIEM for correlation with EDR, identity logs, and threat intelligence.

Defences for File Integrity Monitoring (FIM) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: FIM, Change detection, Tripwire-style monitoring.