What is File Integrity Monitoring (FIM)?
File Integrity Monitoring (FIM) is a security control that continuously watches critical files, directories, system configurations, and registry keys for unauthorized or unexpected changes. It is used to detect tampering, support incident investigations, and satisfy compliance requirements such as PCI-DSS and HIPAA.
What it does
FIM tools take a baseline snapshot of files and system objects, then compare the current state against that baseline on a scheduled or real-time basis. When a difference is found, the tool records what changed, when it changed, and which user or process made the change.
Typical objects monitored include:
- Operating system binaries and libraries
- Application configuration files
- Web server content directories
- Windows registry keys
- SSH authorized_keys and sudoers files
- Log files and audit trails
Most FIM tools generate an alert or log entry for every detected change. Some can also block or roll back unauthorized changes.
Why teams buy it
Compliance mandates are the most common driver. PCI-DSS Requirement 11.5 explicitly requires FIM on cardholder data environments. HIPAA, NERC CIP, and several other frameworks reference equivalent controls.
Breach detection is the second driver. Attackers who gain a foothold often modify system binaries, plant web shells, or alter configuration files to maintain persistence. FIM catches these modifications even when the attacker avoids triggering behavioral alerts in an EDR tool.
Change management auditing is a third use case. Operations teams use FIM logs to verify that only approved changes were made during a maintenance window.
What to look for
- Real-time vs. scheduled scanning: Real-time monitoring catches changes within seconds; scheduled scans may miss short-lived modifications.
- Baseline management: The tool should make it easy to approve known-good changes and update the baseline without generating noise.