It includes both security integrity — preventing or detecting impermissible change — and fitness for use, which depends on valid values, relationships, context, and provenance. Integrity applies while data is created, stored, processed, transmitted, restored, and disposed of.
Controls should preserve trustworthy meaning as well as bits. An unaltered record can still be wrong at creation, incomplete, stale, or detached from its source; an authorized change can also reduce integrity if it violates business rules or obscures history.
Key points
Invalid-change preventionUse authorization, separation of duties, validated inputs, database constraints, controlled transformations, versioning, and safe interfaces appropriate to the data and process.
Context preservationRecord sources, timestamps, definitions, transformations, approvals, and lineage so users can evaluate origin, meaning, completeness, and changes over time.
Detection and recoveryUse reconciliation and protected audit logs; use checksums for accidental corruption and a message authentication code (MAC) or digital signature when malicious modification is in scope; preserve protected backups and test restoration with independent evidence of correctness.
Important limitationA hash comparison is meaningful only when the reference value and comparison process are trustworthy. Even then, a match shows only that selected bytes have not changed; it cannot prove that the original data was true, complete, properly authorized, or suitable for its intended use.