Audit compliance for code intergrity

Customer Audit and compliance requirements are driving the need for independently verifiable evidence that firmware, Licensed Internal Code (LIC), and related system code have not been altered. While IBM firmware includes internal integrity validation mechanisms that prevent unauthorized code from being applied, customers currently have limited ability to demonstrate to auditors that these validation checks were executed and successfully passed.

Auditor feedback indicates that relying solely on the successful application of firmware as proof of validation is insufficient for evidentiary and compliance purposes. The requested enhancement is the introduction of an auditable security log event that explicitly records the successful completion of firmware and code integrity verification checks.

This capability should extend beyond firmware updates to include system changes originating from manufacturing or Resource Link activities, Code activations, VTD_Exec updates, and other configuration-altering actions. By generating a definitive log entry confirming that authenticity and integrity checks have passed, organizations can automate the collection and retention of evidence required for audit and regulatory compliance. (IE: Hash Validations)

To address operational concerns surrounding security log capacity, this logging capability could be implemented as a configurable option that administrators can enable or disable as necessary. The security log should also record any changes to this setting, providing a complete audit trail of both integrity validation events and logging configuration changes. This approach would enhance transparency, strengthen compliance posture, and provide customers with objective, auditable proof that critical code and configuration changes have undergone and passed IBM's integrity verification processes.