What is file integrity monitoring (FIM) and how does it relate to configuration monitoring?

More context

FIM answers "did something change?" by comparing current file state against a known-good snapshot. It is strong at catching tampering with binaries and unexpected edits to configuration files, but it has no opinion about whether the original state was secure in the first place.

Configuration monitoring answers "is this setting correct?" by evaluating each control in a baseline against the live system. In practice mature programs run both: FIM for change detection on critical files, and continuous CIS Benchmark scanning with drift detection so every deviation from the approved baseline is caught and documented.