Secure IOS images and files
You can secure the IOS images and configuration files stored in flash and NVRAM using a feature called Cisco IOS Resilient Configuration. This feature works by making a secure working copy of the IOS image and the startup configuration. These secure files (also known as the primary bootset) cannot be removed by a remote user. Note that this feature can be disabled only through a console session.
To secure the IOS image on your device, use the secure boot-image command:
R1(config)#secure boot-image %IOS_RESILIENCE-5-IMAGE_RESIL_ACTIVE: Successfully secured running image
To secure the startup-config file, use the secure boot-config command:
R1(config)#secure boot-config %IOS_RESILIENCE-5-CONFIG_RESIL_ACTIVE: Successfully secured config archive [flash:.runcfg-20150807-151124.ar]
To verify the archive, use the show secure bootset command:
R1#show secure bootset IOS resilience router id FTX1111W0QT IOS image resilience version 12.4 activated at 15:11:00 UTC fri aug 7 2015 Secure archive flash:/c1841-advipservicesk9-mz.124-15.T1.bin type is image (elf)  file size is 33591768 bytes, run size is 33591768 bytes Runnable image, entry point 0x8000F000, run from ram IOS configuration resilience version 12.4 activated at 15:11:24 UTC fri aug 7 2015 Secure archive flash:/.runcfg-20150807-151124.ar type is config configuration archive size 714 bytes