The first design goal for the integrity option states that both user data and Telnet option sequences must be integrity checked. Hence the integrity block must be placed below the NVT block. Additionally, by placing it above the encryption block we make the life of an intruder even harder. If encryption is enabled the intruder will not be able to see the INTEGRITY INFO sub-option sequences. See figure 3.7.
Figure 3.7: Placement of the integrity block