SI-12 Information Management and Retention

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High, Privacy	Organization	3 (3 in a baseline)

Related controls: AC-16, AU-5, AU-11, CA-2, CA-3, CA-5, CA-6, CA-7, CA-9, CM-5, CM-9, CP-2, IR-8, MP-2, MP-3, MP-4, MP-6, PL-2, PL-4, PM-4, PM-8, PM-9, PS-2, PS-6, PT-2, PT-3, RA-2, RA-3, SA-5, SA-8, SR-2

Control statement

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

NIST discussion

Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information. The National Archives and Records Administration (NARA) provides federal policy and guidance on records retention and schedules. If organizations have a records management office, consider coordinating with records management personnel. Records produced from the output of implemented controls that may require management and retention include, but are not limited to: All XX-1, AC-6(9), AT-4, AU-12, CA-2, CA-3, CA-5, CA-6, CA-7, CA-8, CA-9, CM-2, CM-3, CM-4, CM-6, CM-8, CM-9, CM-12, CM-13, CP-2, IR-6, IR-8, MA-2, MA-4, PE-2, PE-8, PE-16, PE-17, PL-2, PL-4, PL-7, PL-8, PM-5, PM-8, PM-9, PM-18, PM-21, PM-27, PM-28, PM-30, PM-31, PS-2, PS-6, PS-7, PT-2, PT-3, PT-7, RA-2, RA-3, RA-5, RA-8, SA-4, SA-5, SA-8, SA-10, SI-4, SR-2, SR-4, SR-8.

Control enhancements

SI-12(1) Limit Personally Identifiable Information Elements

Baselines: Privacy

Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignment: organization-defined elements of personally identifiable information].

Discussion and assessment objectives for SI-12(1)

Limiting the use of personally identifiable information throughout the information life cycle when the information is not needed for operational purposes helps to reduce the level of privacy risk created by a system. The information life cycle includes information creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition. Risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to determining which elements of personally identifiable information may create risk.

Determine if personally identifiable information being processed in the information life cycle is limited to [Assignment: organization-defined elements of personally identifiable information].

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; personally identifiable information processing procedures; records retention and disposition policy; records retention and disposition procedures; federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to limiting personally identifiable information elements; personally identifiable information inventory; system audit records; audit findings; system security plan; privacy plan; privacy program plan; privacy impact assessment; privacy risk assessment documentation; data mapping documentation; other relevant documents or records.

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities; organizational personnel with security and privacy responsibilities; network administrators.

Test: Organizational processes for information management and retention (including limiting personally identifiable information processing); automated mechanisms supporting and/or implementing limits to personally identifiable information processing.

SI-12(2) Minimize Personally Identifiable Information in Testing, Training, and Research

Baselines: Privacy

Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [Assignment: organization-defined techniques].

Discussion and assessment objectives for SI-12(2)

Organizations can minimize the risk to an individual’s privacy by employing techniques such as de-identification or synthetic data. Limiting the use of personally identifiable information throughout the information life cycle when the information is not needed for research, testing, or training helps reduce the level of privacy risk created by a system. Risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to determining the techniques to use and when to use them.

Determine if:

• SI-12(02)[01] [Assignment: organization-defined techniques] are used to minimize the use of personally identifiable information for research;
• SI-12(02)[02] [Assignment: organization-defined techniques] are used to minimize the use of personally identifiable information for testing;
• SI-12(02)[03] [Assignment: organization-defined techniques] are used to minimize the use of personally identifiable information for training.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; personally identifiable information processing procedures; federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to minimizing the use of personally identifiable information in testing, training, and research; policy for the minimization of personally identifiable information used in testing, training, and research; procedures for the minimization of personally identifiable information used in testing, training, and research; documentation supporting minimization policy implementation (e.g., templates for testing, training, and research); data sets used for testing, training, and research; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities; organizational personnel with information security and privacy responsibilities; network administrators; system developers; personnel with IRB responsibilities.

Test: Organizational processes for the minimization of personally identifiable information used in testing, training, and research; automated mechanisms supporting and/or implementing the minimization of personally identifiable information used in testing, training, and research.

SI-12(3) Information Disposal

Baselines: Privacy

Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques].

Discussion and assessment objectives for SI-12(3)

Organizations can minimize both security and privacy risks by disposing of information when it is no longer needed. The disposal or destruction of information applies to originals as well as copies and archived records, including system logs that may contain personally identifiable information.

Determine if:

• SI-12(03)[01] [Assignment: organization-defined techniques] are used to dispose of information following the retention period;
• SI-12(03)[02] [Assignment: organization-defined techniques] are used to destroy information following the retention period;
• SI-12(03)[03] [Assignment: organization-defined techniques] are used to erase information following the retention period.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; personally identifiable information processing procedures; records retention and disposition policy; records retention and disposition procedures; laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal; media protection policy; media protection procedures; system audit records; audit findings; information disposal records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities; organizational personnel with information security and privacy responsibilities; network administrators.

Test: Organizational processes for information disposition; automated mechanisms supporting and/or implementing information disposition.

Assessment objectives (SP 800-53A)

Objectives and methods for SI-12

Determine if:

• SI-12[01] information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
• SI-12[02] information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
• SI-12[03] information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
• SI-12[04] information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; records retention and disposition policy; records retention and disposition procedures; federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention; media protection policy; media protection procedures; audit findings; system security plan; privacy plan; privacy program plan; personally identifiable information inventory; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel with information and records management, retention, and disposition responsibilities; organizational personnel with information security and privacy responsibilities; network administrators.

Test: Organizational processes for information management, retention, and disposition; automated mechanisms supporting and/or implementing information management, retention, and disposition.

Policy statement

• The System owner shall manage and retain information within the system, and information output from the system, in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements. (SI-12)
• The System owner shall document the retention period and the authority for it for each type of information the system holds, drawn from the organization’s records retention schedule. (SI-12)
• The System owner shall dispose of information when its retention period ends, unless a legal hold or an approved extension applies. (SI-12)

Federal systems

The head of each federal agency must “make and preserve records containing adequate and proper documentation” of the agency’s functions (44 U.S.C. § 3101), and federal records “may not be alienated or destroyed” except under chapter 33 of title 44 (44 U.S.C. § 3314): that is, under records schedules approved by the Archivist of the United States, including the General Records Schedules the Archivist issues for records common to several or all agencies (44 U.S.C. § 3303a(d)). As of September 2026.

• The System owner shall retain and dispose of federal records in the system only as an approved agency records schedule or a General Records Schedule allows. (SI-12)

SI-12(1) Limit personally identifiable information elements

• For a system that processes personally identifiable information, the System owner shall limit the personally identifiable information processed in the information life cycle to Fill in: elements of personally identifiable information being processed in the information life cycle Typical: the data elements the system’s privacy impact assessment lists as needed for its stated purposes. (SI-12(1))

SI-12(2) Minimize personally identifiable information in testing, training and research

• The System owner shall use the following techniques to minimize the use of personally identifiable information for research: Fill in: techniques used to minimize the use of personally identifiable information for research Typical: de-identified or synthetic data, or where the research needs identifiable data, only the elements the senior privacy official approves. (SI-12(2))
• The System owner shall use the following techniques to minimize the use of personally identifiable information for testing: Fill in: techniques used to minimize the use of personally identifiable information for testing Typical: synthetic data, or masked copies of production data. (SI-12(2))
• The System owner shall use the following techniques to minimize the use of personally identifiable information for training: Fill in: techniques used to minimize the use of personally identifiable information for training Typical: fictitious or synthetic records. (SI-12(2))

SI-12(3) Information disposal

• The System owner shall use the following techniques to dispose of information following the retention period: Fill in: techniques used to dispose of information following the retention period Typical: deletion by the system’s automated retention jobs, and shredding for paper output. (SI-12(3))
• The System owner shall use the following techniques to destroy information following the retention period: Fill in: techniques used to destroy information following the retention period Typical: destruction of storage media by shredding, disintegration or incineration, as the media sanitization procedure sets out. (SI-12(3))
• The System owner shall use the following techniques to erase information following the retention period: Fill in: techniques used to erase information following the retention period Typical: cryptographic erase or overwriting, as the media sanitization procedure sets out. (SI-12(3))

From the System and Information Integrity Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SI-12 asks you to manage and retain information in the system, and information the system outputs, as laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements require. NIST’s SI-12 discussion says these requirements cover the full life cycle of information, sometimes beyond the system’s disposal, and that information to retain includes policies, procedures, plans, reports and the output of controls. It lists many controls whose records may need retaining, including every -1 control, the CA assessments and authorizations, the CM baselines and change records, CP-2, IR-6, IR-8, RA-3, RA-5 and SI-4. It says NARA provides federal policy and guidance on records retention and schedules, and suggests coordinating with records management staff. SI-12 is in the Low, Moderate and High baselines and the Privacy baseline.

SI-12 has two sides: keeping information as long as required, and getting rid of it when the period ends. Assessors check both, and the second is where systems usually fall short, because nothing breaks when old data is kept.

Common implementations. The organization’s records retention schedule, owned by records management, sets a period for each type of record. Each system security plan, and the privacy impact assessment for personally identifiable information, names the types of information the system holds and the period and authority for each. The system enforces the periods with retention settings in its storage, database, log platform and backup tool, and automated jobs that delete expired records. Legal holds suspend deletion for the records they cover, through the same tools. Each year the system owner confirms that disposal happened, including for backups, exports and copies held by service providers.

Organization-defined parameters. SI-12 has no parameters. The System and Information Integrity policy has the system owner manage and retain information as the control states, document the retention period and its authority for each type of information the system holds, drawn from the organization’s records retention schedule, and dispose of information when its period ends unless a legal hold or an approved extension applies. Its decision worksheet asks where retention periods are set and who confirms disposal; the typical answer is the records retention schedule, with the system owner confirming disposal each year. Two other policies depend on SI-12: media are sanitized only after confirming no retention requirement or legal hold still applies (MP-6, recorded in the media sanitization record), and audit records are kept for the AU-11 period.

Evidence assessors ask for.

• The records retention schedule, and the types of information the system holds mapped to it, with periods and authorities
• Retention settings in the database, storage, log platform and backup tool, compared with the periods
• Records of the deletion jobs that ran, or of disposal confirmed in the last year
• How legal holds are applied and released
• For a sample of record types, the oldest records still held, compared with the period

Inheritance. The retention schedule and the records management program are common controls. The system owns applying them: setting the periods in its own tools and disposing of its own information. A service provider that stores the system’s information must support the periods and delete on request or at contract end; the contract and the system security plan should say how.

Common findings.

• No retention period documented for the system’s information, or “keep forever” by default.
• Records deleted in the application but still in backups, exports or a provider’s storage years later.
• Retention settings in the log platform that do not match the AU-11 period or the schedule.
• Disposal stopped by a legal hold that ended long ago.
• Information output from the system, such as reports and extracts on shared drives, outside any retention control.

Enhancements in the Moderate baseline. None. SI-12 has three enhancements, all in the Privacy baseline only.

Enhancements in the Privacy baseline. Each applies to a system that processes personally identifiable information, and each is recorded in the privacy impact assessment.

• SI-12(1) limits the personally identifiable information processed across the information life cycle to the elements you name. NIST’s discussion says limiting information not needed for operational purposes reduces privacy risk, and that risk assessments and applicable laws, regulations and policies help determine which elements create risk. Typical value: the data elements the system’s privacy impact assessment lists as needed for its stated purposes. Its section 3 lists each element with why it is needed, and its minimization entry records the elements considered and left out.
• SI-12(2) minimizes personally identifiable information in research, testing and training. NIST’s discussion names de-identification and synthetic data as techniques. Typical values: for research, de-identified or synthetic data, or where the research needs identifiable data, only the elements the senior privacy official approves; for testing, synthetic data, or masked copies of production data; for training, fictitious or synthetic records. The SA-11 clause has developers test with data prepared under SI-12(2), not live personally identifiable information, unless the senior privacy official approves; the organization-wide rules are under PM-25. NIST SP 800-188, De-Identifying Government Datasets: Techniques and Governance (September 2023), the final version as of October 2026, describes de-identification techniques, including synthetic data, and their governance.
• SI-12(3) sets the techniques used to dispose of, destroy or erase information after the retention period. NIST’s discussion says disposal applies to originals, copies and archived records, including system logs that may contain personally identifiable information. Typical values: to dispose of it, deletion by the system’s automated retention jobs, and shredding for paper output; to destroy it, destruction of storage media by shredding, disintegration or incineration, as the media sanitization procedure sets out; to erase it, cryptographic erase or overwriting, as the media sanitization procedure sets out. The media techniques follow NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025), the final version as of October 2026, under MP-6. Section 7 of the privacy impact assessment records the disposal method for each record.

Federal systems (as of October 2026). The head of each federal agency must “make and preserve records containing adequate and proper documentation” of the agency’s organization, functions, policies, decisions, procedures and essential transactions (44 U.S.C. § 3101), and federal records “may not be alienated or destroyed except under” chapter 33 of title 44 (44 U.S.C. § 3314), which includes the General Records Schedules the Archivist issues for records common to agencies (44 U.S.C. § 3303a(d)); text checked in the United States Code, 2024 edition. NARA’s General Records Schedules page says “Use of the GRS is mandatory. Agencies must use the GRS unless they can justify the use of an agency-specific schedule.” The SI-12 clause’s federal block has the system owner retain and dispose of federal records in the system only as an approved agency records schedule or a General Records Schedule allows. Work out the periods with the agency records officer.

Artifacts

• System and Information Integrity Decision Worksheet
• System and Information Integrity Policy