SI-21 Information Refresh
Guidance: nonePolicy clause: noneWhat these mean
si21ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Not in a baseline | Organization | None |
Related controls: SI-14
Control statement
Section titled “Control statement”Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed.
NIST discussion
Retaining information for longer than it is needed makes it an increasingly valuable and enticing target for adversaries. Keeping information available for the minimum period of time needed to support organizational missions or business functions reduces the opportunity for adversaries to compromise, capture, and exfiltrate that information.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for SI-21
Determine if the [Assignment: organization-defined information] is refreshed [Assignment: organization-defined frequencies] or is generated on demand and deleted when no longer needed.
Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; procedures addressing software and information integrity; system design documentation; system configuration settings and associated documentation; information refresh procedures; list of information to be refreshed; system security plan; privacy plan; other relevant documents or records.
Interview: Organizational personnel responsible for refreshing information; organizational personnel with information security and privacy responsibilities; organizational personnel with systems security engineering responsibilities; system developers.
Test: Mechanisms for information refresh; organizational processes for information refresh.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.