# System and Information Integrity Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/si/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for System and Information Integrity, and who is accountable for meeting those requirements. (SI-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SI-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (SI-1a.1(a))
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (SI-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (SI-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (SI-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (SI-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SI-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (SI-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (SI-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (SI-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (SI-1a.1(a))

## Procedures

The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (SI-1a.2)

## Dissemination

- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the system and information integrity policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (SI-1a)
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the system and information integrity procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (SI-1a)

## Policy statements

### Flaw remediation (SI-2)

- The [System owner] shall identify system flaws from vulnerability scanning and monitoring, vendor security advisories, assessments and incident analysis. (SI-2a)
- The [System owner] shall report identified flaws that affect the system to the [Security operations team] and record each in the system's flaw tracking. (SI-2a)
- The [System owner] shall correct identified system flaws. (SI-2a)
- The [System owner] shall test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installing them in production. (SI-2b)
- The [System owner] shall install security-relevant software and firmware updates within [Fill in: time period within which to install security-relevant software updates after the release of the updates. Typical: known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days] of the release of the updates. (SI-2c)
- The [System owner] shall enter any security-relevant update that cannot be installed in time in the system's plan of action and milestones, with a planned date and any compensating measures, before its installation time ends. (SI-2c)
- The [System owner] shall incorporate flaw remediation into the organization's configuration management process, recording routine updates as standard changes and urgent updates as emergency changes. (SI-2d)

#### Federal systems

CISA [BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk), Prioritizing Security Updates Based on Risk (June 10, 2026), sets remediation deadlines for federal civilian agencies by whether an asset is publicly exposed, whether the vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated, and its technical impact, from 3 days to "fix on system upgrade". Its clock starts when CISA adds a vulnerability to the KEV catalog or the agency identifies it, whichever is first. It revoked BOD 22-01 and BOD 19-02. It does not apply to national security systems. As of September 2026.

- The [System owner] shall set the SI-2c installation times no longer than the deadlines CISA BOD 26-04 sets, and install security updates within those deadlines. (SI-2c)

### Automated flaw remediation status (SI-2(2))

- The [System owner] shall determine whether system components have applicable security-relevant software and firmware updates installed, using [Fill in: automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components. Typical: the patch management and vulnerability scanning tools], [Fill in: the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components. Typical: at least weekly]. (SI-2(2))

#### Federal systems

CISA [BOD 23-01](https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks), Improving Asset Visibility and Vulnerability Detection on Federal Networks (October 3, 2022), requires federal civilian agencies to perform automated asset discovery every 7 days and to initiate vulnerability enumeration across all discovered assets, including roaming devices such as laptops, every 14 days. As of September 2026.

- The [System owner] shall ensure the system's assets are covered by automated asset discovery at least every 7 days and by vulnerability enumeration at least every 14 days, as CISA BOD 23-01 requires. (SI-2(2))

### Malicious code protection (SI-3)

- The [System owner] shall implement [Select one or more: signature-based; non-signature-based. Typical: signature-based and non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. (SI-3a)
- The [System owner] shall ensure malicious code protection mechanisms update automatically as new releases are available, in accordance with the organization's configuration management policy and procedures. (SI-3b)
- The [System owner] shall configure malicious code protection mechanisms to perform periodic scans of the system [Fill in: the frequency at which malicious code protection mechanisms perform scans. Typical: at least weekly]. (SI-3c.1)
- The [System owner] shall configure malicious code protection mechanisms to perform real-time scans of files from external sources at [Select one or more: endpoint; network entry and exit points. Typical: endpoint and network entry and exit points] as the files are downloaded, opened or executed. (SI-3c.1)
- The [System owner] shall configure malicious code protection mechanisms to [Select one or more: block malicious code; quarantine malicious code; take [Assignment: organization-defined action]. Typical: block and quarantine malicious code] and to send an alert to [Fill in: personnel or roles to be alerted when malicious code is detected. Typical: the security operations team] when malicious code is detected. (SI-3c.2)
- The [Security operations team] shall review reported false positives, approve any scan exclusion with a documented reason and an expiry date, and record the effect of false positives on the availability of the system. (SI-3d)

### System monitoring (SI-4)

- The [Security operations team] shall monitor the system to detect attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Fill in: monitoring objectives to detect attacks and indicators of potential attacks on the system. Typical: detecting attacks, malware, unauthorized access, privilege misuse and data exfiltration]. (SI-4a.1)
- The [Security operations team] shall monitor the system to detect unauthorized local, network and remote connections. (SI-4a.2)
- The [Security operations team] shall identify unauthorized use of the system through [Fill in: techniques and methods used to identify unauthorized use of the system. Typical: log correlation in the security information and event management (SIEM) platform, endpoint detection and response, network intrusion detection and user behavior analytics]. (SI-4b)
- The [System owner] shall ensure monitoring capabilities are deployed strategically within the system to collect the essential information the monitoring objectives call for, including at the managed interfaces under SC-7. (SI-4c.1)
- The [System owner] shall ensure monitoring capabilities can be deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization. (SI-4c.2)
- The [Security operations team] shall analyze detected events and anomalies, and refer suspected incidents to the [Incident response team]. (SI-4d)
- The [Chief Information Security Officer] shall adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations or the Nation. (SI-4e)
- The [Chief Information Security Officer] shall obtain a legal opinion on system monitoring activities before they begin and whenever they change significantly. (SI-4f)
- The [Security operations team] shall provide [Fill in: system monitoring information to be provided to personnel or roles. Typical: alerts and monitoring reports] to [Fill in: personnel or roles to whom system monitoring information is to be provided. Typical: the system owner and the incident response team], [Select one or more: as needed; [Assignment: organization-defined frequency]. Typical: as needed, and at least monthly]. (SI-4g)

#### Federal systems

[OMB M-26-14](https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf), Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded M-21-31. It directs agencies to prioritize two logging objectives, continuous event monitoring and threat hunting, investigation, response and forensics, for all information systems owned or operated by the agency or by third parties on its behalf, and to adhere to CISA's [Logging Reference Architecture](https://www.cisa.gov/resources-tools/resources/logging-reference-architecture) (published August 20, 2026). Its Appendix B requires logs that support monitoring for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, with automated alerts, and that are readily available to the agency's top-level security operations center. It does not apply to national security systems. As of September 2026.

- The [System owner] shall ensure the system's logs are readily available to the agency's top-level security operations center, as OMB M-26-14 requires. (SI-4c.1)
- The [Security operations team] shall use the system's logs to monitor for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, and generate automated alerts for them, as OMB M-26-14 Appendix B requires. (SI-4a.1)
- In the event of a known or suspected compromise, the [Chief Information Security Officer] shall provide logs and other relevant data to CISA and the FBI on request, to the extent consistent with applicable law, as OMB M-26-14 requires. (SI-4g)

### Automated tools and mechanisms for real-time analysis (SI-4(2))

- The [Security operations team] shall employ automated tools and mechanisms, such as correlation rules in the SIEM platform and endpoint detection and response, to support near real-time analysis of events. (SI-4(2))

### Inbound and outbound communications traffic (SI-4(4))

- The [Security operations team] shall determine and document criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic. (SI-4(4)(a))
- The [Security operations team] shall monitor inbound communications traffic [Fill in: the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions. Typical: continuously] for [Fill in: unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic. Typical: connections from known malicious sources, unapproved protocols and ports, and scanning or password-guessing patterns]. (SI-4(4)(b))
- The [Security operations team] shall monitor outbound communications traffic [Fill in: the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions. Typical: continuously] for [Fill in: unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic. Typical: connections to known malicious destinations, unusual data volumes, unapproved protocols and regular beaconing to external hosts]. (SI-4(4)(b))

### System-generated alerts (SI-4(5))

- The [System owner] shall ensure the system alerts [Fill in: personnel or roles to be alerted when indications of compromise or potential compromise occur. Typical: the security operations team] when the following system-generated indications of compromise or potential compromise occur: [Fill in: compromise indicators. Typical: indicators of compromise from the detection tools and threat intelligence feeds]. (SI-4(5))

### Visibility of encrypted communications (SI-4(10))

- The [System owner] shall make provisions so that [Fill in: encrypted communications traffic to be made visible to system monitoring tools and mechanisms. Typical: encrypted traffic crossing the internet connection and the public-facing subnetwork, except categories exempted after legal and privacy review, such as health and financial sites] is visible to [Fill in: system monitoring tools and mechanisms to be provided access to encrypted communications traffic. Typical: the intrusion detection and prevention systems and data loss prevention tools at the boundary]. (SI-4(10))

### Automated organization-generated alerts (SI-4(12))

- The [Security operations team] shall alert [Fill in: personnel or roles to be alerted when indications of inappropriate or unusual activity with security or privacy implications occur. Typical: the security operations team and the system owner] using [Fill in: automated mechanisms used to alert personnel or roles. Typical: the security information and event management (SIEM) platform] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Fill in: activities that trigger alerts to personnel or. Typical: use of privileged accounts outside approved change windows, bulk downloads or exports of sensitive information, disabled security tools, and new administrative accounts]. (SI-4(12))

### Wireless intrusion detection (SI-4(14))

- The [System owner] shall employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system. (SI-4(14))

### Privileged users (SI-4(20))

- The [Security operations team] shall implement the following additional monitoring of privileged users: [Fill in: additional monitoring of privileged users. Typical: recording of privileged sessions, alerts on high-risk privileged commands, and a review of privileged activity at least weekly]. (SI-4(20))

### Unauthorized network services (SI-4(22))

- The [Security operations team] shall detect network services that have not been authorized or approved by [Fill in: authorization or approval processes for network services. Typical: the change control process and the approved ports, protocols and services list]. (SI-4(22)(a))
- When unauthorized network services are detected, the [Security operations team] shall [Select one or more: audit; alert [Assignment: organization-defined personnel or roles]. Typical: audit, and alert the security operations team and the system owner]. (SI-4(22)(b))

### Security alerts, advisories and directives (SI-5)

- The [Security operations team] shall receive system security alerts, advisories and directives from [Fill in: external organizations from whom system security alerts, advisories, and directives are to be received on an ongoing basis. Typical: CISA, the vendors of the system's components, and the organization's information sharing and analysis center] on an ongoing basis. (SI-5a)
- The [Security operations team] shall generate internal security alerts, advisories and directives as deemed necessary. (SI-5b)
- The [Security operations team] shall disseminate security alerts, advisories and directives to [Select one or more: [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined elements]; [Assignment: organization-defined external organizations]. Typical: system owners and system administrators, the security operations and incident response teams, and the service providers who operate systems for the organization, where an alert affects them]. (SI-5c)
- The [System owner] shall implement security directives in accordance with their established time frames, or notify the issuing organization of the degree of noncompliance. (SI-5d)

#### Federal systems

The Federal Information Security Modernization Act requires the head of each agency to comply with the binding operational directives and emergency directives the Secretary of Homeland Security issues under 44 U.S.C. § 3553(b) and (h) ([44 U.S.C. § 3554(a)(1)(B)(ii) and (v)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)). CISA publishes them on its [Cybersecurity Directives](https://www.cisa.gov/directives) page; they do not apply to national security systems. As of September 2026.

- The [Chief Information Security Officer] shall track each CISA binding operational directive and emergency directive that applies to the agency, and ensure system owners complete its required actions and reports within the time frames it sets. (SI-5d)

### Automated alerts and advisories (SI-5(1))

- The [Security operations team] shall broadcast security alert and advisory information throughout the organization using [Fill in: automated mechanisms used to broadcast security alert and advisory information throughout the organization. Typical: the ticketing system, which assigns each alert to the owners of the affected components, and the security team's distribution lists]. (SI-5(1))

### Security and privacy function verification (SI-6)

- The [System owner] shall verify the correct operation of the following security functions: [Fill in: security functions to be verified for correct operation. Typical: access enforcement, authentication, audit logging, encryption and malicious code protection]. (SI-6a)
- The [System owner] shall verify the correct operation of the following privacy functions: [Fill in: privacy functions to be verified for correct operation. Typical: consent recording, de-identification and the scheduled deletion of personally identifiable information]. (SI-6a)
- The [System owner] shall perform the verification [Select one or more: [Assignment: organization-defined system transitional states]; upon command by user with appropriate privilege; [Assignment: organization-defined frequency]. Typical: at system startup and restart, upon command by a user with appropriate privilege, and at least monthly]. (SI-6b)
- The [System owner] shall ensure [Fill in: personnel or roles to be alerted of failed security and privacy verification tests. Typical: the system owner and the security operations team] are alerted to failed security and privacy verification tests. (SI-6c)
- When anomalies are discovered, the [System owner] shall [Select one or more: shut the system down; restart the system; [Assignment: organization-defined alternative action(s)]. Typical: isolate the affected component and open an incident]. (SI-6d)

### Software, firmware and information integrity (SI-7)

- The [System owner] shall employ integrity verification tools to detect unauthorized changes to the following software: [Fill in: software requiring integrity verification tools to be employed to detect unauthorized changes. Typical: operating system files, installed applications, container images and security tool binaries]. (SI-7a)
- The [System owner] shall employ integrity verification tools to detect unauthorized changes to the following firmware: [Fill in: firmware requiring integrity verification tools to be employed to detect unauthorized changes. Typical: server, network device and endpoint firmware and boot components, where the platform supports verification]. (SI-7a)
- The [System owner] shall employ integrity verification tools to detect unauthorized changes to the following information: [Fill in: information requiring integrity verification tools to be employed to detect unauthorized changes. Typical: security configuration files, audit logs, and the critical data stores named in the system security plan]. (SI-7a)
- When unauthorized changes to software are detected, the [System owner] shall [Fill in: actions to be taken when unauthorized changes to software are detected. Typical: alert the security operations team, restore the approved version, and handle an unauthorized change as a suspected incident]. (SI-7b)
- When unauthorized changes to firmware are detected, the [System owner] shall [Fill in: actions to be taken when unauthorized changes to firmware are detected. Typical: alert the security operations team, restore the approved firmware, and handle an unauthorized change as a suspected incident]. (SI-7b)
- When unauthorized changes to information are detected, the [System owner] shall [Fill in: actions to be taken when unauthorized changes to information are detected. Typical: alert the security operations team and the information owner, restore the information from a trusted source or backup, and handle an unauthorized change as a suspected incident]. (SI-7b)

### Integrity checks (SI-7(1))

- The [System owner] shall perform an integrity check of [Fill in: software on which an integrity check is to be performed. Typical: the software named for integrity verification under SI-7] [Select one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]. Typical: at startup, after each update or change to the software, and at least weekly]. (SI-7(1))
- The [System owner] shall perform an integrity check of [Fill in: firmware on which an integrity check is to be performed. Typical: the firmware named for integrity verification under SI-7] [Select one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]. Typical: at startup, after each firmware update, and at least monthly]. (SI-7(1))
- The [System owner] shall perform an integrity check of [Fill in: information on which an integrity check is to be performed. Typical: the information named for integrity verification under SI-7] [Select one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]. Typical: after each authorized change to the information, and at least daily]. (SI-7(1))

### Automated notifications of integrity violations (SI-7(2))

- The [System owner] shall employ automated tools that notify [Fill in: personnel or roles to whom notification is to be provided upon discovering discrepancies during integrity verification. Typical: the security operations team and the system owner] upon discovering discrepancies during integrity verification. (SI-7(2))

### Automated response to integrity violations (SI-7(5))

- When integrity violations are discovered, the [System owner] shall ensure the system automatically takes the following action: [Select one or more: shut down the system; restart the system; implement [Assignment: organization-defined controls]. Typical: implement controls: block the changed component from running, isolate the affected host, and restore the approved version]. (SI-7(5))

### Integration of detection and response (SI-7(7))

- The [System owner] shall incorporate the detection of the following unauthorized changes into the organization's incident response capability: [Fill in: security-relevant changes to the system. Typical: unauthorized changes to operating system and application files, security configuration settings, firmware and audit logging settings]. (SI-7(7))

### Code authentication (SI-7(15))

- The [System owner] shall implement cryptographic mechanisms to authenticate the following software and firmware components before installation: [Fill in: software or firmware components to be authenticated by cryptographic mechanisms prior to installation. Typical: operating system and application updates, firmware updates, drivers and container images]. (SI-7(15))

### Spam protection (SI-8)

- The [System owner] shall employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages. (SI-8a)
- The [System owner] shall update spam protection mechanisms when new releases are available, in accordance with the organization's configuration management policy and procedures. (SI-8b)

#### Federal systems

CISA [BOD 18-01](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security), Enhance Email and Web Security (October 16, 2017), requires federal civilian agencies to have valid SPF and DMARC records for all second-level agency domains, to set a DMARC policy of "reject" for all second-level domains and mail-sending hosts, and to add the address the directive designates (`reports@dmarc.cyber.dhs.gov`) as a recipient of DMARC aggregate reports. As of September 2026.

- The [System owner] shall ensure each second-level domain the system uses has valid SPF and DMARC records, with a DMARC policy of reject for the domain and its mail-sending hosts, as CISA BOD 18-01 requires. (SI-8a)
- The [System owner] shall include `reports@dmarc.cyber.dhs.gov` as a recipient of the domain's DMARC aggregate reports, as CISA BOD 18-01 requires. (SI-8a)

### Automatic updates (SI-8(2))

- The [System owner] shall ensure spam protection mechanisms are updated automatically [Fill in: the frequency at which to automatically update spam protection mechanisms. Typical: as the vendor releases updates, and at least daily]. (SI-8(2))

### Information input validation (SI-10)

- The [System owner] shall ensure the system checks the validity of [Fill in: information inputs to the system requiring validity checks. Typical: all inputs from users, external systems and interfaces, including web forms, API requests, file uploads and query parameters]. (SI-10)

### Error handling (SI-11)

- The [System owner] shall ensure the system generates error messages that provide the information needed for corrective action without revealing information that could be exploited. (SI-11a)
- The [System owner] shall ensure the system reveals detailed error messages only to [Fill in: personnel or roles to whom error messages are to be revealed. Typical: system administrators and developers with a need to know, through the system's logs]. (SI-11b)

### Information management and retention (SI-12)

- The [System owner] shall manage and retain information within the system, and information output from the system, in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements. (SI-12)
- The [System owner] shall document the retention period and the authority for it for each type of information the system holds, drawn from the organization's records retention schedule. (SI-12)
- The [System owner] shall dispose of information when its retention period ends, unless a legal hold or an approved extension applies. (SI-12)

#### Federal systems

The head of each federal agency must "make and preserve records containing adequate and proper documentation" of the agency's functions ([44 U.S.C. § 3101](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3101&num=0&edition=prelim)), and federal records "may not be alienated or destroyed" except under chapter 33 of title 44 ([44 U.S.C. § 3314](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3314&num=0&edition=prelim)): that is, under records schedules approved by the Archivist of the United States, including the General Records Schedules the Archivist issues for records common to several or all agencies ([44 U.S.C. § 3303a(d)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3303a&num=0&edition=prelim)). As of September 2026.

- The [System owner] shall retain and dispose of federal records in the system only as an approved agency records schedule or a General Records Schedule allows. (SI-12)

### Memory protection (SI-16)

- The [System owner] shall implement the following controls to protect the system memory from unauthorized code execution: [Fill in: controls to be implemented to protect the system memory from unauthorized code execution. Typical: data execution prevention and address space layout randomization, enforced by the operating system and hardware]. (SI-16)

## Review and update

- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current system and information integrity policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current system and information integrity policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (SI-1c.1)
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current system and information integrity procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the system and information integrity procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (SI-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SI-1a.1(b))