# System and Information Integrity Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/si/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet SI-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the SI-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for System and Information Integrity, and who is accountable for meeting those requirements. (SI-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SI-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (SI-1a.1(a))
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (SI-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (SI-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (SI-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (SI-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SI-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (SI-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (SI-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (SI-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (SI-1a.1(a))

## Procedures

The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (SI-1a.2)

## Dissemination

- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the system and information integrity policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (SI-1a)
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the system and information integrity procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (SI-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Flaw remediation (SI-2)

> **Guidance:** SI-2 is the fixing half of vulnerability management: RA-5 finds the flaws, and SI-2 installs the updates that correct them. The installation times here count from the release of the update, while the RA-5 remediation times count from when a finding is reported, so keep the two sets of values consistent. The [Patch and Flaw Remediation Standard](https://kston83.github.io/nist-guide/templates/standards/patch-and-flaw-remediation-standard/) sets the test groups, deployment rings and schedules. NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning (April 2022, current as of September 2026), describes how to plan patching as routine preventive maintenance.

- The [System owner] shall identify system flaws from vulnerability scanning and monitoring, vendor security advisories, assessments and incident analysis. (SI-2a)
- The [System owner] shall report identified flaws that affect the system to the [Security operations team] and record each in the system's flaw tracking. (SI-2a)
- The [System owner] shall correct identified system flaws. (SI-2a)
- The [System owner] shall test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installing them in production. (SI-2b)
- The [System owner] shall install security-relevant software and firmware updates within [Fill in: time period within which to install security-relevant software updates after the release of the updates. Typical: known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days] of the release of the updates. (SI-2c)
- The [System owner] shall enter any security-relevant update that cannot be installed in time in the system's plan of action and milestones, with a planned date and any compensating measures, before its installation time ends. (SI-2c)
- The [System owner] shall incorporate flaw remediation into the organization's configuration management process, recording routine updates as standard changes and urgent updates as emergency changes. (SI-2d)

> **Guidance:** Unsupported software and firmware cannot be fixed. Record each unsupported component as a flaw, with a replacement date in the plan of action and milestones, until it is removed (SA-22).

#### Federal systems

CISA [BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk), Prioritizing Security Updates Based on Risk (June 10, 2026), sets remediation deadlines for federal civilian agencies by whether an asset is publicly exposed, whether the vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated, and its technical impact, from 3 days to "fix on system upgrade". Its clock starts when CISA adds a vulnerability to the KEV catalog or the agency identifies it, whichever is first. It revoked BOD 22-01 and BOD 19-02. It does not apply to national security systems. As of September 2026.

- The [System owner] shall set the SI-2c installation times no longer than the deadlines CISA BOD 26-04 sets, and install security updates within those deadlines. (SI-2c)

### Malicious code protection (SI-3)

> **Guidance:** Endpoint detection and response on servers and workstations, together with malware scanning in the email and web gateways, usually covers system entry and exit points. Non-signature-based means behavior or reputation analysis, which catches malware no signature yet describes. Enterprise tools are often common controls; the system owner makes sure every component that can run an agent has one.

- The [System owner] shall implement [Select one or more: signature-based; non-signature-based. Typical: signature-based and non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. (SI-3a)
- The [System owner] shall ensure malicious code protection mechanisms update automatically as new releases are available, in accordance with the organization's configuration management policy and procedures. (SI-3b)
- The [System owner] shall configure malicious code protection mechanisms to perform periodic scans of the system [Fill in: the frequency at which malicious code protection mechanisms perform scans. Typical: at least weekly]. (SI-3c.1)
- The [System owner] shall configure malicious code protection mechanisms to perform real-time scans of files from external sources at [Select one or more: endpoint; network entry and exit points. Typical: endpoint and network entry and exit points] as the files are downloaded, opened or executed. (SI-3c.1)
- The [System owner] shall configure malicious code protection mechanisms to [Select one or more: block malicious code; quarantine malicious code; take [Assignment: organization-defined action]. Typical: block and quarantine malicious code] and to send an alert to [Fill in: personnel or roles to be alerted when malicious code is detected. Typical: the security operations team] when malicious code is detected. (SI-3c.2)
- The [Security operations team] shall review reported false positives, approve any scan exclusion with a documented reason and an expiry date, and record the effect of false positives on the availability of the system. (SI-3d)

### System monitoring (SI-4)

> **Guidance:** System monitoring takes in the audit records reviewed under AU-6 and adds endpoint, network and cloud detection. The [System Monitoring Standard](https://kston83.github.io/nist-guide/templates/standards/system-monitoring-standard/) sets the log sources, detection coverage, alert handling and reporting. Legal review of monitoring (SI-4f) is usually done once for the organization's monitoring program and repeated when monitoring changes, with a system use notification under AC-8.

- The [Security operations team] shall monitor the system to detect attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Fill in: monitoring objectives to detect attacks and indicators of potential attacks on the system. Typical: detecting attacks, malware, unauthorized access, privilege misuse and data exfiltration]. (SI-4a.1)
- The [Security operations team] shall monitor the system to detect unauthorized local, network and remote connections. (SI-4a.2)
- The [Security operations team] shall identify unauthorized use of the system through [Fill in: techniques and methods used to identify unauthorized use of the system. Typical: log correlation in the security information and event management (SIEM) platform, endpoint detection and response, network intrusion detection and user behavior analytics]. (SI-4b)
- The [System owner] shall ensure monitoring capabilities are deployed strategically within the system to collect the essential information the monitoring objectives call for, including at the managed interfaces under SC-7. (SI-4c.1)
- The [System owner] shall ensure monitoring capabilities can be deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization. (SI-4c.2)
- The [Security operations team] shall analyze detected events and anomalies, and refer suspected incidents to the [Incident response team]. (SI-4d)
- The [Chief Information Security Officer] shall adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations or the Nation. (SI-4e)
- The [Chief Information Security Officer] shall obtain a legal opinion on system monitoring activities before they begin and whenever they change significantly. (SI-4f)
- The [Security operations team] shall provide [Fill in: system monitoring information to be provided to personnel or roles. Typical: alerts and monitoring reports] to [Fill in: personnel or roles to whom system monitoring information is to be provided. Typical: the system owner and the incident response team], [Select one or more: as needed; [Assignment: organization-defined frequency]. Typical: as needed, and at least monthly]. (SI-4g)

#### Federal systems

[OMB M-26-14](https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf), Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded M-21-31. It directs agencies to prioritize two logging objectives, continuous event monitoring and threat hunting, investigation, response and forensics, for all information systems owned or operated by the agency or by third parties on its behalf, and to adhere to CISA's [Logging Reference Architecture](https://www.cisa.gov/resources-tools/resources/logging-reference-architecture) (published August 20, 2026). Its Appendix B requires logs that support monitoring for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, with automated alerts, and that are readily available to the agency's top-level security operations center. It does not apply to national security systems. As of September 2026.

- The [System owner] shall ensure the system's logs are readily available to the agency's top-level security operations center, as OMB M-26-14 requires. (SI-4c.1)
- The [Security operations team] shall use the system's logs to monitor for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, and generate automated alerts for them, as OMB M-26-14 Appendix B requires. (SI-4a.1)
- In the event of a known or suspected compromise, the [Chief Information Security Officer] shall provide logs and other relevant data to CISA and the FBI on request, to the extent consistent with applicable law, as OMB M-26-14 requires. (SI-4g)

### Security alerts, advisories and directives (SI-5)

> **Guidance:** Subscribing to the CISA advisories and the vendor security bulletins for every product in the component inventory (CM-8) is the usual starting point. The value is in routing: each alert reaches the people who run the affected component, with a due date.

- The [Security operations team] shall receive system security alerts, advisories and directives from [Fill in: external organizations from whom system security alerts, advisories, and directives are to be received on an ongoing basis. Typical: CISA, the vendors of the system's components, and the organization's information sharing and analysis center] on an ongoing basis. (SI-5a)
- The [Security operations team] shall generate internal security alerts, advisories and directives as deemed necessary. (SI-5b)
- The [Security operations team] shall disseminate security alerts, advisories and directives to [Select one or more: [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined elements]; [Assignment: organization-defined external organizations]. Typical: system owners and system administrators, the security operations and incident response teams, and the service providers who operate systems for the organization, where an alert affects them]. (SI-5c)
- The [System owner] shall implement security directives in accordance with their established time frames, or notify the issuing organization of the degree of noncompliance. (SI-5d)

#### Federal systems

The Federal Information Security Modernization Act requires the head of each agency to comply with the binding operational directives and emergency directives the Secretary of Homeland Security issues under 44 U.S.C. § 3553(b) and (h) ([44 U.S.C. § 3554(a)(1)(B)(ii) and (v)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)). CISA publishes them on its [Cybersecurity Directives](https://www.cisa.gov/directives) page; they do not apply to national security systems. As of September 2026.

- The [Chief Information Security Officer] shall track each CISA binding operational directive and emergency directive that applies to the agency, and ensure system owners complete its required actions and reports within the time frames it sets. (SI-5d)

### Information management and retention (SI-12)

> **Guidance:** Retention applies to everything the system holds or produces: records, logs, backups, reports and exports. Records management usually owns the retention schedule; the system owner makes the system follow it, including deletion at the end of the period. For personally identifiable information, the retention periods also go in the privacy impact assessment.

- The [System owner] shall manage and retain information within the system, and information output from the system, in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements. (SI-12)
- The [System owner] shall document the retention period and the authority for it for each type of information the system holds, drawn from the organization's records retention schedule. (SI-12)
- The [System owner] shall dispose of information when its retention period ends, unless a legal hold or an approved extension applies. (SI-12)

#### Federal systems

The head of each federal agency must "make and preserve records containing adequate and proper documentation" of the agency's functions ([44 U.S.C. § 3101](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3101&num=0&edition=prelim)), and federal records "may not be alienated or destroyed" except under chapter 33 of title 44 ([44 U.S.C. § 3314](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3314&num=0&edition=prelim)): that is, under records schedules approved by the Archivist of the United States, including the General Records Schedules the Archivist issues for records common to several or all agencies ([44 U.S.C. § 3303a(d)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3303a&num=0&edition=prelim)). As of September 2026.

- The [System owner] shall retain and dispose of federal records in the system only as an approved agency records schedule or a General Records Schedule allows. (SI-12)

## Review and update

- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current system and information integrity policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current system and information integrity policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (SI-1c.1)
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current system and information integrity procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the system and information integrity procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (SI-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SI-1a.1(b))