# System and Information Integrity Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/si/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet SI-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the SI-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for System and Information Integrity, and who is accountable for meeting those requirements. (SI-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SI-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (SI-1a.1(a))
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (SI-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (SI-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (SI-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (SI-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SI-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (SI-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (SI-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (SI-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (SI-1a.1(a))

## Procedures

The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (SI-1a.2)

## Dissemination

- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the system and information integrity policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (SI-1a)
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the system and information integrity procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (SI-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Information management and retention (SI-12)

> **Guidance:** Retention applies to everything the system holds or produces: records, logs, backups, reports and exports. Records management usually owns the retention schedule; the system owner makes the system follow it, including deletion at the end of the period. For personally identifiable information, the retention periods also go in the privacy impact assessment.

- The [System owner] shall manage and retain information within the system, and information output from the system, in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements. (SI-12)
- The [System owner] shall document the retention period and the authority for it for each type of information the system holds, drawn from the organization's records retention schedule. (SI-12)
- The [System owner] shall dispose of information when its retention period ends, unless a legal hold or an approved extension applies. (SI-12)

#### Federal systems

The head of each federal agency must "make and preserve records containing adequate and proper documentation" of the agency's functions ([44 U.S.C. § 3101](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3101&num=0&edition=prelim)), and federal records "may not be alienated or destroyed" except under chapter 33 of title 44 ([44 U.S.C. § 3314](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3314&num=0&edition=prelim)): that is, under records schedules approved by the Archivist of the United States, including the General Records Schedules the Archivist issues for records common to several or all agencies ([44 U.S.C. § 3303a(d)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3303a&num=0&edition=prelim)). As of September 2026.

- The [System owner] shall retain and dispose of federal records in the system only as an approved agency records schedule or a General Records Schedule allows. (SI-12)

### Limit personally identifiable information elements (SI-12(1))

> **Guidance:** This is data minimization in the system itself: fields that are not needed are not collected, and fields no longer needed are removed. The minimization section of the [privacy impact assessment](https://kston83.github.io/nist-guide/templates/reports/privacy-impact-assessment/) records the elements considered and left out. SI-12(1) is in the Privacy baseline only.

- For a system that processes personally identifiable information, the [System owner] shall limit the personally identifiable information processed in the information life cycle to [Fill in: elements of personally identifiable information being processed in the information life cycle. Typical: the data elements the system's privacy impact assessment lists as needed for its stated purposes]. (SI-12(1))

### Minimize personally identifiable information in testing, training and research (SI-12(2))

> **Guidance:** Copies of production data in test and training environments are a common source of breaches, because those environments rarely have production's controls. The organization-wide rules and approvals are under PM-25. SI-12(2) is in the Privacy baseline only.

- The [System owner] shall use the following techniques to minimize the use of personally identifiable information for research: [Fill in: techniques used to minimize the use of personally identifiable information for research. Typical: de-identified or synthetic data, or where the research needs identifiable data, only the elements the senior privacy official approves]. (SI-12(2))
- The [System owner] shall use the following techniques to minimize the use of personally identifiable information for testing: [Fill in: techniques used to minimize the use of personally identifiable information for testing. Typical: synthetic data, or masked copies of production data]. (SI-12(2))
- The [System owner] shall use the following techniques to minimize the use of personally identifiable information for training: [Fill in: techniques used to minimize the use of personally identifiable information for training. Typical: fictitious or synthetic records]. (SI-12(2))

### Information disposal (SI-12(3))

> **Guidance:** Disposal at the end of the retention period covers every copy, including backups, exports and copies held by service providers. Sanitizing the media itself is MP-6. SI-12(3) is in the Privacy baseline only.

- The [System owner] shall use the following techniques to dispose of information following the retention period: [Fill in: techniques used to dispose of information following the retention period. Typical: deletion by the system's automated retention jobs, and shredding for paper output]. (SI-12(3))
- The [System owner] shall use the following techniques to destroy information following the retention period: [Fill in: techniques used to destroy information following the retention period. Typical: destruction of storage media by shredding, disintegration or incineration, as the media sanitization procedure sets out]. (SI-12(3))
- The [System owner] shall use the following techniques to erase information following the retention period: [Fill in: techniques used to erase information following the retention period. Typical: cryptographic erase or overwriting, as the media sanitization procedure sets out]. (SI-12(3))

### Personally identifiable information quality operations (SI-18)

> **Guidance:** Checks at collection include validating formats and confirming information with the individual. Periodic checks compare records with authoritative sources and flag records past their retention period. The organization-wide quality policies are under PM-22. SI-18 is in the Privacy baseline only.

- For a system that processes personally identifiable information, the [System owner] shall check the accuracy of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the accuracy of personally identifiable information across the information life cycle. Typical: at collection, and at least annually]. (SI-18a)
- For such a system, the [System owner] shall check the relevance of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the relevance of personally identifiable information across the information life cycle. Typical: at least annually, with the review of the privacy impact assessment]. (SI-18a)
- For such a system, the [System owner] shall check the timeliness of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the timeliness of personally identifiable information across the information life cycle. Typical: at least annually]. (SI-18a)
- For such a system, the [System owner] shall check the completeness of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the completeness of personally identifiable information across the information life cycle. Typical: at collection, and at least annually]. (SI-18a)
- For such a system, the [System owner] shall correct or delete inaccurate or outdated personally identifiable information. (SI-18b)

#### Federal systems

The Privacy Act requires each agency that maintains a system of records to maintain all records used in making any determination about an individual "with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination", and, before disseminating a record to anyone other than an agency (except under subsection (b)(2)), to make reasonable efforts to assure it is accurate, complete, timely and relevant for agency purposes ([5 U.S.C. § 552a(e)(5) and (e)(6)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). As of September 2026.

- For each system of records, the [System owner] shall maintain records used in making determinations about individuals with the accuracy, relevance, timeliness and completeness 5 U.S.C. § 552a(e)(5) requires. (SI-18a)
- Before disseminating a record from a system of records to anyone other than an agency, except under 5 U.S.C. § 552a(b)(2), the [System owner] shall make reasonable efforts to assure the record is accurate, complete, timely and relevant for agency purposes. (SI-18a)

### Individual requests (SI-18(4))

> **Guidance:** The privacy notice tells individuals how to ask for a correction; this clause makes the system able to carry it out, including in copies shared with others where PM-22 requires notifying them. SI-18(4) is in the Privacy baseline only.

- For a system that processes personally identifiable information, the [System owner] shall correct or delete personally identifiable information upon request by individuals or their designated representatives, once the request is verified and approved. (SI-18(4))
- The [Senior privacy official] shall ensure each request to correct or delete personally identifiable information is answered, and that a refusal is given in writing with the reason and how to appeal. (SI-18(4))

#### Federal systems

For records in a system of records, the Privacy Act lets an individual request amendment of a record about them. The agency must acknowledge the request in writing "not later than 10 days (excluding Saturdays, Sundays, and legal public holidays)" after receiving it, and then promptly either make the correction or tell the individual of its refusal, the reasons, and how to request a review. A review of a refusal must be completed within 30 days, excluding Saturdays, Sundays and legal public holidays, unless the agency head extends the period for good cause ([5 U.S.C. § 552a(d)(2) and (d)(3)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). Subsections (j) and (k) let an agency exempt some systems of records from these provisions by rule. As of September 2026.

- For each system of records, the [Senior privacy official] shall acknowledge each request to amend a record in writing within 10 days, excluding Saturdays, Sundays and legal public holidays, and then promptly correct the record or explain the refusal and how to request a review. (SI-18(4))
- The [Senior privacy official] shall complete the review of a refused amendment within 30 days, excluding Saturdays, Sundays and legal public holidays, unless the agency head extends the period for good cause. (SI-18(4))

### De-identification (SI-19)

> **Guidance:** Removing direct identifiers is rarely enough: combinations of indirect identifiers, such as postal code, birth date and sex, can re-identify people. Evaluating effectiveness means testing for that risk, especially before a dataset is published. NIST SP 800-188, De-Identifying Government Datasets: Techniques and Governance (September 2023, final as of September 2026), describes the techniques and governance. SI-19 is in the Privacy baseline only.

- The [System owner] shall remove the following elements of personally identifiable information from datasets that are to be de-identified: [Fill in: elements of personally identifiable information to be removed from datasets. Typical: direct identifiers such as names, addresses, identification numbers, contact details and full dates of birth, and any indirect identifiers the privacy review finds could re-identify individuals]. (SI-19a)
- The [Senior privacy official] shall evaluate the effectiveness of de-identification [Fill in: the frequency at which to evaluate the effectiveness of de-identification. Typical: annually, and before each new release of a de-identified dataset]. (SI-19b)

## Review and update

- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current system and information integrity policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current system and information integrity policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (SI-1c.1)
- The [Fill in: an official to manage the system and information integrity policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current system and information integrity procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the system and information integrity procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (SI-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SI-1a.1(b))