System and Information Integrity Policy

System and Information Integrity Policy template: Ready-to-adopt System and Information Integrity policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The System and Information Integrity policy states what the organization requires for system and information integrity and who is accountable for it. It meets SI-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. SI-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
SI-1	Policy and Procedures	Yes	Yes	Yes	Yes
SI-2	Flaw Remediation	Yes	Yes	Yes
SI-2(2)	Automated Flaw Remediation Status		Yes	Yes
SI-3	Malicious Code Protection	Yes	Yes	Yes
SI-4	System Monitoring	Yes	Yes	Yes
SI-4(2)	Automated Tools and Mechanisms for Real-time Analysis		Yes	Yes
SI-4(4)	Inbound and Outbound Communications Traffic		Yes	Yes
SI-4(5)	System-generated Alerts		Yes	Yes
SI-4(10)	Visibility of Encrypted Communications			Yes
SI-4(12)	Automated Organization-generated Alerts			Yes
SI-4(14)	Wireless Intrusion Detection			Yes
SI-4(20)	Privileged Users			Yes
SI-4(22)	Unauthorized Network Services			Yes
SI-5	Security Alerts, Advisories, and Directives	Yes	Yes	Yes
SI-5(1)	Automated Alerts and Advisories			Yes
SI-6	Security and Privacy Function Verification			Yes
SI-7	Software, Firmware, and Information Integrity		Yes	Yes
SI-7(1)	Integrity Checks		Yes	Yes
SI-7(2)	Automated Notifications of Integrity Violations			Yes
SI-7(5)	Automated Response to Integrity Violations			Yes
SI-7(7)	Integration of Detection and Response		Yes	Yes
SI-7(15)	Code Authentication			Yes
SI-8	Spam Protection		Yes	Yes
SI-8(2)	Automatic Updates		Yes	Yes
SI-10	Information Input Validation		Yes	Yes
SI-11	Error Handling		Yes	Yes
SI-12	Information Management and Retention	Yes	Yes	Yes	Yes
SI-12(1)	Limit Personally Identifiable Information Elements				Yes
SI-12(2)	Minimize Personally Identifiable Information in Testing, Training, and Research				Yes
SI-12(3)	Information Disposal				Yes
SI-16	Memory Protection		Yes	Yes
SI-18	Personally Identifiable Information Quality Operations				Yes
SI-18(4)	Individual Requests				Yes
SI-19	De-identification				Yes

Decisions to make first

The policy has 92 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who installs updates for each kind of component, and how are urgent updates approved?	SI-2, SI-2(2)	The IT operations team patches operating systems and common software monthly as standard changes; application teams update their own code and libraries; updates for known exploited vulnerabilities go through the emergency change process.	Chief Information Security Officer, with the change control board
Where do monitoring data and alerts go, and who triages them, at what hours?	SI-4, SI-4(2), SI-4(5)	A central security information and event management (SIEM) platform, triaged around the clock by the security operations team or a managed security service.	Chief Information Security Officer
Which malicious code, spam and monitoring protections are common controls, and which does each system own?	SI-3, SI-4, SI-8	Endpoint detection and response, the email gateway and the SIEM platform are common controls; each system owner makes sure every component runs the agent and sends its logs, and owns application-specific detections.	Chief Information Security Officer
Is encrypted traffic decrypted for inspection, and which categories are exempt?	SI-4(10)	Decrypted at the internet boundary proxy, with health, financial and similar personal categories exempt, as approved by legal counsel and the senior privacy official.	Chief Information Security Officer, with legal counsel and the senior privacy official
Where are retention periods set for each type of information, and who confirms information is disposed of at the end?	SI-12, SI-12(3)	In the organization’s records retention schedule, owned by records management; each system security plan and privacy impact assessment names the periods that apply, and the system owner confirms disposal each year.	System owner, with records management

Record your values in the System and Information Integrity decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: SI pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet SI-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the SI-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for System and Information Integrity, and who is accountable for meeting those requirements. (SI-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SI-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (SI-1a.1(a))
• The Fill in: an official to manage the system and information integrity policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (SI-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (SI-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (SI-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (SI-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SI-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (SI-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (SI-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (SI-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (SI-1a.1(a))

Procedures

The Fill in: an official to manage the system and information integrity policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (SI-1a.2)

Dissemination

• The Fill in: an official to manage the system and information integrity policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the system and information integrity policy is to be disseminated Typical: everyone within its scope, through the policy library. (SI-1a)
• The Fill in: an official to manage the system and information integrity policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the system and information integrity procedures are to be disseminated Typical: the people who carry them out, and the system owners. (SI-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Flaw remediation (SI-2)

Guidance

SI-2 is the fixing half of vulnerability management: RA-5 finds the flaws, and SI-2 installs the updates that correct them. The installation times here count from the release of the update, while the RA-5 remediation times count from when a finding is reported, so keep the two sets of values consistent. The Patch and Flaw Remediation Standard sets the test groups, deployment rings and schedules. NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning (April 2022, current as of September 2026), describes how to plan patching as routine preventive maintenance.

• The System owner shall identify system flaws from vulnerability scanning and monitoring, vendor security advisories, assessments and incident analysis. (SI-2a)
• The System owner shall report identified flaws that affect the system to the Security operations team and record each in the system’s flaw tracking. (SI-2a)
• The System owner shall correct identified system flaws. (SI-2a)
• The System owner shall test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installing them in production. (SI-2b)
• The System owner shall install security-relevant software and firmware updates within Fill in: time period within which to install security-relevant software updates after the release of the updates Typical: known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days of the release of the updates. (SI-2c)
• The System owner shall enter any security-relevant update that cannot be installed in time in the system’s plan of action and milestones, with a planned date and any compensating measures, before its installation time ends. (SI-2c)
• The System owner shall incorporate flaw remediation into the organization’s configuration management process, recording routine updates as standard changes and urgent updates as emergency changes. (SI-2d)

Guidance

Unsupported software and firmware cannot be fixed. Record each unsupported component as a flaw, with a replacement date in the plan of action and milestones, until it is removed (SA-22).

Federal systems

CISA BOD 26-04, Prioritizing Security Updates Based on Risk (June 10, 2026), sets remediation deadlines for federal civilian agencies by whether an asset is publicly exposed, whether the vulnerability is in CISA’s Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated, and its technical impact, from 3 days to “fix on system upgrade”. Its clock starts when CISA adds a vulnerability to the KEV catalog or the agency identifies it, whichever is first. It revoked BOD 22-01 and BOD 19-02. It does not apply to national security systems. As of September 2026.

• The System owner shall set the SI-2c installation times no longer than the deadlines CISA BOD 26-04 sets, and install security updates within those deadlines. (SI-2c)

Automated flaw remediation status (SI-2(2))

Guidance

Patch compliance reports from the patch management tool, checked against authenticated vulnerability scans, show which components are missing updates. Components the tools cannot reach, such as appliances, need a manual check on the same schedule.

• The System owner shall determine whether system components have applicable security-relevant software and firmware updates installed, using Fill in: automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components Typical: the patch management and vulnerability scanning tools, Fill in: the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components Typical: at least weekly. (SI-2(2))

Federal systems

CISA BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks (October 3, 2022), requires federal civilian agencies to perform automated asset discovery every 7 days and to initiate vulnerability enumeration across all discovered assets, including roaming devices such as laptops, every 14 days. As of September 2026.

• The System owner shall ensure the system’s assets are covered by automated asset discovery at least every 7 days and by vulnerability enumeration at least every 14 days, as CISA BOD 23-01 requires. (SI-2(2))

Malicious code protection (SI-3)

Guidance

Endpoint detection and response on servers and workstations, together with malware scanning in the email and web gateways, usually covers system entry and exit points. Non-signature-based means behavior or reputation analysis, which catches malware no signature yet describes. Enterprise tools are often common controls; the system owner makes sure every component that can run an agent has one.

• The System owner shall implement Select one or more: signature-based; non-signature-based Typical: signature-based and non-signature-based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. (SI-3a)
• The System owner shall ensure malicious code protection mechanisms update automatically as new releases are available, in accordance with the organization’s configuration management policy and procedures. (SI-3b)
• The System owner shall configure malicious code protection mechanisms to perform periodic scans of the system Fill in: the frequency at which malicious code protection mechanisms perform scans Typical: at least weekly. (SI-3c.1)
• The System owner shall configure malicious code protection mechanisms to perform real-time scans of files from external sources at Select one or more: endpoint; network entry and exit points Typical: endpoint and network entry and exit points as the files are downloaded, opened or executed. (SI-3c.1)
• The System owner shall configure malicious code protection mechanisms to Select one or more: block malicious code; quarantine malicious code; take [Assignment: organization-defined action] Typical: block and quarantine malicious code and to send an alert to Fill in: personnel or roles to be alerted when malicious code is detected Typical: the security operations team when malicious code is detected. (SI-3c.2)
• The Security operations team shall review reported false positives, approve any scan exclusion with a documented reason and an expiry date, and record the effect of false positives on the availability of the system. (SI-3d)

System monitoring (SI-4)

Guidance

System monitoring takes in the audit records reviewed under AU-6 and adds endpoint, network and cloud detection. The System Monitoring Standard sets the log sources, detection coverage, alert handling and reporting. Legal review of monitoring (SI-4f) is usually done once for the organization’s monitoring program and repeated when monitoring changes, with a system use notification under AC-8.

• The Security operations team shall monitor the system to detect attacks and indicators of potential attacks in accordance with the following monitoring objectives: Fill in: monitoring objectives to detect attacks and indicators of potential attacks on the system Typical: detecting attacks, malware, unauthorized access, privilege misuse and data exfiltration. (SI-4a.1)
• The Security operations team shall monitor the system to detect unauthorized local, network and remote connections. (SI-4a.2)
• The Security operations team shall identify unauthorized use of the system through Fill in: techniques and methods used to identify unauthorized use of the system Typical: log correlation in the security information and event management (SIEM) platform, endpoint detection and response, network intrusion detection and user behavior analytics. (SI-4b)
• The System owner shall ensure monitoring capabilities are deployed strategically within the system to collect the essential information the monitoring objectives call for, including at the managed interfaces under SC-7. (SI-4c.1)
• The System owner shall ensure monitoring capabilities can be deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization. (SI-4c.2)
• The Security operations team shall analyze detected events and anomalies, and refer suspected incidents to the Incident response team. (SI-4d)
• The Chief Information Security Officer shall adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations or the Nation. (SI-4e)
• The Chief Information Security Officer shall obtain a legal opinion on system monitoring activities before they begin and whenever they change significantly. (SI-4f)
• The Security operations team shall provide Fill in: system monitoring information to be provided to personnel or roles Typical: alerts and monitoring reports to Fill in: personnel or roles to whom system monitoring information is to be provided Typical: the system owner and the incident response team, Select one or more: as needed; [Assignment: organization-defined frequency] Typical: as needed, and at least monthly. (SI-4g)

Federal systems

OMB M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded M-21-31. It directs agencies to prioritize two logging objectives, continuous event monitoring and threat hunting, investigation, response and forensics, for all information systems owned or operated by the agency or by third parties on its behalf, and to adhere to CISA’s Logging Reference Architecture (published August 20, 2026). Its Appendix B requires logs that support monitoring for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, with automated alerts, and that are readily available to the agency’s top-level security operations center. It does not apply to national security systems. As of September 2026.

• The System owner shall ensure the system’s logs are readily available to the agency’s top-level security operations center, as OMB M-26-14 requires. (SI-4c.1)
• The Security operations team shall use the system’s logs to monitor for suspicious activity identified by security tooling, known indicators of compromise and anomalous system or user activity, and generate automated alerts for them, as OMB M-26-14 Appendix B requires. (SI-4a.1)
• In the event of a known or suspected compromise, the Chief Information Security Officer shall provide logs and other relevant data to CISA and the FBI on request, to the extent consistent with applicable law, as OMB M-26-14 requires. (SI-4g)

Automated tools and mechanisms for real-time analysis (SI-4(2))

Guidance

Correlation rules and analytics in the SIEM, and the detection engines in endpoint and network tools, are the automated tools. Near real-time means minutes, not the next day’s review.

• The Security operations team shall employ automated tools and mechanisms, such as correlation rules in the SIEM platform and endpoint detection and response, to support near real-time analysis of events. (SI-4(2))

Inbound and outbound communications traffic (SI-4(4))

Guidance

Outbound monitoring is where data exfiltration and command-and-control traffic show up. Threat intelligence feeds supply the known malicious sources and destinations; a baseline of normal volumes supplies the unusual ones.

• The Security operations team shall determine and document criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic. (SI-4(4)(a))
• The Security operations team shall monitor inbound communications traffic Fill in: the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions Typical: continuously for Fill in: unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic Typical: connections from known malicious sources, unapproved protocols and ports, and scanning or password-guessing patterns. (SI-4(4)(b))
• The Security operations team shall monitor outbound communications traffic Fill in: the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions Typical: continuously for Fill in: unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic Typical: connections to known malicious destinations, unusual data volumes, unapproved protocols and regular beaconing to external hosts. (SI-4(4)(b))

System-generated alerts (SI-4(5))

• The System owner shall ensure the system alerts Fill in: personnel or roles to be alerted when indications of compromise or potential compromise occur Typical: the security operations team when the following system-generated indications of compromise or potential compromise occur: Fill in: compromise indicators Typical: indicators of compromise from the detection tools and threat intelligence feeds. (SI-4(5))

Security alerts, advisories and directives (SI-5)

Guidance

Subscribing to the CISA advisories and the vendor security bulletins for every product in the component inventory (CM-8) is the usual starting point. The value is in routing: each alert reaches the people who run the affected component, with a due date.

• The Security operations team shall receive system security alerts, advisories and directives from Fill in: external organizations from whom system security alerts, advisories, and directives are to be received on an ongoing basis Typical: CISA, the vendors of the system’s components, and the organization’s information sharing and analysis center on an ongoing basis. (SI-5a)
• The Security operations team shall generate internal security alerts, advisories and directives as deemed necessary. (SI-5b)
• The Security operations team shall disseminate security alerts, advisories and directives to Select one or more: [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined elements]; [Assignment: organization-defined external organizations] Typical: system owners and system administrators, the security operations and incident response teams, and the service providers who operate systems for the organization, where an alert affects them. (SI-5c)
• The System owner shall implement security directives in accordance with their established time frames, or notify the issuing organization of the degree of noncompliance. (SI-5d)

Federal systems

The Federal Information Security Modernization Act requires the head of each agency to comply with the binding operational directives and emergency directives the Secretary of Homeland Security issues under 44 U.S.C. § 3553(b) and (h) (44 U.S.C. § 3554(a)(1)(B)(ii) and (v)). CISA publishes them on its Cybersecurity Directives page; they do not apply to national security systems. As of September 2026.

• The Chief Information Security Officer shall track each CISA binding operational directive and emergency directive that applies to the agency, and ensure system owners complete its required actions and reports within the time frames it sets. (SI-5d)

Software, firmware and information integrity (SI-7)

Guidance

File integrity monitoring, signed and verified container images, secure boot and measured boot are the usual integrity verification tools. Changes approved under CM-3 are expected; integrity verification finds the ones that were not.

• The System owner shall employ integrity verification tools to detect unauthorized changes to the following software: Fill in: software requiring integrity verification tools to be employed to detect unauthorized changes Typical: operating system files, installed applications, container images and security tool binaries. (SI-7a)
• The System owner shall employ integrity verification tools to detect unauthorized changes to the following firmware: Fill in: firmware requiring integrity verification tools to be employed to detect unauthorized changes Typical: server, network device and endpoint firmware and boot components, where the platform supports verification. (SI-7a)
• The System owner shall employ integrity verification tools to detect unauthorized changes to the following information: Fill in: information requiring integrity verification tools to be employed to detect unauthorized changes Typical: security configuration files, audit logs, and the critical data stores named in the system security plan. (SI-7a)
• When unauthorized changes to software are detected, the System owner shall Fill in: actions to be taken when unauthorized changes to software are detected Typical: alert the security operations team, restore the approved version, and handle an unauthorized change as a suspected incident. (SI-7b)
• When unauthorized changes to firmware are detected, the System owner shall Fill in: actions to be taken when unauthorized changes to firmware are detected Typical: alert the security operations team, restore the approved firmware, and handle an unauthorized change as a suspected incident. (SI-7b)
• When unauthorized changes to information are detected, the System owner shall Fill in: actions to be taken when unauthorized changes to information are detected Typical: alert the security operations team and the information owner, restore the information from a trusted source or backup, and handle an unauthorized change as a suspected incident. (SI-7b)

Integrity checks (SI-7(1))

• The System owner shall perform an integrity check of Fill in: software on which an integrity check is to be performed Typical: the software named for integrity verification under SI-7 Select one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency] Typical: at startup, after each update or change to the software, and at least weekly. (SI-7(1))
• The System owner shall perform an integrity check of Fill in: firmware on which an integrity check is to be performed Typical: the firmware named for integrity verification under SI-7 Select one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency] Typical: at startup, after each firmware update, and at least monthly. (SI-7(1))
• The System owner shall perform an integrity check of Fill in: information on which an integrity check is to be performed Typical: the information named for integrity verification under SI-7 Select one or more: at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency] Typical: after each authorized change to the information, and at least daily. (SI-7(1))

Integration of detection and response (SI-7(7))

• The System owner shall incorporate the detection of the following unauthorized changes into the organization’s incident response capability: Fill in: security-relevant changes to the system Typical: unauthorized changes to operating system and application files, security configuration settings, firmware and audit logging settings. (SI-7(7))

Spam protection (SI-8)

Guidance

Spam protection sits in the email gateway or the cloud email service’s filtering, and in some cases in web or messaging gateways. Publishing SPF, DKIM and DMARC records for the organization’s own domains helps other organizations reject mail that spoofs them.

• The System owner shall employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages. (SI-8a)
• The System owner shall update spam protection mechanisms when new releases are available, in accordance with the organization’s configuration management policy and procedures. (SI-8b)

Federal systems

CISA BOD 18-01, Enhance Email and Web Security (October 16, 2017), requires federal civilian agencies to have valid SPF and DMARC records for all second-level agency domains, to set a DMARC policy of “reject” for all second-level domains and mail-sending hosts, and to add the address the directive designates (reports@dmarc.cyber.dhs.gov) as a recipient of DMARC aggregate reports. As of September 2026.

• The System owner shall ensure each second-level domain the system uses has valid SPF and DMARC records, with a DMARC policy of reject for the domain and its mail-sending hosts, as CISA BOD 18-01 requires. (SI-8a)
• The System owner shall include reports@dmarc.cyber.dhs.gov as a recipient of the domain’s DMARC aggregate reports, as CISA BOD 18-01 requires. (SI-8a)

Automatic updates (SI-8(2))

• The System owner shall ensure spam protection mechanisms are updated automatically Fill in: the frequency at which to automatically update spam protection mechanisms Typical: as the vendor releases updates, and at least daily. (SI-8(2))

Information input validation (SI-10)

Guidance

Validate on the server, against an allow list of expected type, length, format and range, and keep data separate from commands (for example, parameterized database queries). Code review and application security testing (SA-11) are where assessors look for evidence.

• The System owner shall ensure the system checks the validity of Fill in: information inputs to the system requiring validity checks Typical: all inputs from users, external systems and interfaces, including web forms, API requests, file uploads and query parameters. (SI-10)

Error handling (SI-11)

Guidance

Users see a short message and a reference number; the detail, such as stack traces, database errors and internal paths, goes to the logs. Login and password reset messages should not reveal whether an account exists.

• The System owner shall ensure the system generates error messages that provide the information needed for corrective action without revealing information that could be exploited. (SI-11a)
• The System owner shall ensure the system reveals detailed error messages only to Fill in: personnel or roles to whom error messages are to be revealed Typical: system administrators and developers with a need to know, through the system’s logs. (SI-11b)

Information management and retention (SI-12)

Guidance

Retention applies to everything the system holds or produces: records, logs, backups, reports and exports. Records management usually owns the retention schedule; the system owner makes the system follow it, including deletion at the end of the period. For personally identifiable information, the retention periods also go in the privacy impact assessment.

• The System owner shall manage and retain information within the system, and information output from the system, in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements. (SI-12)
• The System owner shall document the retention period and the authority for it for each type of information the system holds, drawn from the organization’s records retention schedule. (SI-12)
• The System owner shall dispose of information when its retention period ends, unless a legal hold or an approved extension applies. (SI-12)

Federal systems

The head of each federal agency must “make and preserve records containing adequate and proper documentation” of the agency’s functions (44 U.S.C. § 3101), and federal records “may not be alienated or destroyed” except under chapter 33 of title 44 (44 U.S.C. § 3314): that is, under records schedules approved by the Archivist of the United States, including the General Records Schedules the Archivist issues for records common to several or all agencies (44 U.S.C. § 3303a(d)). As of September 2026.

• The System owner shall retain and dispose of federal records in the system only as an approved agency records schedule or a General Records Schedule allows. (SI-12)

Memory protection (SI-16)

Guidance

Modern operating systems provide these protections by default; the evidence is a configuration baseline (CM-6) that keeps them enabled and a scan that shows no exceptions.

• The System owner shall implement the following controls to protect the system memory from unauthorized code execution: Fill in: controls to be implemented to protect the system memory from unauthorized code execution Typical: data execution prevention and address space layout randomization, enforced by the operating system and hardware. (SI-16)

Review and update

• The Fill in: an official to manage the system and information integrity policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current system and information integrity policy is reviewed and updated Typical: annually and following Fill in: events that would require the current system and information integrity policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (SI-1c.1)
• The Fill in: an official to manage the system and information integrity policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current system and information integrity procedures are reviewed and updated Typical: annually and following Fill in: events that would require the system and information integrity procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (SI-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SI-1a.1(b))