System and Information Integrity Decision Worksheet

System and Information Integrity Decision Worksheet template: Every decision the System and Information Integrity family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the System and Information Integrity family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every SI control in the baseline, with a typical value where the System and Information Integrity Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

62 decisions.

Decision	Control	Typical value	Who decides
Who installs updates for each kind of component, and how are urgent updates approved?	SI-2, SI-2(2)	The IT operations team patches operating systems and common software monthly as standard changes; application teams update their own code and libraries; updates for known exploited vulnerabilities go through the emergency change process.	Chief Information Security Officer, with the change control board
Where do monitoring data and alerts go, and who triages them, at what hours?	SI-4, SI-4(2), SI-4(5)	A central security information and event management (SIEM) platform, triaged around the clock by the security operations team or a managed security service.	Chief Information Security Officer
Which malicious code, spam and monitoring protections are common controls, and which does each system own?	SI-3, SI-4, SI-8	Endpoint detection and response, the email gateway and the SIEM platform are common controls; each system owner makes sure every component runs the agent and sends its logs, and owns application-specific detections.	Chief Information Security Officer
Is encrypted traffic decrypted for inspection, and which categories are exempt?	SI-4(10)	Decrypted at the internet boundary proxy, with health, financial and similar personal categories exempt, as approved by legal counsel and the senior privacy official.	Chief Information Security Officer, with legal counsel and the senior privacy official
Where are retention periods set for each type of information, and who confirms information is disposed of at the end?	SI-12, SI-12(3)	In the organization’s records retention schedule, owned by records management; each system security plan and privacy impact assessment names the periods that apply, and the system owner confirms disposal each year.	System owner, with records management
Personnel or roles to whom the system and information integrity policy is to be disseminated	SI-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the system and information integrity procedures are to be disseminated	SI-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	SI-1	Organization-level	Chief Information Security Officer
An official to manage the system and information integrity policy and procedures	SI-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current system and information integrity policy is reviewed and updated	SI-1	Annually	Chief Information Security Officer
Events that would require the current system and information integrity policy to be reviewed and updated	SI-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current system and information integrity procedures are reviewed and updated	SI-1	Annually	Chief Information Security Officer
Events that would require the system and information integrity procedures to be reviewed and updated	SI-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Time period within which to install security-relevant software updates after the release of the updates	SI-2	Known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days	Chief Information Security Officer
Automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components	SI-2(2)	The patch management and vulnerability scanning tools	Chief Information Security Officer
The frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components	SI-2(2)	At least weekly	Chief Information Security Officer
Select one or more: signature-based; non-signature-based	SI-3	Signature-based and non-signature-based	Chief Information Security Officer
The frequency at which malicious code protection mechanisms perform scans	SI-3	At least weekly	Chief Information Security Officer
Select one or more: endpoint; network entry and exit points	SI-3	Endpoint and network entry and exit points	Chief Information Security Officer
Select one or more: block malicious code; quarantine malicious code; take organization-defined action (see its row below)	SI-3	Block and quarantine malicious code	Chief Information Security Officer
Action to be taken in response to malicious code detection	SI-3	See the selection above	Chief Information Security Officer
Personnel or roles to be alerted when malicious code is detected	SI-3	The security operations team	Chief Information Security Officer
Monitoring objectives to detect attacks and indicators of potential attacks on the system	SI-4	Detecting attacks, malware, unauthorized access, privilege misuse and data exfiltration	Chief Information Security Officer
Techniques and methods used to identify unauthorized use of the system	SI-4	Log correlation in the security information and event management (SIEM) platform, endpoint detection and response, network intrusion detection and user behavior analytics	Chief Information Security Officer
System monitoring information to be provided to personnel or roles	SI-4	Alerts and monitoring reports	Chief Information Security Officer
Personnel or roles to whom system monitoring information is to be provided	SI-4	The system owner and the incident response team	Chief Information Security Officer
Select one or more: as needed; organization-defined frequency (see its row below)	SI-4	As needed, and at least monthly	Chief Information Security Officer
A frequency for providing system monitoring to personnel or roles	SI-4	At least monthly	Chief Information Security Officer
The frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions	SI-4(4)	Continuously	Chief Information Security Officer
Unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic	SI-4(4)	Connections from known malicious sources, unapproved protocols and ports, and scanning or password-guessing patterns	Chief Information Security Officer
The frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions	SI-4(4)	Continuously	Chief Information Security Officer
Unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic	SI-4(4)	Connections to known malicious destinations, unusual data volumes, unapproved protocols and regular beaconing to external hosts	Chief Information Security Officer
Personnel or roles to be alerted when indications of compromise or potential compromise occur	SI-4(5)	The security operations team	Chief Information Security Officer
Compromise indicators	SI-4(5)	Indicators of compromise from the detection tools and threat intelligence feeds	Chief Information Security Officer
External organizations from whom system security alerts, advisories, and directives are to be received on an ongoing basis	SI-5	CISA, the vendors of the system’s components, and the organization’s information sharing and analysis center	Chief Information Security Officer
Select one or more: organization-defined personnel or roles (see its row below); organization-defined elements (see its row below); organization-defined external organizations (see its row below)	SI-5	System owners and system administrators, the security operations and incident response teams, and the service providers who operate systems for the organization, where an alert affects them	Chief Information Security Officer
Personnel or roles to whom security alerts, advisories, and directives are to be disseminated	SI-5	System owners and system administrators	Chief Information Security Officer
Elements within the organization to whom security alerts, advisories, and directives are to be disseminated	SI-5	The security operations and incident response teams	Chief Information Security Officer
External organizations to whom security alerts, advisories, and directives are to be disseminated	SI-5	The service providers who operate systems for the organization, where an alert affects them	Chief Information Security Officer
Software requiring integrity verification tools to be employed to detect unauthorized changes	SI-7	Operating system files, installed applications, container images and security tool binaries	Chief Information Security Officer
Firmware requiring integrity verification tools to be employed to detect unauthorized changes	SI-7	Server, network device and endpoint firmware and boot components, where the platform supports verification	Chief Information Security Officer
Information requiring integrity verification tools to be employed to detect unauthorized changes	SI-7	Security configuration files, audit logs, and the critical data stores named in the system security plan	Chief Information Security Officer
Actions to be taken when unauthorized changes to software are detected	SI-7	Alert the security operations team, restore the approved version, and handle an unauthorized change as a suspected incident	Chief Information Security Officer
Actions to be taken when unauthorized changes to firmware are detected	SI-7	Alert the security operations team, restore the approved firmware, and handle an unauthorized change as a suspected incident	Chief Information Security Officer
Actions to be taken when unauthorized changes to information are detected	SI-7	Alert the security operations team and the information owner, restore the information from a trusted source or backup, and handle an unauthorized change as a suspected incident	Chief Information Security Officer
Software on which an integrity check is to be performed	SI-7(1)	The software named for integrity verification under SI-7	Chief Information Security Officer
Select one or more: at startup; at organization-defined transitional states or security-relevant events (see its row below); organization-defined frequency (see its row below)	SI-7(1)	At startup, after each update or change to the software, and at least weekly	Chief Information Security Officer
Transitional states or security-relevant events requiring integrity checks (on software)	SI-7(1)	Each update or change to the software	Chief Information Security Officer
Frequency with which to perform an integrity check (on software)	SI-7(1)	At least weekly	Chief Information Security Officer
Firmware on which an integrity check is to be performed	SI-7(1)	The firmware named for integrity verification under SI-7	Chief Information Security Officer
Select one or more: at startup; at organization-defined transitional states or security-relevant events (see its row below); organization-defined frequency (see its row below)	SI-7(1)	At startup, after each firmware update, and at least monthly	Chief Information Security Officer
Transitional states or security-relevant events requiring integrity checks (on firmware)	SI-7(1)	Each firmware update	Chief Information Security Officer
Frequency with which to perform an integrity check (on firmware)	SI-7(1)	At least monthly	Chief Information Security Officer
Information on which an integrity check is to be performed	SI-7(1)	The information named for integrity verification under SI-7	Chief Information Security Officer
Select one or more: at startup; at organization-defined transitional states or security-relevant events (see its row below); organization-defined frequency (see its row below)	SI-7(1)	After each authorized change to the information, and at least daily	Chief Information Security Officer
Transitional states or security-relevant events requiring integrity checks (of information)	SI-7(1)	Each authorized change to the information	Chief Information Security Officer
Frequency with which to perform an integrity check (of information)	SI-7(1)	At least daily	Chief Information Security Officer
Security-relevant changes to the system	SI-7(7)	Unauthorized changes to operating system and application files, security configuration settings, firmware and audit logging settings	Chief Information Security Officer
The frequency at which to automatically update spam protection mechanisms	SI-8(2)	As the vendor releases updates, and at least daily	Chief Information Security Officer
Information inputs to the system requiring validity checks	SI-10	All inputs from users, external systems and interfaces, including web forms, API requests, file uploads and query parameters	Chief Information Security Officer
Personnel or roles to whom error messages are to be revealed	SI-11	System administrators and developers with a need to know, through the system’s logs	Chief Information Security Officer
Controls to be implemented to protect the system memory from unauthorized code execution	SI-16	Data execution prevention and address space layout randomization, enforced by the operating system and hardware	Chief Information Security Officer