| name | SI-12_information-management-and-retention |
| description | Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directive |
| category | input-validation |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","si-12","si"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-20"] |
| chains_with | ["AC-16","AU-5","AU-11","CA-2","CA-3","CA-5","CA-6","CA-7","CA-9","CM-5"] |
| prerequisites | [] |
| severity_boost | {"AC-16":"Chain with AC-16 for comprehensive security coverage","AU-5":"Chain with AU-5 for comprehensive security coverage","AU-11":"Chain with AU-11 for comprehensive security coverage"} |
SI-12 Information Management and Retention
High-Level Description
Family: System and Information Integrity (SI)
Framework: NIST SP 800-53 Rev 5
Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information. The National Archives and Records Administration (NARA) provides federal policy and guidance on records retention and schedules. If organizations have a records management office, consider coordinating with records management personnel. Records produced from the output of implemented controls that may require management and retention include, but are not limited to: All XX-1, AC-6(9), AT-4, AU-12, CA-2, CA-3, CA-5, CA-6, CA-7, CA-8, CA-9, CM-2, CM-3, CM-4, CM-6, CM-8, CM-9, CM-12, CM-13, CP-2, IR-6, IR-8, MA-2, MA-4, PE-2, PE-8, PE-16, PE-17, PL-2, PL-4, PL-7, PL-8, PM-5, PM-8, PM-9, PM-18, PM-21, PM-27, PM-28, PM-30, PM-31, PS-2, PS-6, PS-7, PT-2, PT-3, PT-7, RA-2, RA-3, RA-5, RA-8, SA-4, SA-5, SA-8, SA-10, SI-4, SR-2, SR-4, SR-8.
What to Check
- Verify SI-12 Information Management and Retention is documented in SSP
