Navigate

SI-12

SI-12: Information Handling and Retention

The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

Supplemental

Information handling and retention requirements cover the full life cycle of information, in some cases extending beyond the disposal of information systems. The National Archives and Records Administration provides guidance on records retention.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Privacy (CNSSI 1253), Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
PR.IP-2

Related Controls

The controls below (if any) were marked by NIST as being related to SI-12.

Control	Description
AC-16	The organization: a: Provides the means to associate [organization-defined types of security attributes] having [organization-defined security attribute values] with information in storage, in process, and/or in transmission; b: Ensures that the security attribute associations are made and retained with the information; c: Establishes the permitted [organization-defined security attributes] for [organization-defined information systems]; and d: Determines the permitted [organization-defined values or ranges] for each of the established security attributes.
AU-5	The information system: a: Alerts [organization-defined personnel or roles] in the event of an audit processing failure; and b: Takes the following additional actions: [organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)].
AU-11	The organization retains audit records for [organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
MP-2	The organization restricts access to [organization-defined types of digital and/or non-digital media] to [organization-defined personnel or roles].
MP-4	The organization: a: Physically controls and securely stores [organization-defined types of digital and/or non-digital media] within [organization-defined controlled areas]; and b: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Enhancements

The controls below (if any) add on to the requirements of SI-12.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SI-12.

CCI	Definition
CCI-001315	Manage information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
CCI-001678	Retain information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.