SI-14(2)

Requirement
1. [Selection: Refresh [Assignment: organization-defined information][Assignment: organization-defined frequency]; Generate [Assignment: organization-defined information] on demand]; and
2. Delete information when no longer needed.

Discussion

Retaining information longer than is needed makes the information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides advanced adversaries information that can assist in their reconnaissance and lateral movement through the system.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing non-persistence for system components; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for ensuring that information is and remains non-persistent; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for ensuring that information is and remains non-persistent; automated mechanisms supporting and/or implementing component and service refreshes].

ID	Assessment Objectives
SI-14(02)(a)	<SI-14(02)_ODP[01] SELECTED PARAMETER VALUE> is performed;
SI-14(02)(b)	information is deleted when no longer needed.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!