SI-21

Requirement

Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed.

Discussion

Retaining information for longer than it is needed makes it an increasingly valuable and enticing target for adversaries. Keeping information available for the minimum period of time needed to support organizational missions or business functions reduces the opportunity for adversaries to compromise, capture, and exfiltrate that information.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; procedures addressing software and information integrity; system design documentation; system configuration settings and associated documentation; information refresh procedures; list of information to be refreshed; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for refreshing information; organizational personnel with information security and privacy responsibilities; organizational personnel with systems security engineering responsibilities; system developers].

Test

[SELECT FROM: Mechanisms for information refresh; organizational processes for information refresh].

ID	Assessment Objectives
SI-21	the <SI-21_ODP[01] information> is refreshed <SI-21_ODP[02] frequencies> or is generated on demand and deleted when no longer needed.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!