ComplianceNIST 800-53 control

NIST-SI-12 Information Management and Retention

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SI System and Information Integrity
Control
SI-12
ATT&CK techniques mitigated
35

Control statement

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Discussion

Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information. The National Archives and Records Administration (NARA) provides federal policy and guidance on records retention and schedules. If organizations have a records management office, consider coordinating with records management personnel. Records produced from the output of implemented controls that may require management and retention include, but are not limited to: All XX-1, [AC-6(9)](#ac-6.9), [AT-4](#at-4), [AU-12](#au-12), [CA-2](#ca-2), [CA-3](#ca-3), [CA-5](#ca-5), [CA-6](#ca-6), [CA-7](#ca-7), [CA-8](#ca-8), [CA-9](#ca-9), [CM-2](#cm-2), [CM-3](#cm-3), [CM-4](#cm-4), [CM-6](#cm-6), [CM-8](#cm-8), [CM-9](#cm-9), [CM-12](#cm-12), [CM-13](#cm-13), [CP-2](#cp-2), [IR-6](#ir-6), [IR-8](#ir-8), [MA-2](#ma-2), [MA-4](#ma-4), [PE-2](#pe-2), [PE-8](#pe-8), [PE-16](#pe-16), [PE-17](#pe-17), [PL-2](#pl-2), [PL-4](#pl-4), [PL-7](#pl-7), [PL-8](#pl-8), [PM-5](#pm-5), [PM-8](#pm-8), [PM-9](#pm-9), [PM-18](#pm-18), [PM-21](#pm-21), [PM-27](#pm-27), [PM-28](#pm-28), [PM-30](#pm-30), [PM-31](#pm-31), [PS-2](#ps-2), [PS-6](#ps-6), [PS-7](#ps-7), [PT-2](#pt-2), [PT-3](#pt-3), [PT-7](#pt-7), [RA-2](#ra-2), [RA-3](#ra-3), [RA-5](#ra-5), [RA-8](#ra-8), [SA-4](#sa-4), [SA-5](#sa-5), [SA-8](#sa-8), [SA-10](#sa-10), [SI-4](#si-4), [SR-2](#sr-2), [SR-4](#sr-4), [SR-8](#sr-8).

ATT&CK mappings (CTID)

• T1003 OS Credential Dumping • T1003.003 NTDS • T1020.001 Traffic Duplication • T1040 Network Sniffing • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.008 Clear Mailbox Data • T1070.008 Clear Mailbox Data • T1114 Email Collection • T1114.001 Local Email Collection • T1114.002 Remote Email Collection • T1114.003 Email Forwarding Rule • T1119 Automated Collection • T1213.004 Customer Relationship Management Software • T1530 Data from Cloud Storage • T1548 Abuse Elevation Control Mechanism • T1548.004 Elevated Execution with Prompt • T1550.001 Application Access Token • T1552 Unsecured Credentials • T1552.004 Private Keys • T1557 Adversary-in-the-Middle • T1557.002 ARP Cache Poisoning • T1557.004 Evil Twin • T1558 Steal or Forge Kerberos Tickets • T1558.002 Silver Ticket • T1558.003 Kerberoasting • T1558.004 AS-REP Roasting • T1558.005 Ccache Files • T1565 Data Manipulation • T1565.001 Stored Data Manipulation • T1565.002 Transmitted Data Manipulation • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump

Related

Mitigates · not in database (2)

Mitigates · MITRE ATT&CK (32)

  • T1557.004 Evil Twin sub-technique
  • T1558.005 Ccache Files sub-technique
  • T1213.004 Customer Relationship Management Software sub-technique
  • T1070.008 Clear Mailbox Data sub-technique
  • T1602.002 Network Device Configuration Dump sub-technique
  • T1020.001 Traffic Duplication sub-technique
  • T1602 Data from Configuration Repository technique
  • T1602.001 SNMP (MIB Dump) sub-technique
  • T1557.002 ARP Cache Poisoning sub-technique
  • T1558.004 AS-REP Roasting sub-technique
  • T1565 Data Manipulation technique
  • T1565.001 Stored Data Manipulation sub-technique
  • T1565.002 Transmitted Data Manipulation sub-technique
  • T1114.001 Local Email Collection sub-technique
  • T1114.002 Remote Email Collection sub-technique
  • T1114.003 Email Forwarding Rule sub-technique
  • T1003.003 NTDS sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1558 Steal or Forge Kerberos Tickets technique
  • T1558.002 Silver Ticket sub-technique
  • T1558.003 Kerberoasting sub-technique
  • T1552 Unsecured Credentials technique
  • T1552.004 Private Keys sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.004 Elevated Execution with Prompt sub-technique
  • T1550.001 Application Access Token sub-technique
  • T1530 Data from Cloud Storage technique
  • T1003 OS Credential Dumping technique
  • T1040 Network Sniffing technique
  • T1070 Indicator Removal technique
Show all 32 ›

Related control · Compliance (31)

  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AU-11 Audit Record Retention NIST 800-53 control
  • NIST-AU-5 Response to Audit Logging Process Failures NIST 800-53 control
  • NIST-CA-2 Control Assessments NIST 800-53 control
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CA-5 Plan of Action and Milestones NIST 800-53 control
  • NIST-CA-6 Authorization NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CA-9 Internal System Connections NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-IR-8 Incident Response Plan NIST 800-53 control
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-3 Media Marking NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-6 Media Sanitization NIST 800-53 control
  • NIST-PL-2 System Security and Privacy Plans NIST 800-53 control
  • NIST-PL-4 Rules of Behavior NIST 800-53 control
  • NIST-PM-4 Plan of Action and Milestones Process NIST 800-53 control
  • NIST-PM-8 Critical Infrastructure Plan NIST 800-53 control
  • NIST-PM-9 Risk Management Strategy NIST 800-53 control
  • NIST-PS-2 Position Risk Designation NIST 800-53 control
  • NIST-PS-6 Access Agreements NIST 800-53 control
  • NIST-PT-2 Authority to Process Personally Identifiable Information NIST 800-53 control
  • NIST-PT-3 Personally Identifiable Information Processing Purposes NIST 800-53 control
  • NIST-RA-2 Security Categorization NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
Show all 31 ›

Referenced by Compliance · enhancement of (3)

  • NIST-SI-12(1) Limit Personally Identifiable Information Elements NIST 800-53 enhancement
  • NIST-SI-12(2) Minimize Personally Identifiable Information in Testing, Training, and Research NIST 800-53 enhancement
  • NIST-SI-12(3) Information Disposal NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SI System and Information Integrity NIST 800-53 family

Referenced by Compliance · related control (56)

  • NIST-AC-1 Policy and Procedures NIST 800-53 control
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AT-1 Policy and Procedures NIST 800-53 control
  • NIST-AT-4 Training Records NIST 800-53 control
  • NIST-AU-1 Policy and Procedures NIST 800-53 control
  • NIST-AU-11 Audit Record Retention NIST 800-53 control
  • NIST-AU-5 Response to Audit Logging Process Failures NIST 800-53 control
  • NIST-CA-1 Policy and Procedures NIST 800-53 control
  • NIST-CA-2 Control Assessments NIST 800-53 control
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CA-5 Plan of Action and Milestones NIST 800-53 control
  • NIST-CA-6 Authorization NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CA-9 Internal System Connections NIST 800-53 control
  • NIST-CM-1 Policy and Procedures NIST 800-53 control
  • NIST-CM-5(1) Automated Access Enforcement and Audit Records NIST 800-53 enhancement
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-CP-1 Policy and Procedures NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-IA-1 Policy and Procedures NIST 800-53 control
  • NIST-IR-1 Policy and Procedures NIST 800-53 control
  • NIST-IR-8 Incident Response Plan NIST 800-53 control
  • NIST-MA-1 Policy and Procedures NIST 800-53 control
  • NIST-MP-1 Policy and Procedures NIST 800-53 control
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-3 Media Marking NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-6 Media Sanitization NIST 800-53 control
  • NIST-PE-1 Policy and Procedures NIST 800-53 control
  • NIST-PL-1 Policy and Procedures NIST 800-53 control
Show all 56 ›