← SI-12
SI-12(3) SI · System and Information Integrity

Information Disposal

LOW MODERATE HIGH
1 Overlay 0 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Use the following techniques to dispose of, destroy, or erase information following the retention period: [organization-defined techniques].

Discussion (NIST Supplemental Guidance)

Organizations can minimize both security and privacy risks by disposing of information when it is no longer needed. The disposal or destruction of information applies to originals as well as copies and archived records, including system logs that may contain personally identifiable information.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for SI-12(3) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. techniques used to dispose of information following the retention period are defined;
  2. techniques used to destroy information following the retention period are defined;
  3. techniques used to erase information following the retention period are defined;
  4. <SI-12(03)_ODP[01] techniques> are used to dispose of information following the retention period;
  5. <SI-12(03)_ODP[02] techniques> are used to destroy information following the retention period;
  6. <SI-12(03)_ODP[03] techniques> are used to erase information following the retention period.

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; personally identifiable information processing procedures; records retention and disposition policy; records retention and disposition procedures; laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal; media protection policy; media protection procedures; system audit records; audit findings; information disposal records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information and records management, retention, and disposition responsibilities; organizational personnel with information security and privacy responsibilities; network administrators].

Test

[SELECT FROM: Organizational processes for information disposition; automated mechanisms supporting and/or implementing information disposition].

Overlays

Showing the OT/ICS overlay for the parent control SI-12 — see the SI-12(3) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

  • Base control: Included (matches standard baseline)

MODERATE

  • Base control: Included (matches standard baseline)

HIGH

  • Base control: Included (matches standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for SI-12(3). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • System and information integrity policy
  • personally identifiable information processing policy
  • records retention and disposition policy
  • laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal
  • media protection policy
  • system security plan
  • privacy plan

Testing

  • Organizational processes for information disposition
  • automated mechanisms supporting and/or implementing information disposition

Other Records

  • system and information integrity procedures
  • personally identifiable information processing procedures
  • records retention and disposition procedures
  • media protection procedures
  • system audit records
  • audit findings
  • information disposal records
  • privacy impact assessment
  • privacy risk assessment documentation
  • other relevant documents or records