Non-persistent Information
LOW MODERATE HIGHRequirements NIST SOURCE
Requirement Context
This element is part of SI-14(2) — Non-persistent Information. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of SI-14(2) — Non-persistent Information. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Discussion (NIST Supplemental Guidance)
Retaining information longer than is needed makes the information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides advanced adversaries information that can assist in their reconnaissance and lateral movement through the system.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SI-14(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- one of the following PARAMETER VALUES is selected: {refresh <SI-14(02)_ODP[02] information> <SI-14(02)_ODP[03] frequency>; generate <SI-14(02)_ODP[04] information> on demand};
- the information to be refreshed is defined (if selected);
- the frequency at which to refresh information is defined (if selected);
- the information to be generated is defined (if selected);
- <SI-14(02)_ODP[01] SELECTED PARAMETER VALUE> is performed;
- information is deleted when no longer needed.
Examine
[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing non-persistence for system components; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel responsible for ensuring that information is and remains non-persistent; organizational personnel with information security responsibilities].
Test
[SELECT FROM: Organizational processes for ensuring that information is and remains non-persistent; automated mechanisms supporting and/or implementing component and service refreshes].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SI-14(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and information integrity policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Organizational processes for ensuring that information is and remains non-persistent
- automated mechanisms supporting and/or implementing component and service refreshes
Other Records
- system and information integrity procedures
- procedures addressing non-persistence for system components
- system audit records
- other relevant documents or records