+SI-14(02) Non-persistent Information

SI-14(02) Non-persistent Information

Control

  1. [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] ; and
  2. Delete information when no longer needed.

Discussion

Retaining information longer than is needed makes the information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides advanced adversaries information that can assist in their reconnaissance and lateral movement through the system.

Assessment Objective

  1. [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] is performed;
  2. information is deleted when no longer needed.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing non-persistence for system components system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for ensuring that information is and remains non-persistent organizational personnel with information security responsibilities

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις

3. Σχετικοί κανονισμοί

Κανονισμοί

Συνδεδεμένα ζητήματα

Συνδέσεις
is blocked by SI-14(02) Non-persistent Information – Assessment Procedure