03.14.05E Non-Persistent Information

Statement

• {{ insert: param, A.03.14.05E.ODP.01 }}.

• Delete information when no longer needed.

Guidance

Retaining information longer than is required makes that information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides adversaries with information that can assist in their reconnaissance and lateral movement through the system. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

{{ insert: param, A.03.14.05E.ODP.01 }} is performed.

Assessment objective

information is deleted when no longer needed.

Assessment method

• System and information integrity policy system and information integrity procedures system security plan procedures addressing non-persistence for system components system design documentation system configuration settings and associated documentation system audit records other relevant documents or records

Assessment method

• Personnel responsible for ensuring that information is and remains non-persistent personnel with information security responsibilities

Assessment method

• Processes for ensuring that information is and remains non-persistent automated mechanisms supporting and/or implementing component and service refreshes

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final