SI-12 asks you to manage and retain information within the system, and information output from the system, in accordance with applicable laws, regulations, policies, standards, guidelines and operational requirements.
800-53 binds federal systems and contractors. For other companies it is a reference for retention questions that appear in nearly every security review: how long do you keep data, and how do you know?
What it means in practice
NIST says retention covers the whole life cycle of information, sometimes beyond the disposal of the system itself. It includes not only business data but also policies, procedures, plans, reports and the output produced by implementing controls. The guidance lists many controls whose records may need retention, including policy documents from every family, audit records, assessment reports, and configuration baselines. The federal records authority sets schedules for US agencies. A company does not follow those, but it does have its own legal and contract duties: tax, employment, privacy law and customer agreements.
Two sides need attention. One is customer and business data, where privacy law often limits how long you may keep it. The other is evidence, where an audit window requires you to keep it for a stated period. SI-12 holds both.
The enhancements apply this to personal data: SI-12(1) Limit Personally Identifiable Information Elements, SI-12(2) Minimize Personally Identifiable Information in Testing, Training, and Research, and SI-12(3) Information Disposal.
Evidence to collect
- A retention schedule that lists record types, retention period, legal or contractual reason, owner and disposal method.
- Configuration of automated retention: object storage lifecycle rules, database purge jobs, log retention settings, backup expiry.
- Disposal records: job logs or tickets showing data was deleted on schedule.
- Legal hold procedure and any active holds.
- Evidence archives for your controls, with dates, covering the audit period.
- Data inventory showing where personal data lives.
Common gaps
A schedule on paper while storage keeps everything forever. Logs kept for thirty days when a contract says a year. Test environments filled with copies of production personal data. Backups that outlive the deletion promise. Evidence overwritten before an audit period ends. No owner for each record class.
How to implement it
Build the schedule from three inputs: laws that apply to you, customer contract terms, and your own audit needs. Take the longest requirement that applies to each record type unless privacy rules cap it. Then turn the schedule into settings. Lifecycle rules and purge jobs beat reminders.
Evidence retention deserves automation. If controls produce their records on a schedule and store them with timestamps, the audit window fills itself. The evidence collection demo shows this idea.
Click through it at your own pace, or open it full screen.
Test your deletion path at least once a year. Pick a record, request its disposal, and prove it is gone from primary storage and, on the backup cycle, from backups.
Quick check
Does SI-12 cover only customer data?
No. It also covers policies, plans, reports and the output of implemented controls.
What is a good test of retention?
Trace one record from creation to disposal and show the evidence that deletion happened on time.
