SI-21 asks you to refresh specified information at defined frequencies, or generate it on demand, and delete it when no longer needed. NIST 800-53 binds US federal systems and, by contract, some others. For other teams it is a useful reference when a customer asks about data minimization and stale copies.
What it means in practice
The guidance gives the reason plainly. Information kept longer than needed becomes a more valuable target. Holding it for the minimum period reduces the chance that an adversary captures and exfiltrates it.
In practice that means cached credentials, derived datasets, test copies and exports each get a lifetime. When the lifetime ends, the data is rebuilt from the source or removed.
Evidence to collect
- An inventory of information types with a refresh interval or an on demand rule.
- Retention and deletion settings, for example bucket lifecycle rules or database job schedules.
- Logs showing deletions or regeneration actually ran.
- An exception list with owners and reasons.
Common gaps
- Temporary exports that stay in shared drives for years.
- Caches and replicas that outlive the source record.
- Deletion rules that exist for production but not for backups, staging or analytics copies.
How to implement it
Pick the three copies most likely to be forgotten: exports, staging data, analytics extracts. Give each an owner and a maximum age, enforce it with a scheduled job, and keep the job logs.
Quick check
Is SI-21 the same as a retention policy?
It overlaps, but it also covers refreshing or regenerating information so that stale copies are not trusted, not only deleting it.
