FedRAMP Moderate SI-12: Information Management and Retention

What else in your programme already covers this

This control maps to 48 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 4 controls

CIS-3.1 Establish and Maintain a Data Management Process
CIS-3.4 Enforce Data Retention
CIS-3.5 Securely Dispose of Data
CIS-8.10 Retain Audit Logs

ISO 27701:2019 · 4 controls

5.5.5 Documented information
6.15.1 Compliance with legal and contractual requirements
7.2.8 Records related to processing PII
7.4.7 Retention

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained
NIST-CSF-PR.DS-11 Backups of data are created, protected, maintained, and tested
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring

ISO 27001:2022 · 3 controls

5.31 Legal, statutory, regulatory and contractual requirements
5.33 Protection of records
8.10 Information deletion

PCI DSS 4.0 · 3 controls

10.5.1 10.5.1 Keep logs 12 months, latest three months online
3.2.1 3.2.1 Data retention and disposal minimise stored account data
3.3.1 3.3.1 SAD not retained after authorization, even encrypted

SOC 2 · 3 controls

SOC2-P4.2 P4.2 Retaining personal information
SOC2-P4.3 P4.3 Securely disposing of personal information
SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs

Australia Consumer Data Right - Banking (CDR) · 2 controls

AUCDR-IS-3 Securely manage information assets over their lifecycle
AUCDR-PS-12 Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data

C5 (Germany) · 2 controls

C5-OPS-11 Logging and Monitoring - Metadata Management Concept
C5-PI-03 Secure deletion of data

HIPAA Security Rule · 2 controls

164.316(b)(1) Documentation (Standard)
164.316(b)(2)(i) Time Limit (Documentation Retention)

ISO 27002:2022 · 2 controls

5.33 Protection of records
8.10 Information deletion

APPI · 1 control

APPI-A22 Accuracy and Deletion of Personal Data

APRA CPS 230 Operational Risk Management · 1 control

CPS230-19 Tolerance Levels for Each Critical Operation

AWS Well-Architected Security Pillar · 1 control

SEC07-BP04 Define scalable data lifecycle management

Australia My Health Records Act 2012 · 1 control

MYHR-GOV-5 Retention, destruction and correction obligations of the System Operator

Azure Security Benchmark · 1 control

ASBv3-LT-6 Configure log storage retention

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-20 Production of System Safeguards Books and Records

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-DSP-16 Data Retention and Deletion

DORA · 1 control

DORA-Art.56 Data protection

GDPR · 1 control

GDPR-Art.5 Principles relating to processing of personal data

NIST SP 800-161 Rev 1 · 1 control

161R1-SI-12 Information Management and Retention

NIST SP 800-171 Rev 3 · 1 control

03.14.08 Information Management and Retention

NIST SP 800-172 · 1 control

3.14.5e Review Persistent Storage and Remove CUI No Longer Needed

NIST SP 800-218 · 1 control

SP800-218-PS.3.1 Archive and Protect Released Software

NIST SP 800-53 Rev 5 · 1 control

NIST800-SI-12 SI-12 Information Management and Retention

NIST SP 800-53 Rev 5 HIGH · 1 control

SI-12 SI-12 Information Management and Retention

NIST SP 800-53 Rev 5 LOW · 1 control

SI-12 SI-12 Information Management and Retention

NIST SP 800-53 Rev 5 MODERATE · 1 control

SI-12 SI-12 Information Management and Retention

NIST SP 800-66 Rev 2 · 1 control

164.316(b)(1) Documentation (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of FedRAMP Moderate have you already done?

FedRAMP Moderate SI-12 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP Moderate your existing evidence covers. Hold ISO 27002:2022 and 182 of 323 FedRAMP Moderate controls already carry evidence.

If you hold ISO 27002:202256.3% covered · 141 gaps If you hold PCI DSS 4.051.1% covered · 158 gaps If you hold ISO 27001:202249.8% covered · 162 gaps If you hold NIST SP 800-171 Rev 345.5% covered · 176 gaps If you hold C5 (Germany)37.2% covered · 203 gaps If you hold CMMC 2.035% covered · 210 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 348 were rejected on the ISO 27002:2022 pair alone.

See the released pairs, $299 each Browse the graph free