EvidenceSheet
NIST SP 800-53 Rev 5 · SI - System and Information Integrity

SI-14 Non-persistence. Implement non-persistent [organization-defined] that are initiated in a known state and terminated [organization-defined]

Non-persistence. Implement non-persistent [organization-defined] that are initiated in a known state and terminated [organization-defined].

5
artefacts
1
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

  • Records showing components are actually terminated and refreshed at the defined interval · Document repository

periodic reviewEvidence produced at each review

  • Evidence each is initiated in a known state from a trusted source rather than from its previous state · Document repository

governing documentDocuments that govern the control

  • The defined non-persistent components or services, and the defined termination condition or period · HR system / LMS
  • Verification that no state persists across the refresh, including credentials, caches and local data · Policy repository / GRC workspace
  • Rationale linking the refresh period to the dwell time the control aims to limit · Document repository

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your Document repository on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

SI-13 Predictable Failure Prevention. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [organization-defined] ; and Provide substitute system components and a means to exchange active and standby · SI-15 Information Output Filtering. Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [organization-defined]