[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsi-12":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","si-12","SI-12","Information Management and Retention",74,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Information within the system and output from it must be managed and retained in line with applicable laws, regulations, policies, standards and operational requirements.\n\n**In practice.** Good practice is a retention schedule that states how long each information category is kept and why, applied through automated retention and deletion in storage and SaaS platforms, with legal hold procedures. Auditors expect the schedule, configuration of retention settings and records of deletion. For European organisations this ties directly to the GDPR storage limitation principle. Retention should cover structured and unstructured data, including email, chat and collaboration tools.\n\n**Common gaps.** Organisations often keep everything indefinitely because deletion feels risky, which increases breach impact. Retention rules are rarely applied to backups, logs and data exports. Nobody may be clearly accountable for applying the schedule in each system.","Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.\nDiscussion: Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information. The National Archives and Records Administration (NARA) provides federal policy and guidance on records retention and schedules. If organizations have a records management office, consider coordinating with records management personnel. Records produced from the output of implemented controls that may require management and retention include, but are not limited to: All XX-1, [AC-6(9)](#ac-6.9), [AT-4](#at-4), [AU-12](#au-12), [CA-2](#ca-2), [CA-3](#ca-3), [CA-5](#ca-5), [CA-6](#ca-6), [CA-7](#ca-7), [CA-8](#ca-8), [CA-9](#ca-9), [CM-2](#cm-2), [CM-3](#cm-3), [CM-4](#cm-4), [CM-6](#cm-6), [CM-8](#cm-8), [CM-9](#cm-9), [CM-12](#cm-12), [CM-13](#cm-13), [CP-2](#cp-2), [IR-6](#ir-6), [IR-8](#ir-8), [MA-2](#ma-2), [MA-4](#ma-4), [PE-2](#pe-2), [PE-8](#pe-8), [PE-16](#pe-16), [PE-17](#pe-17), [PL-2](#pl-2), [PL-4](#pl-4), [PL-7](#pl-7), [PL-8](#pl-8), [PM-5](#pm-5), [PM-8](#pm-8), [PM-9](#pm-9), [PM-18](#pm-18), [PM-21](#pm-21), [PM-27](#pm-27), [PM-28](#pm-28), [PM-30](#pm-30), [PM-31](#pm-31), [PS-2](#ps-2), [PS-6](#ps-6), [PS-7](#ps-7), [PT-2](#pt-2), [PT-3](#pt-3), [PT-7](#pt-7), [RA-2](#ra-2), [RA-3](#ra-3), [RA-5](#ra-5), [RA-8](#ra-8), [SA-4](#sa-4), [SA-5](#sa-5), [SA-8](#sa-8), [SA-10](#sa-10), [SI-4](#si-4), [SR-2](#sr-2), [SR-4](#sr-4), [SR-8](#sr-8).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":25,"title":26,"published_at":27},"uk-legal-aid-agency-breach-exposes-47-years-of-sensitive-records","UK Legal Aid Agency Breach Exposes 47 Years of Sensitive Records","2026-10-15T16:20:35.876+00:00",{"slug":29,"title":30,"published_at":31},"healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft-via-tracking-pixels","Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft via Tracking Pixels","2026-10-14T08:20:59.917+00:00",{"slug":33,"title":34,"published_at":35},"stolen-credentials-expose-metas-github-repos-and-personal-data","Stolen Credentials Expose Meta's GitHub Repos and Personal Data","2026-10-13T18:21:42.163+00:00",{"slug":37,"title":38,"published_at":39},"finnish-healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft","Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft","2026-10-12T14:21:55.533+00:00",{"slug":41,"title":42,"published_at":43},"cjeu-loss-of-control-over-personal-data-qualifies-as-compensable-harm-under-gdpr-article-82","CJEU: Loss of Control Over Personal Data Qualifies as Compensable Harm Under GDPR Article 82","2026-10-12T14:20:50.134+00:00",{"slug":45,"title":46,"published_at":47},"belgian-dpa-fines-company-for-accidental-personal-data-disclosure-via-email","Belgian DPA Fines Company for Accidental Personal Data Disclosure via Email","2026-10-12T10:20:36.922+00:00",{"slug":49,"title":50,"published_at":51},"asos-breach-highlights-third-party-platform-risk-and-cloud-data-exposure","ASOS Breach Highlights Third-Party Platform Risk and Cloud Data Exposure","2026-10-07T10:20:21.584+00:00",{"slug":53,"title":54,"published_at":55},"openai-fires-researchers-for-mishandling-sensitive-infrastructure-data","OpenAI Fires Researchers for Mishandling Sensitive Infrastructure Data","2026-10-02T14:21:26.767+00:00",{"slug":57,"title":58,"published_at":59},"critical-flaws-in-armatura-one-expose-physical-access-systems-to-remote-takeover","Critical Flaws in Armatura One Expose Physical Access Systems to Remote Takeover","2026-10-01T18:21:50.053+00:00",{"slug":61,"title":62,"published_at":63},"spains-dgt-fined-for-collecting-excessive-personal-data-via-mobile-app","Spain's DGT Fined for Collecting Excessive Personal Data via Mobile App","2026-10-01T16:20:36.501+00:00",{"slug":65,"title":66,"published_at":67},"estonian-dpa-fines-website-operator-for-republishing-restricted-public-register-data","Estonian DPA Fines Website Operator for Republishing Restricted Public Register Data","2026-10-01T08:21:08.203+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",29,{"slug":75,"name":76,"problem":77,"stories":78},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",14,{"slug":80,"name":81,"problem":82,"stories":83},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",12,{"slug":85,"name":86,"problem":87,"stories":88},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",10,{"slug":90,"name":91,"problem":92,"stories":93},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",9,{"slug":95,"name":96,"problem":97,"stories":93},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[99,105,111,116,121,125,130,135],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","3","Control 3","Data Protection",61,{"family":106,"item":107,"code":108,"title":109,"together":110},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",53,{"family":112,"item":113,"code":114,"title":114,"together":115},"itil","overview","ITIL",36,{"family":106,"item":117,"code":118,"title":119,"together":120},"32","Article 32","Security of processing",31,{"family":100,"item":122,"code":123,"title":124,"together":120},"14","Control 14","Security Awareness and Skills Training",{"family":106,"item":126,"code":127,"title":128,"together":129},"25","Article 25","Data protection by design and by default",30,{"family":5,"item":131,"code":132,"title":133,"together":134},"ac-2","AC-2","Account Management",22,{"family":5,"item":136,"code":137,"title":138,"together":134},"ac-3","AC-3","Access Enforcement"]