Information Management and Retention

frameworkNIST SP 800-53 Rev 5.2 sectionSI System and Information Integrity csf 2.0ID.AM-07 ID.AM-08 topics— frameworks1 0 0

Official textManage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SI-12 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-07 ID.AM-08	Inventories of data and corresponding metadata for designated data types are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
ISO 27001	A.5.9 A.5.8 A.5.11 A.5.12	Inventory of information and other associated assets; Information security in project management…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping +6 more loosely related (not mappings) A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.2 CIS 3.5 CIS 1.2	Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Data Inventory…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-07: related, not a mapping +7 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 3 more in the downloads
SOC 2	C1.1 CC6.1	Identifying and protecting confidential information; Logical access security over information assets	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
PCI DSS	3.2.1 3.4.1 3.4.2 6.2.1	Account data storage minimised, with retention and disposal; PAN masked when displayed…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping +11 more loosely related (not mappings) 6.2.2 Developers trained in secure software development Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
CMMC	CA.L2-3.12.4 MA.L2-3.7.1 MA.L2-3.7.3 SC.L2-3.13.2	System Security Plan; Perform Maintenance…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +1 more loosely related (not mappings) MP.L2-3.8.4 Media Markings Loosely related Only shares CSF ID.AM-07: related, not a mapping
HIPAA	§164.316(b)(2)(i)	Time Limit	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 13 loosely related (not mappings) §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.310(a)(2)(ii) Facility Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.310(a)(2)(iv) Maintenance Records Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(b) Requirements for Group Health Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	12.4 6.2	Asset inventory; Secure development life cycle	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.