# SI-21 Information Refresh

NIST SP 800-53 control. Family: SI System and Information Integrity. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed.
Guidance: Retaining information for longer than it is needed makes it an increasingly valuable and enticing target for adversaries. Keeping information available for the minimum period of time needed to support organizational missions or business functions reduces the opportunity for adversaries to compromise, capture, and exfiltrate that information.

## Clauses by framework (6 frameworks)
- iso_27001_2022: A.8.10
- bsi_grundschutz: APP.3.1
- finma_circular: IV.E(84)
- dora: Art.13(1)
- rbi_csf: Annex1.15
- iosco_cyber: LE-3, SA-1
OSA's mapping for iso_27001_2022 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SI-21
- Clauses only: /api/v1/controls/SI-21?fields=mappings
- Page for people: /controls/si-21/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.