SI-12-727 Information Output Handling and Retention

Information Output Handling and Retention

Control ID

SI-12-727

Control Name

Information Output Handling and Retention

Control Category

System and Information Integrity

Functional Areas

Protect

Sub-Areas

Enterprise Architecture, Roadmap and Emerging Technology

NIST Baseline Level(s)

LOW, MOD, HIGH

NIST Priority

State Implementation Required

Yes

Agency Last Implemented Date

May 20, 2016

Agency Implementation

The Agency handles all information output in accordance with the Texas A&M University System ("TAMUS") record retention schedule and data classification standard, and other laws or policies that may supersede TAMUS directives.

Risk Statement

Inaccurate data output from applications triggers unexpected results.

Control Description

The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

Control Example

The organization handles information according to the standards set forth in applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

State Implementation

The state organization handles and retains output from the information system in accordance with applicable laws, standards, and operational requirements.

Testing Procedures

Obtain system and information integrity policy; procedures addressing information system output handling and retention; media protection policy and procedures; information retention records, other relevant documents or records and ascertain if : (I)the organization handles output from the information system in accordance with applicable laws, Executive Orders, directives, policies, regulations, standards, and operational requirements. (ii)the organization retains output from the information system in accordance with applicable laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.