PI1.5

PI1.5

The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity’s objectives.

Category

Processing Integrity

Subcategory

Additional Criteria for Processing Integrity

Points of Focus

Protects Stored Items

Stored items are protected to prevent theft, corruption, destruction, or deterioration that would prevent output from meeting specifications.

Archives and Protects System Records

System records are archived, and archives are protected against theft, corruption, destruction, or deterioration that would prevent them from being used.

Stores Data Completely and Accurately

Procedures are in place to provide for the complete, accurate, and timely storage of data.

Creates and Maintains Records of System Storage Activities

Records of system storage activities are created and maintained completely and accurately in a timely manner.

Evidence Requests

Area of Focus	Artifact	Description
Cryptographic Protections	Cryptographic Protections	Documented evidence of organization-approved cryptographic solutions and modules for both data at rest and in transit.
Asset Management	Data Retention Program	Documented evidence of a formal data retention program that governs the retention and destruction of data types.
Technology Design & Acquisition	Secure Engineering Principles (SEP)	Documented evidence of defined secure engineering principles used to ensure Sensitivity, Integrity, Availability & Safety (CIAS) concerns are properly addressed in the design and implementation of systems, applications and services.
Technology Design & Acquisition	Software Assurance Maturity Model (SAMM)	Documented evidence of a Software Assurance Maturity Model (SAMM).