Control statement
Implement non-persistent [Organization-defined: system components and services] that are initiated in a known state and terminated [Organization-defined: si-14_odp.02].
Discussion
Implementation of non-persistent components and services mitigates risk from advanced persistent threats (APTs) by reducing the targeting capability of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. By implementing the concept of non-persistence for selected system components, organizations can provide a trusted, known state computing resource for a specific time period that does not give adversaries sufficient time to exploit vulnerabilities in organizational systems or operating environments. Since the APT is a high-end, sophisticated threat with regard to capability, intent, and targeting, organizations assume that over an extended period, a percentage of attacks will be successful. Non-persistent system components and services are activated as required using protected information and terminated periodically or at the end of sessions. Non-persistence increases the work factor of adversaries attempting to compromise or breach organizational systems. Non-persistence can be achieved by refreshing system components, periodically reimaging components, or using a variety of common virtualization techniques. Non-persistent services can be implemented by using virtualization techniques as part of virtual machines or as new instances of processes on physical machines (either persistent or non-persistent). The benefit of periodic refreshes of system components and services is that it does not require organizations to first determine whether compromises of components or services have occurred (something that may often be difficult to determine). The refresh of selected system components and services occurs with sufficient frequency to prevent the spread or intended impact of attacks, but not with such frequency that it makes the system unstable. Refreshes of critical components and services may be done periodically to hinder the ability of adversaries to exploit optimum windows of vulnerabilities.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Non-persistence as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to flaw remediation, malicious-code protection, monitoring, integrity, and trustworthy information handling.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- patch and remediation records
- malware protection configuration
- monitoring alerts and response records
- integrity validation and exception reports
Common failure patterns
- patch compliance hides unsupported assets
- alerts generated without response ownership
- exceptions never expire
- integrity monitoring excludes critical configurations
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- SI-14[01]non-persistent [Organization-defined: system components and services] that are initiated in a known state are implemented;
- SI-14[02]non-persistent [Organization-defined: system components and services] are terminated [Organization-defined: si-14_odp.02].
Examine
- System and information integrity policy
- system and information integrity procedures
- procedures addressing non-persistence for system components
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel responsible for non-persistence
- organizational personnel with information security responsibilities
- system/network administrators
- system developer
Test
- Automated mechanisms supporting and/or implementing the initiation and termination of non-persistent components
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
SI-14(1) — Refresh from Trusted Sources
Obtain software and data employed during system component and service refreshes from the following trusted sources: [Organization-defined: trusted sources].
Official discussion
Trusted sources include software and data from write-once, read-only media or from selected offline secure storage facilities.
Organization-defined parameters (1)
Assessment objectives and methods
the software and data employed during system component and service refreshes are obtained from [Organization-defined: trusted sources].
Examine
- System and information integrity policy
- system and information integrity procedures
- procedures addressing non-persistence for system components
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel responsible for obtaining component and service refreshes from trusted sources
- organizational personnel with information security responsibilities
Test
- Organizational processes for defining and obtaining component and service refreshes from trusted sources
- automated mechanisms supporting and/or implementing component and service refreshes
SI-14(2) — Non-persistent Information
- (a)[Organization-defined: si-14.02_odp.01] ; and
- (b)Delete information when no longer needed.
Official discussion
Retaining information longer than is needed makes the information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides advanced adversaries information that can assist in their reconnaissance and lateral movement through the system.
Organization-defined parameters (4)
Assessment objectives and methods
- SI-14(02)(a)[Organization-defined: si-14.02_odp.01] is performed;
- SI-14(02)(b)information is deleted when no longer needed.
Examine
- System and information integrity policy
- system and information integrity procedures
- procedures addressing non-persistence for system components
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel responsible for ensuring that information is and remains non-persistent
- organizational personnel with information security responsibilities
Test
- Organizational processes for ensuring that information is and remains non-persistent
- automated mechanisms supporting and/or implementing component and service refreshes
SI-14(3) — Non-persistent Connectivity
Establish connections to the system on demand and terminate connections after [Organization-defined: si-14.03_odp].
Official discussion
Persistent connections to systems can provide advanced adversaries with paths to move laterally through systems and potentially position themselves closer to high value assets. Limiting the availability of such connections impedes the adversary’s ability to move freely through organizational systems.
Organization-defined parameters (1)
Assessment objectives and methods
- SI-14(03)[01]connections to the system are established on demand;
- SI-14(03)[02]connections to the system are terminated after [Organization-defined: si-14.03_odp].
Examine
- System and information integrity policy
- system and information integrity procedures
- procedures addressing non-persistence for system components
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel responsible for limiting persistent connections
- organizational personnel with information security responsibilities
Test
- Organizational processes for limiting persistent connections
- automated mechanisms supporting and/or implementing non-persistent connectivity
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.