SI-19 asks you to remove defined elements of personally identifiable information from datasets, and to evaluate the result for effectiveness. The organization names the elements and the evaluation method. NIST 800-53 binds US federal systems and, by contract, some others. For the rest, it is a reference when customers ask how you handle data used for testing, analytics or sharing.
What it means in practice
The guidance defines de-identification as removing the association between identifying data and the data subject. Obvious identifiers include name, social security number, date and place of birth and biometric records. Linked or linkable data such as medical, educational, financial and employment information matters too.
The second half of the control is easy to skip. Removing columns is not proof. You are asked to evaluate whether the dataset can still be tied back to a person.
The enhancements list the contexts and techniques: collection (SI-19.1), archiving (SI-19.2), release (SI-19.3), removal, masking, encryption, hashing or replacement of direct identifiers (SI-19.4), statistical disclosure control (SI-19.5), differential privacy (SI-19.6), validated algorithms and software (SI-19.7) and motivated intruder (SI-19.8).
Evidence to collect
- The list of PII elements removed from each dataset.
- The tool or script used, with version and review record.
- An effectiveness test, such as a re-identification attempt on a sample.
- Approval records before a de-identified dataset is shared or archived.
- A register of datasets and their de-identification status.
Common gaps
- Masking names but leaving rare combinations, like postcode plus birth date, that still identify people.
- Test environments filled with raw production copies.
- No re-identification test.
- Hashed identifiers treated as anonymous even though they can be matched.
How to implement it
Decide the default for non production environments, which should be synthetic or de-identified data. Build the process as a repeatable job, not a manual export. After each run, sample the output and try to link records back using other fields you hold. Record the result and who signed it off.
Quick check
Is hashing an email address enough to de-identify it?
Not by itself. Anyone with a list of candidate emails can hash them and match. The control wants you to evaluate effectiveness.
