SI-20 asks you to embed data or capabilities in chosen systems so you can tell whether organizational data was exfiltrated or improperly removed. NIST 800-53 binds US federal systems and, by contract, some others. For a smaller company it is an optional idea worth knowing, and you only owe it if your selected baseline or contract includes it.
What it means in practice
The guidance describes a range from passive to active. A passive approach can be as simple as adding false email names and addresses to an internal database. If mail ever arrives at one of those addresses, you know the database or a copy of it left your control. Active approaches go further, for example embedding capabilities that report back when data is opened outside your environment.
This is the digital version of a seeded mailing list.
Evidence to collect
- The list of systems where tainting is applied and why you chose them.
- A record of the seed values, stored somewhere restricted.
- The monitoring that watches for the seeds, such as a mailbox rule or a log alert.
- Any triggered event and the incident record that followed.
Common gaps
- Seeds that were planted but never monitored.
- Seed values stored in the same place as the data, so an intruder removes them together.
- No legal review for active techniques that call out from copied data.
How to implement it
Pick one sensitive dataset, such as a customer export. Add a small number of fake records with addresses you control, then alert on any inbound mail to them. Keep it passive unless counsel agrees otherwise.
Quick check
Does SI-20 require active tracking software?
No. The guidance explicitly includes passive approaches such as fake entries in a database.
