SI-23 asks you to fragment defined information based on conditions you set, and to distribute the fragments across systems or components you name. NIST 800-53 binds US federal systems and, by contract, some others. For most companies it is an advanced option, not a baseline expectation.
What it means in practice
The guidance ties this to advanced persistent threats that aim to exfiltrate valuable information. Once data is out, you rarely get it back. Splitting it into disparate elements across multiple systems raises the attacker's work factor and the chance of detection. NIST also notes a tradeoff: fragmentation affects your own ability to access the information.
Examples include splitting an encryption key between two custodians or systems, or separating identifying fields from the rest of a record.
Evidence to collect
- The data types you decided to fragment and the rationale.
- The design showing where each fragment lives.
- Access controls proving no single account can reach all pieces.
- A recovery test showing you can reassemble the data.
Common gaps
- Fragments stored side by side with the same credentials.
- No tested reassembly path.
- Applying it everywhere, which hurts availability without lowering real risk.
How to implement it
Apply it to the crown jewels only, such as key material. Use separate stores, separate permissions and a documented recovery procedure.
Quick check
What is the main cost of fragmentation?
Your own access gets harder, so reassembly and recovery must be designed and tested.
