Assessment Objective

Determine if:

• SI-23a. under [Assignment: circumstances], [Assignment: information] is fragmented;
• SI-23b. under [Assignment: circumstances] , the fragmented information is distributed across [Assignment: systems or system components].

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• procedures addressing software and information integrity
• system design documentation
• system configuration settings and associated documentation
• procedures to identify information for fragmentation and distribution across systems/system components
• list of distributed and fragmented information
• list of circumstances requiring information fragmentation
• enterprise architecture
• system security architecture
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• organizational personnel with systems security engineering responsibilities
• system developers
• security architects

Test

• Organizational processes to identify information for fragmentation and distribution across systems/system components
• automated mechanisms supporting and/or implementing information fragmentation and distribution across systems/system components

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final