SI-23: Information Fragmentation

Quick-reference card

What this control requires

SI-23 requires organizations to break sensitive information into fragments and distribute those fragments across multiple systems or components. The goal is structural. No single system should hold enough data for an attacker to reconstruct a complete, actionable dataset.

In practice, you identify which information assets are high-value targets for exfiltration, then split each asset into discrete elements. Those elements get distributed across independently secured systems, storage locations, or network segments.

The control also requires that you document which information is fragmented, where the fragments reside, and under what circumstances fragmentation applies. Your system and information integrity policies need to define the criteria that trigger fragmentation, such as the classification level or assessed value of the data.

The underlying operational problem is straightforward. When a complete sensitive dataset lives in a single location, one successful intrusion gives an adversary everything they need. Fragmentation forces attackers to compromise multiple independently defended systems before they can piece together anything useful, which raises both the cost of attack and the likelihood of detection.

Why it matters

Advanced persistent threat (APT) actors design their campaigns around efficiency. They target organizations where the most complete and valuable data is concentrated in the fewest locations, because that minimizes the number of intrusions needed for a successful exfiltration.

When an organization stores complete personally identifiable information (PII) databases, full encryption key material, or comprehensive authentication credential stores in a single logical or physical location, an adversary faces a high-value, low-complexity target. Once access is achieved, automated collection (T1119) can stage the entire dataset for exfiltration in a single operation. Logs covering the collection event can be cleared from a single location (T1070.001), and data can be silently manipulated (T1565.001) in ways that may go undetected until the corrupted data is used.

Information fragmentation is a structural countermeasure that forces adversaries to breach multiple independently secured systems to reconstruct a complete sensitive dataset. A single compromised server yields an incomplete, non-actionable fragment rather than the full corpus. That structural change both reduces the value of any individual breach and increases the minimum number of intrusions required for complete exfiltration.

The indicator removal techniques (T1070) that attackers use to cover their tracks also become harder to execute comprehensively when the evidence trail spans multiple, independently administered systems. Separate log stores that can’t be cleared from a single access point mean that forensic evidence is more likely to survive, increasing the probability that defenders detect the campaign before it succeeds.

What attackers exploit

• Single-location data concentration: Adversaries use automated collection techniques (T1119) to stage entire datasets for exfiltration when all sensitive data resides in one place.
• Centralized log stores: When all access logs live on the same system as the data, attackers can clear indicators of compromise (T1070.001, T1070.002) in a single operation, eliminating the forensic trail.
• Stored data manipulation: Adversaries who gain access to a complete, unfragmented dataset can silently alter records (T1565, T1565.001) without detection, because no independent copy exists for comparison.
• Low-complexity exfiltration paths: Organizations that don’t fragment high-value information present attackers with a lower work factor, meaning fewer intrusions, fewer lateral movements, and less time spent inside the network.

How to implement

For your organization

The central challenge with SI-23 is balancing security against operational accessibility. Fragmenting data protects against exfiltration, but it also affects how quickly your teams can access complete datasets for legitimate purposes. Your implementation needs to address both sides of that tradeoff.

Step 1: Identify and classify information for fragmentation. Start by inventorying your highest-value data assets. These include complete PII databases, encryption key material, authentication credential stores, intellectual property repositories, and any dataset whose exfiltration would cause significant harm. Classify each asset by its impact level, data sensitivity, and exposure to known threat patterns.

Step 2: Define fragmentation criteria and procedures. Document the circumstances under which fragmentation applies. Your fragmentation policy should specify what triggers fragmentation (data classification level, assessed value, threat intelligence), how data is divided (by record type, by field, by geographic region), and the minimum number of fragments required for each classification tier.

Step 3: Distribute fragments across independent systems. Place fragments on systems or components that are independently secured, meaning separate administrative domains, separate authentication mechanisms, and separate log stores. The goal is that compromising one system doesn’t give an attacker access to other fragments. Network segmentation, separate storage infrastructure, and geographically distributed systems are common approaches.

Step 4: Implement access controls and reassembly procedures. Define and document how authorized personnel reassemble fragmented data when they need it. This process should require multi-person authorization for full reassembly and should generate audit logs at each step. Avoid creating standing processes that routinely reassemble all fragments, as that defeats the purpose of fragmentation.

Step 5: Monitor and audit fragment integrity. Establish integrity-checking routines for each fragment location. Use file integrity monitoring, access logging, and periodic reconciliation to detect unauthorized access or modification of individual fragments. Your system security plan should reference the fragmentation architecture and monitoring procedures.

Common mistakes: Organizations often fragment data but then create a centralized index that maps every fragment’s location, effectively recreating a single point of compromise. Another frequent error is implementing fragmentation only at the storage layer while leaving complete datasets assembled in application memory during processing.

For your vendors

Assessing a vendor’s implementation of SI-23 requires you to understand whether they’ve genuinely distributed sensitive data across independent systems or whether fragmentation exists only on paper.

Questionnaire questions to ask:

• Does your organization fragment any categories of sensitive data across multiple systems or storage locations? If so, which data categories and how many independent fragment locations are used?
• What criteria determine when data fragmentation is applied? Is fragmentation tied to data classification levels, regulatory requirements, or threat assessments?
• Are the systems holding fragments administered independently, with separate authentication and access controls?
• How do authorized users reassemble fragmented data, and what controls govern the reassembly process?
• Do you maintain separate, independently administered log stores for each system holding a fragment?

Evidence to request:

• Fragmentation policy and procedures documenting which information is fragmented and the distribution methodology
• System architecture diagrams showing the physical or logical separation of fragment locations
• Access control documentation demonstrating independent administration of each fragment location
• Audit logs showing reassembly events and the authorization workflow required to trigger reassembly
• Results from integrity monitoring for fragment locations

Red flags to watch for:

• All fragments stored within the same administrative domain or on systems sharing a single set of credentials
• No documented criteria for determining what data qualifies for fragmentation
• Reassembly processes that don’t require multi-person authorization
• A single centralized index mapping all fragment locations without independent protection for the index itself
• No independent log stores for fragment-hosting systems

Verification approach: Request architecture diagrams and cross-reference them with access control documentation. The key test is whether compromising one fragment location gives an attacker the information or access needed to locate and retrieve other fragments. If it does, the fragmentation is cosmetic rather than structural.

Evidence examples

Cross-framework mapping

No cross-framework mappings are currently documented for SI-23.

Related controls

No related controls are referenced in the NIST SP 800-53 catalog for SI-23. However, practitioners should review the broader System and Information Integrity (SI) family for controls that complement fragmentation strategies, particularly those addressing software and information integrity verification. Controls in the Program Management (PM) family that address data governance may also provide useful context for establishing fragmentation policies.

Frequently asked questions

What is NIST SP 800-53 SI-23

SI-23 requires organizations to fragment designated sensitive information and distribute the resulting fragments across multiple, independently secured systems or components. The control targets scenarios where a complete dataset concentrated in a single location presents a high-value exfiltration target. By splitting data into non-actionable pieces and storing them separately, you increase the adversary’s work factor and raise the likelihood of detecting intrusion attempts before a full dataset can be reconstructed.

What happens if SI-23 is not implemented

Without information fragmentation, a single successful intrusion can give an adversary access to a complete sensitive dataset, enabling full exfiltration in one operation. The absence of distributed fragments means that automated collection tools can stage all target data from a single system, and attackers can clear the associated logs from one location. Organizations also lose the detection advantage that comes from adversaries needing to move laterally across independently monitored systems.

How do you audit SI-23

Auditing SI-23 starts with verifying that documented fragmentation procedures exist and that they specify which information is fragmented, the criteria triggering fragmentation, and the systems hosting each fragment. Assessors should confirm that the fragmented information is distributed across independently administered systems by reviewing architecture documentation and access control configurations. Testing should validate that compromising one fragment location doesn’t provide sufficient information or access to locate and retrieve the remaining fragments.

How does information fragmentation differ from encryption

Encryption protects data confidentiality by making information unreadable without the correct key, but the complete encrypted dataset typically still resides in a single location. Information fragmentation takes a structurally different approach by dividing the data itself into pieces and distributing those pieces across separate systems, so even a decrypted fragment remains incomplete. The two techniques complement each other, and organizations can layer them by fragmenting data and encrypting each fragment independently.

Ready to streamline your compliance management? Start a free trial to see how UpGuard helps you manage risk across your organization and vendor ecosystem.