Question 1

What evidence do auditors ask for on SI-23 Information Fragmentation. Based on [organization-defined]: Fragment the following information: [organization-defined] ; and Distribute the fragmented information across the following systems or system components: [organization-defined]?

Accepted Answer

The defined circumstances on which fragmentation is based, such as a threat assessment or risk trigger; The defined information fragmented and the fragmentation method used; The defined systems or components across which fragments are distributed, with evidence of the actual distribution; Evidence that no single location holds enough fragments to reconstruct the information; Reconstitution procedure and evidence it has been tested.

Question 2

Can SI-23 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on SI-23?

Accepted Answer

Fragments distributed across systems that share one administrator, one key or one storage platform

`SI-23` Information Fragmentation. Based on [organization-defined]: Fragment the following information: [organization-defined] ; and Distribute the fragmented information across the following systems or system components: [organization-defined]

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet