Encrypt CUI at Rest to Prevent Exposure from Lost or Compromised Devices
NIST 800-171 control 3.13.9 addresses the protection of Controlled Unclassified Information stored on organizational systems. Under the CMMC framework, this control is divided into two assessment objectives: identifying encryption usage and documenting encryption implementation. Organizations must ensure CUI remains protected even when systems are physically compromised, lost, or stolen through the application of cryptographic protections to all storage locations.
Control Requirements and Scope
Control 3.13.9 mandates that organizations clearly identify where CUI is stored and how encryption protects that data at rest. This requirement encompasses all storage types including internal hard drives, solid-state drives, mobile devices, cloud environments, backup systems, and external media. Organizations must document which encryption tools, methods, and cryptographic protocols are deployed and confirm alignment with recognized standards such as FIPS 140-2 or FIPS 140-3.
The control applies to both fixed and portable storage. Any system capable of storing CUI must implement appropriate cryptographic mechanisms or alternative physical safeguards. The focus is on the state of information when not actively processed or transmitted, protecting data from unauthorized access regardless of storage device type or access frequency.
Risk of Unencrypted CUI at Rest
Failure to encrypt CUI at rest creates multiple security vulnerabilities. Physical theft of laptops, mobile devices, or external drives can immediately expose sensitive information to unauthorized parties. Insider threats may access stored CUI without detection when encryption is absent. Cloud storage misconfigurations can lead to public data exposure, and organizations will fail CMMC Level 2 or DFARS compliance assessments without proper encryption implementation.
Even secure networks cannot prevent data exposure once a device leaves physical control. Encryption ensures that even if attackers gain physical access to storage media, they cannot read the data without cryptographic keys. This protection is essential for maintaining confidentiality throughout the data lifecycle.
Implementation Approach
Organizations should begin by conducting a comprehensive inventory of all systems storing CUI. This includes laptops, desktops, servers, mobile devices such as phones and tablets, cloud storage platforms like AWS S3 or Azure Blob Storage, backup and disaster recovery systems, and removable media. Each system must be assessed for encryption capability and current protection status.
Next, identify and deploy appropriate encryption methods for each system type. Common solutions include BitLocker for Windows systems, FileVault for Mac devices, native cloud encryption services, encrypted external drives, and database-level encryption such as Transparent Data Encryption for SQL Server. Document the specific cryptographic tools, encryption algorithms like AES-256, key management practices, and compliance with FIPS validation requirements.
Organizations must update their System Security Plan and security policies to reflect encryption implementation. For each CUI-bearing system, describe the encryption method, state configuration settings such as full disk encryption enabled at boot, and list cryptographic modules or services used. Maintain a system inventory that includes encryption status alongside device type, role, and owner information.
Compliance Evidence and Documentation
| Evidence Type | Required Documentation | Purpose |
|---|---|---|
| System Security Plan | Encryption methods per system with specific algorithms and tools | Demonstrate intentional protection strategy |
| Policy Documents | Requirements for encryption on portable and fixed storage | Establish organizational standards |
| System Inventory | Encryption status for all CUI-bearing assets | Verify comprehensive coverage |
| Configuration Evidence | Screenshots or audit logs showing active encryption | Confirm operational implementation |
| Standards Validation | FIPS 140-2 or 140-3 certification documentation | Prove cryptographic compliance |
Assessors will examine SSP entries describing CUI-at-rest encryption for each system, policy documents requiring encryption, inventory records showing encryption status, configuration files or screenshots from devices and cloud platforms, and validation that cryptographic modules meet NIST and FIPS standards. Organizations should establish processes to review and update documentation regularly, ensuring changes to encryption tools, storage systems, or CUI locations are reflected in compliance records.
Common Implementation Gaps
Many organizations apply encryption but fail to document it properly, leaving no audit trail of intentional protection. Others lack clear tracking of which specific systems encrypt CUI at rest, making compliance verification difficult. Security policies may reference encryption generally without system-specific mapping, and documentation frequently omits standards validation such as FIPS compliance confirmation.
Personal devices used for CUI storage often lack encryption enforcement, and cloud storage may be configured without encryption enabled by default. Some organizations use encryption tools but store cryptographic keys on the same devices as encrypted data, undermining the protection. Legacy systems may remain in service without encryption capability, creating compliance gaps that require remediation or documented risk acceptance.
Key Management Considerations
Effective encryption at rest requires proper cryptographic key management. Organizations must establish procedures for key generation, distribution, storage, rotation, and destruction. Keys should be protected separately from encrypted data, ideally using centralized key management systems, Hardware Security Modules, or cloud-native key management services that meet FIPS requirements.
Document key management practices in security policies and the System Security Plan. Specify who has access to encryption keys, how keys are backed up and recovered, and what procedures govern key rotation and retirement. Regular audits should verify that key management practices remain secure and compliant with organizational policies and regulatory standards.
FAQ
What systems must encrypt CUI at rest?
All systems storing CUI must implement encryption, including laptops, desktops, servers, mobile devices, cloud storage platforms, backup systems, and removable media such as USB drives.
What encryption standards meet NIST 800-171 requirements?
FIPS 140-2 or FIPS 140-3 validated cryptographic modules are required. Common implementations include AES-256 encryption algorithms through tools like BitLocker, FileVault, or cloud-native encryption services.
What documentation do assessors require for CUI encryption at rest?
Assessors require System Security Plan entries describing encryption methods per system, policy documents mandating encryption, system inventory records showing encryption status, and validation that cryptographic tools meet FIPS standards.