This objective ensures that your organization enforces encryption for Controlled Unclassified Information (CUI) stored on system components—meaning encryption is mandatory, active, and cannot be disabled or bypassed by users or applications.