Mapped to NIST 800-171 Requirement: 3.8.5
CMMC Assessment Objective: MP.L2-3.8.5[b]
What This Control Means
Your organization should not just protect CUI during transport—it must document how that protection occurs.
Documentation must include:
• Transport scenarios (physical and digital)
• Controls and technologies used
• Roles and responsibilities
• Restrictions and exceptions
This ensures repeatability, consistency, and auditability.
Why It Matters
Without clear documentation:
• Users may guess what “secure” transport means
• Unencrypted or uncontrolled transport methods may be used
• There’s no reference point for training or audits
• External or internal auditors may flag your CUI handling processes as incomplete
Documenting your controls builds confidence and accountability.
How to Implement It
1. Update Your Policies and Plans Ensure these documents reference CUI transport protection:
• Media Protection Policy
• Acceptable Use Policy
• Remote Work Policy
• System Security Plan (SSP)
2. Document Controls for Digital Transport
• Require TLS, VPN, SFTP, or encrypted email for all digital transfers
• Specify prohibited methods (e.g., public cloud drives, standard email)
3. Document Controls for Physical Transport
• Define labeling, storage, courier, and tracking requirements
• State whether CUI may be taken off-site, and under what conditions
4. Reference Tools or Platforms
• Identify approved secure platforms (e.g., encrypted USBs, secure file-sharing solutions)
5. Include Roles and Responsibilities
• Identify who may approve, conduct, or supervise transport events
Evidence the Assessor Will Look For
• Written policies outlining how CUI is protected during transit
• Specific references to encryption standards and approved transport methods
• Procedures for sending/receiving CUI via email or physical courier
• Logs or examples showing adherence to those procedures
• Training documentation that reflects the policy
Common Gaps
• Transport practices vary and are undocumented
• Encryption policies exist but are not tied to transport use cases
• No distinction between physical and digital transport risks
• Users unsure how to handle CUI when working remotely or traveling
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Providing prebuilt templates that document transport protection protocols
• Enforcing encryption policies for data in motion
• Helping define approved file transfer methods, carriers, and platforms
• Offering user-facing guidance on when and how to move CUI securely
• Ensuring documentation aligns with CMMC, NIST, and DFARS requirements
With Cuick Trac, your policies aren’t just secure—they’re documented, reviewed, and defensible.
Final CTA
Compliance isn’t just about doing the right thing—it’s about documenting it, too.
Schedule a Cuick Trac demo to centralize your CUI transport policies and close the documentation gap.