Mapped to NIST 800-171 Requirement: 3.13.10
CMMC Assessment Objective: SC.L2-3.13.10[a]
What This Control Means
You must identify the protections you have in place to authenticate sessions involving:
• User logins (e.g., VPN sessions, remote desktops, email clients)
• System-to-system communications (e.g., APIs, cloud syncs)
• Wireless or wired connections carrying CUI
This includes methods like:
• Strong authentication (e.g., MFA, certificates, pre-shared keys)
• Secure protocol handshakes (e.g., TLS, SSH)
• Session integrity checking (e.g., cryptographic binding)
The focus is on verifying and protecting session identities—not just encrypting traffic.
Why It Matters
Without session authenticity protections:
• Attackers could impersonate users or systems
• Sessions could be hijacked after authentication
• CUI could be exposed to unauthorized parties
• Communications could be redirected or altered in transit
This control ensures you trust who you’re communicating with—and they trust you.
How to Implement It
1. Identify All Communications Paths
• VPN sessions
• Remote access logins (RDP, VDI)
• API calls between systems
• Email servers and clients
• Cloud service access
2. Identify Session Authentication Methods Examples:
• TLS certificates (mutual TLS)
• SSH keys for server access
• VPN authentication tied to MFA
• API keys, OAuth tokens
• S/MIME or PGP for email signing
3. Document Session Protection Mechanisms
• Encryption protocols used
• Authentication methods applied
• How sessions are validated and protected against hijacking
4. Link to System Security Plan (SSP)
• Describe authentication methods in your communication protection sections
Evidence the Assessor Will Look For
• List of session protection methods and authentication technologies
• VPN, RDP, or API configurations enforcing session authenticity
• SSL/TLS settings requiring certificate validation
• Screenshots of session authentication settings
• SSP entries detailing session protection strategies
Common Gaps
• Traffic is encrypted but session identities are not authenticated
• MFA enabled for users but not enforced for system-to-system connections
• No mutual authentication for VPN or API sessions
• Cloud services accessed without validating session integrity
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Documenting authentication and session protection methods for CUI systems
• Mapping session protection across all communication flows
• Verifying configuration compliance with best practices (TLS, MFA, SSH)
• Providing audit-ready reports showing how authenticity is enforced in communication sessions
With Cuick Trac, your communication sessions aren’t just encrypted—they’re verified and trusted.
Final CTA
Encryption hides your data—authentication proves who’s on the other end.
Schedule a Cuick Trac demo to identify and strengthen your communication session protections for CUI.