Mapped to NIST 800-171 Requirement: 3.13.10
CMMC Assessment Objective: SC.L2-3.13.10[b]
What This Control Means
After identifying your session authenticity protections (SC.L2-3.13.10[a]), this objective ensures those protections are described in your official security documentation, such as:
• System Security Plan (SSP)
• Remote Access Policy
• Network Security Architecture diagrams
• Application-specific security designs (e.g., for cloud platforms or APIs)
You must connect technology choices to session authentication strategies.
Why It Matters
Without documentation:
• Internal and external assessors cannot verify your protections
• Engineers and IT staff may implement inconsistent authentication methods
• You can’t prove session trust to auditors or security reviewers
• Users or systems could connect insecurely without detection
Documentation ensures your session protections are intentional, structured, and standardized.
How to Implement It
1. Update the SSP and Policies Clearly describe:
• How session authenticity is verified
• What technologies (VPN, TLS, SSH, etc.) are used
• Whether mutual authentication is applied (e.g., mutual TLS, server + client certs)
• What session management features are enforced (e.g., re-authentication after timeout)
2. List Sessions by Type Examples:
• User login sessions (VPN, RDP, cloud apps)
• API or service-to-service sessions (OAuth, API key validation)
• Admin access sessions (SSH, privileged access management)
3. Include Cryptographic Protections
• Reference protocols like TLS 1.2+, IPsec, SSH v2, HTTPS with server authentication
• Reference FIPS 140-2/140-3 compliance where applicable
4. Map to Systems and Users
• Show where and how protections are applied for CUI-related systems
Evidence the Assessor Will Look For
• SSP entries detailing session authentication mechanisms
• Security architecture diagrams showing session protection points
• Remote Access Policy or VPN configuration documents
• System documentation enforcing certificate-based authentication or MFA for sessions
• Screenshots of encryption/authentication settings for systems managing CUI
Common Gaps
• Session encryption in place but no authentication documentation
• Authentication only documented for user sessions, not system-to-system communication
• No reference to session timeout, re-authentication, or session integrity verification
• Old or broken cryptographic methods still allowed (e.g., SSL, TLS 1.0)
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Documenting all methods used to protect communication session authenticity
• Mapping protections across remote access tools, VPNs, APIs, and cloud services
• Linking session security to specific system and user flows
• Storing authentication method configurations for audit review
• Ensuring your communication protection documentation aligns with CMMC and NIST 800-171 standards
With Cuick Trac, your session protections aren’t assumptions—they’re documented, verifiable, and enforced.
Final CTA
Trust is good. Documented trust is better.
Schedule a Cuick Trac demo to document your communication session protections and solidify your CMMC compliance.