Mapped to NIST 800-171 Requirement: 3.13.16
CMMC Assessment Objective: SC.L2-3.13.16
What This Control Means
You must ensure that when CUI is stored (not in motion), it is protected from:
• Unauthorized access
• Theft
• Data leaks from lost or stolen devices
• Unauthorized cloud storage exposure
• Insecure backups or archived data
Protections may include cryptography, access controls, physical security, or all of these combined.
Why It Matters
If CUI at rest isn’t protected:
• Devices stolen or misplaced could leak sensitive data
• Disgruntled employees could access CUI stored on accessible systems
• Insecure cloud configurations could expose CUI publicly
• Compliance with CMMC, NIST 800-171, and DFARS 7012 would be violated
Protecting CUI at rest is essential for total data lifecycle security.
How to Implement It
1. Apply Full Disk Encryption
• Laptops, desktops, servers (BitLocker, FileVault, Linux LUKS, etc.)
2. Secure Cloud Storage
• Require encryption for cloud-based storage (AWS S3, Azure Blob, etc.)
• Use FIPS-validated encryption modules where possible
• Enforce secure access policies for cloud storage
3. Harden Backup and Archive Storage
• Encrypt backup drives and tapes
• Restrict physical and logical access to backup systems
4. Use Role-Based Access Controls (RBAC)
• Only authorized users can access CUI storage
• Enforce least privilege principles
5. Monitor and Audit CUI Storage Locations
• Track:
◦ Where CUI is stored
◦ Who accesses it
◦ Changes or anomalies in storage behavior
Evidence the Assessor Will Look For
• Encryption settings showing CUI data is protected at rest
• SSP entries describing storage encryption and access controls
• Cloud platform encryption and access configuration screenshots
• Backup system documentation enforcing encryption and access restrictions
• Audit logs showing access control to CUI storage locations
Common Gaps
• Encryption available but not enforced or monitored
• Personal devices used to store CUI without encryption
• Cloud storage accessible without mandatory encryption
• Inadequate monitoring or logging of access to CUI repositories
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Tracking and verifying encryption status for systems storing CUI
• Logging access events for CUI storage assets
• Documenting secure cloud storage configurations and monitoring changes
• Linking encryption and access control enforcement to your SSP and POA&M
• Providing auditors with live evidence of CUI-at-rest protections
With Cuick Trac, your CUI is protected at every stage—even when it’s just sitting still.
Final CTA
Data doesn’t stop being sensitive just because it’s at rest—protect it everywhere.
Schedule a Cuick Trac demo to secure, monitor, and document your CUI-at-rest protections.