SC.L2-3.13.3[a]: Identify the Encryption Methods Used to Protect CUI in Transit

Mapped to NIST 800-171 Requirement: 3.13.3
CMMC Assessment Objective: SC.L2-3.13.3[a]

What This Control Means
You must identify when and how encryption is used to secure CUI as it moves between:
• Internal systems
• External networks
• Cloud platforms
• Third-party service providers
• Remote users (via VPN, RDP, etc.)
This includes all methods of transmission, including wired, wireless, and virtual communication channels.

Why It Matters
Unencrypted CUI in transit can be:
• Intercepted by attackers (e.g., packet sniffing, man-in-the-middle attacks)
• Exposed over untrusted networks
• Rendered non-compliant under DFARS or CMMC rules
Identifying encryption usage ensures CUI is never transmitted in cleartext.

How to Implement It
1. Map All CUI Transmission Paths
• Identify where CUI is sent or received:
◦ Between internal systems
◦ Across VPNs or cloud tunnels
◦ Over email or file transfers
◦ During remote access sessions
2. Identify Cryptographic Protections Used Examples include:
• TLS 1.2 or higher
• IPsec tunnels
• SFTP or SSH
• HTTPS for web-based portals
• Encrypted email (e.g., S/MIME, PGP)
3. Review Configurations
• Validate:
◦ Encryption is enabled by default
◦ Weak protocols (e.g., SSL, TLS 1.0) are disabled
◦ Key lengths and cipher suites meet current standards (e.g., FIPS 140-2)
4. Document in SSP or Security Architecture
• Clearly state how CUI is protected at every boundary
• Include references to security tools, VPN solutions, or cloud platforms

Evidence the Assessor Will Look For
• Network architecture diagrams showing encrypted data flows
• SSP entries identifying cryptographic protections in transit
• Configuration files or screenshots from systems enforcing encryption
• Policies requiring encryption for email, file transfers, or remote access
• Records of encryption protocols used and how they’re validated

Common Gaps
• Encryption used, but not documented
• CUI sent over email or file transfer with no encryption
• Legacy protocols (e.g., FTP, Telnet, TLS 1.0) still active
• Inconsistent application of encryption across systems

How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Mapping CUI data flows and identifying transmission methods
• Documenting cryptographic controls in your SSP
• Linking encryption tools and methods to specific systems and access paths
• Flagging unencrypted CUI traffic or outdated protocols
• Helping ensure encryption aligns with FIPS 140-2 or modern NIST guidance
With Cuick Trac, CUI in transit is encrypted, documented, and defensible.

Final CTA
If CUI moves, it must be encrypted.
Schedule a Cuick Trac demo to identify and document how your organization protects CUI in transit with encryption.

🍪 We Use Cookies

To enhance your experience and analyze site usage, we use cookies. By continuing to use our site, you agree to our use of cookies in accordance with our Privacy Policy.