Mapped to NIST 800-171 Requirement: 3.13.3
CMMC Assessment Objective: SC.L2-3.13.3[a]
What This Control Means
You must identify when and how encryption is used to secure CUI as it moves between:
• Internal systems
• External networks
• Cloud platforms
• Third-party service providers
• Remote users (via VPN, RDP, etc.)
This includes all methods of transmission, including wired, wireless, and virtual communication channels.
Why It Matters
Unencrypted CUI in transit can be:
• Intercepted by attackers (e.g., packet sniffing, man-in-the-middle attacks)
• Exposed over untrusted networks
• Rendered non-compliant under DFARS or CMMC rules
Identifying encryption usage ensures CUI is never transmitted in cleartext.
How to Implement It
1. Map All CUI Transmission Paths
• Identify where CUI is sent or received:
◦ Between internal systems
◦ Across VPNs or cloud tunnels
◦ Over email or file transfers
◦ During remote access sessions
2. Identify Cryptographic Protections Used Examples include:
• TLS 1.2 or higher
• IPsec tunnels
• SFTP or SSH
• HTTPS for web-based portals
• Encrypted email (e.g., S/MIME, PGP)
3. Review Configurations
• Validate:
◦ Encryption is enabled by default
◦ Weak protocols (e.g., SSL, TLS 1.0) are disabled
◦ Key lengths and cipher suites meet current standards (e.g., FIPS 140-2)
4. Document in SSP or Security Architecture
• Clearly state how CUI is protected at every boundary
• Include references to security tools, VPN solutions, or cloud platforms
Evidence the Assessor Will Look For
• Network architecture diagrams showing encrypted data flows
• SSP entries identifying cryptographic protections in transit
• Configuration files or screenshots from systems enforcing encryption
• Policies requiring encryption for email, file transfers, or remote access
• Records of encryption protocols used and how they’re validated
Common Gaps
• Encryption used, but not documented
• CUI sent over email or file transfer with no encryption
• Legacy protocols (e.g., FTP, Telnet, TLS 1.0) still active
• Inconsistent application of encryption across systems
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Mapping CUI data flows and identifying transmission methods
• Documenting cryptographic controls in your SSP
• Linking encryption tools and methods to specific systems and access paths
• Flagging unencrypted CUI traffic or outdated protocols
• Helping ensure encryption aligns with FIPS 140-2 or modern NIST guidance
With Cuick Trac, CUI in transit is encrypted, documented, and defensible.
Final CTA
If CUI moves, it must be encrypted.
Schedule a Cuick Trac demo to identify and document how your organization protects CUI in transit with encryption.