Mapped to NIST 800-171 Requirement: 3.13.3
CMMC Assessment Objective: SC.L2-3.13.3[b]
What This Control Means
You must show written documentation that:
• Describes the encryption methods used for CUI in transit
• Identifies where encryption is enforced in your network or systems
• Lists the protocols, tools, and standards (e.g., TLS 1.2, IPsec, SFTP, FIPS 140-2 validated crypto)
• Explains how encryption protects CUI during system-to-system and user-to-system communication
This is about showing that your encryption practices are deliberate and structured.
Why It Matters
If cryptographic protections are used but not documented:
• You can’t prove compliance with CMMC or DFARS requirements
• System owners may not consistently apply or maintain encryption standards
• Auditors may flag your SSP and data flow documentation as incomplete
• Your organization risks transmitting CUI insecurely without realizing it
This control connects technology to governance.
How to Implement It
1. Update Your SSP
• For each system handling or transmitting CUI:
◦ List the encryption protocol in use
◦ Identify the traffic path (e.g., internal LAN, VPN, cloud sync)
◦ Document the tool or service applying encryption (e.g., Cisco ASA, OpenVPN, Microsoft Purview)
2. Maintain a Data Flow Diagram
• Show where CUI is encrypted in transit
• Label protocols or encryption methods at each transmission point
3. Include in Policy or Procedures
• Require encryption for:
◦ Remote access
◦ File transfers
◦ Cloud uploads
◦ Internal traffic across security zones
4. Keep Protocol References Current
• TLS 1.2 or higher
• IPsec/IKEv2
• FIPS 140-2 or FIPS 140-3 validated tools
Evidence the Assessor Will Look For
• System Security Plan (SSP) entries specifying encryption for data in transit
• Documentation showing what protocols are used and where
• Diagrams identifying encrypted paths between systems
• Policy language requiring encryption in transit for CUI
• References to compliance with FIPS or NIST cryptographic standards
Common Gaps
• Encryption used but not mentioned in documentation
• Policy references encryption, but protocols and tools are not named
• No diagrams showing encrypted transmission points
• Weak or outdated encryption methods referenced (e.g., SSL, TLS 1.0)
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Documenting encryption protocols and methods for all CUI transmission paths
• Mapping encryption coverage across data flow diagrams
• Linking documentation to SSP sections and access control zones
• Supporting encryption policy references aligned with NIST/FIPS standards
• Keeping documentation current with version control and audit history
With Cuick Trac, your encryption isn’t just running—it’s recorded, compliant, and review-ready.
Final CTA
Encryption is essential—so is proving it.
Schedule a Cuick Trac demo to document and defend your CUI-in-transit encryption strategy.