Mapped to NIST 800-171 Requirement: 3.13.3
CMMC Assessment Objective: SC.L2-3.13.3[c]
What This Control Means
This is the implementation checkpoint.
You must show that your systems and networks are actively encrypting CUI during transmission, using validated cryptographic protocols such as:
• TLS 1.2 or higher
• IPsec VPNs
• SFTP, HTTPS, or SSH
• FIPS 140-2/140-3 validated encryption tools
Your assessors will expect to see this in operation, not just in documentation.
Why It Matters
If CUI is transmitted without encryption:
• It can be intercepted via packet sniffing, man-in-the-middle attacks, or unsecured APIs
• You’ll be in violation of DFARS 7012 and CMMC Level 2 requirements
• It could result in contract loss, data breaches, or audit failure
This control confirms your protections are working as intended in the real world.
How to Implement It
1. Validate Your Encryption in Transit
• Use packet sniffing or network analysis tools (e.g., Wireshark) to test for:
◦ HTTPS vs. HTTP
◦ TLS version compliance
◦ Use of SFTP instead of FTP
2. Review VPN and Remote Access Configurations
• Ensure VPN tunnels are:
◦ Enforced
◦ Using strong encryption (e.g., AES-256, SHA-2)
◦ Requiring MFA
3. Confirm Email and File Transfers Are Encrypted
• Check that email encryption (e.g., S/MIME, PGP) is in use for transmitting CUI
• Verify cloud sync tools or transfer platforms use HTTPS or SFTP
4. Review Config Files and Logs
• Look at system, application, or firewall configs that enforce encryption
• Confirm logs show encrypted session establishment and protocol use
Evidence the Assessor Will Look For
• Live demonstrations of encrypted data transmission (e.g., packet captures showing TLS handshakes)
• VPN configuration showing encryption settings
• Email gateway or file transfer tool settings enforcing encryption
• Screen captures or audit logs proving encryption is applied to CUI in transit
• System configurations referencing validated cryptographic libraries or modules
Common Gaps
• Encryption documented but not applied in practice
• TLS/SSL enabled but using outdated protocols (e.g., TLS 1.0, 1.1)
• FTP, Telnet, or other plaintext services still enabled
• Remote access tools (e.g., RDP) not configured to force encryption or MFA
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Validating that encryption is configured and active across CUI transmission paths
• Mapping encrypted traffic flows with protocol tagging
• Storing encryption verification records and screenshots
• Logging changes to firewall, VPN, and file transfer encryption settings
• Ensuring enforcement aligns with your SSP and FIPS/NIST standards
With Cuick Trac, encryption isn’t just promised—it’s proven.
Final CTA
Encrypt it. Confirm it. Prove it.
Schedule a Cuick Trac demo to validate that your encryption controls are actually protecting CUI in transit.