Mapped to NIST 800-171 Requirement: 3.13.3
CMMC Assessment Objective: SC.L2-3.13.3[d]
What This Control Means
You’ve identified (a), documented (b), and implemented (c) encryption for data in transit—now you must demonstrate that those protections are consistently enforced at the system level.
This means:
• Encryption is mandatory across all transmission paths involving CUI
• Users cannot disable or work around encryption settings
• Traffic is blocked or redirected if encryption isn’t applied
• Weak or deprecated protocols are disabled or rejected
Why It Matters
If encryption isn’t enforced:
• Users might transmit CUI over unsecured channels without realizing it
• Misconfigured systems could fall back to outdated or no encryption
• CUI could be intercepted, altering your compliance and breach exposure
• You could pass a review today and fail tomorrow due to a silent failure
Enforcement ensures consistent and secure protection—without relying on user behavior.
How to Implement It
1. Configure Systems to Enforce Encryption by Default
• Web apps: Redirect HTTP to HTTPS
• File transfers: Disable FTP in favor of SFTP or FTPS
• Email gateways: Require TLS or encrypted attachments
• VPNs: Block all non-VPN traffic for remote users
2. Disable Insecure Protocols
• Deactivate:
◦ TLS 1.0 and 1.1
◦ SSL
◦ Telnet, FTP, and unencrypted RDP
3. Use Group Policies or Config Management Tools
• Push enforced encryption settings to:
◦ Browsers
◦ Email clients
◦ Remote access apps
◦ Mobile device configurations
4. Monitor for Exceptions
• Use SIEM or IDS/IPS to detect and alert on:
◦ Unencrypted data flows
◦ Protocol downgrades
◦ Misconfigured systems or apps
5. Test Regularly
• Conduct periodic scans to confirm encryption is working and cannot be bypassed
Evidence the Assessor Will Look For
• System configuration files showing enforced encryption settings
• Logs showing unencrypted traffic is blocked or redirected
• Documentation of policy enforcement (e.g., GPO, MDM profiles)
• Screenshots from encryption enforcement tools
• Scan reports confirming deprecated protocols are disabled
Common Gaps
• Encryption applied but optional or user-configurable
• Protocol fallback enabled (e.g., TLS downgrade attacks)
• File sharing tools allow unencrypted uploads or links
• Systems not consistently configured (some use HTTPS, others don’t)
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing encryption settings across your CUI-connected systems
• Tracking and documenting where encryption is required and blocked when absent
• Logging failed or attempted unencrypted transmissions
• Helping validate that all traffic policies comply with CMMC encryption enforcement expectations
• Providing audit-ready documentation showing where and how encryption is enforced
With Cuick Trac, your encryption controls don’t just exist—they’re locked in.
Final CTA
Set the standard. Lock it in. Enforce it.
Schedule a Cuick Trac demo to enforce encryption across every CUI transmission path and stay CMMC compliant.