Mapped to NIST 800-171 Requirement: 3.13.8
CMMC Assessment Objective: SC.L2-3.13.8[d]
What This Control Means
This is the enforcement checkpoint.
You must demonstrate that:
• Remote access sessions cannot occur without encryption
• Users are forced onto encrypted channels (e.g., VPN, RDP with NLA, SSH)
• Systems reject unencrypted connection attempts automatically
• Encryption policies are pushed and maintained consistently across the environment
This ensures encryption is not optional—it’s a fundamental access requirement.
Why It Matters
If encryption is not enforced:
• Users might connect over plaintext protocols without realizing it
• Misconfigured devices could accidentally leak CUI
• Session hijacking or eavesdropping attacks become viable
• You could pass one scan—and fail your next real-world audit or incident review
Enforcement ensures that encryption is universal, persistent, and not dependent on user behavior.
How to Implement It
1. Configure Systems to Reject Unencrypted Access
• Require SSL/TLS for RDP, VPN, web access, email gateways
• Block non-secure ports at firewalls and routers
• Enforce strict policies on cloud platforms (e.g., AWS, Azure, Office 365)
2. Force VPN Usage for Remote Users
• Require all remote traffic to route through an encrypted VPN
• Disallow split tunneling unless explicitly reviewed and authorized
3. Monitor and Block Unencrypted Traffic
• Use IDS/IPS and firewalls to detect and prevent unencrypted session attempts
• Alert or auto-block connections that don’t meet encryption standards
4. Apply Device and Policy Enforcement
• Push encryption requirements through:
◦ Group Policy (Windows)
◦ MDM profiles (mobile devices)
◦ Configuration management tools (SCCM, Intune, Jamf)
5. Test and Audit Regularly
• Perform regular connection tests to confirm encryption enforcement
• Simulate unencrypted session attempts to validate system responses
Evidence the Assessor Will Look For
• VPN or RDP gateway settings enforcing encryption
• Firewall or proxy policies blocking non-secure protocols
• Logs showing denial of unencrypted connection attempts
• Screenshots or configuration exports showing encryption enforcement
• Audit reports confirming consistent remote access encryption
Common Gaps
• Encryption available but not required (users can bypass)
• Older RDP servers allowing fallback to unencrypted sessions
• VPN policies permitting insecure access or split tunneling without restrictions
• Lack of technical controls preventing plaintext connections
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing encryption requirements across all remote access channels
• Monitoring for session creation and validating encryption status
• Logging unencrypted session attempts and blocking violations
• Pushing compliance policies through MDM, GPO, and cloud configurations
• Providing auditors with proof that encryption enforcement is consistent and effective
With Cuick Trac, encrypted remote access is the only option—by design.
Final CTA
Enforced encryption is the difference between a good plan and a good defense.
Schedule a Cuick Trac demo to lock down your remote access encryption and ensure no CUI session ever travels unsecured.