Mapped to NIST 800-171 Requirement: 3.13.9
CMMC Assessment Objective: SC.L2-3.13.9[b]
What This Control Means
After identifying encryption usage (SC.L2-3.13.9[a]), you must:
• Write down where encryption is applied to systems storing CUI
• Describe the methods and technologies used (e.g., BitLocker, AWS server-side encryption)
• Confirm encryption aligns with recognized standards (e.g., FIPS 140-2, NIST SP 800-111)
This documentation must be clear, current, and available for assessor review.
Why It Matters
Without documentation:
• You can’t prove encryption was applied intentionally and systematically
• Teams may unknowingly store CUI on unprotected systems
• Risk assessments will lack credibility and traceability
• Audit and compliance efforts will fail
Clear documentation ensures everyone knows how CUI is protected at rest.
How to Implement It
1. Update Your SSP and Security Policies For each CUI-bearing system:
• Describe encryption implementation (e.g., “BitLocker AES-256 on Windows laptops”)
• State encryption settings (e.g., enabled on boot, full disk encryption)
• List cryptographic modules or services used
2. Maintain a System Inventory
• Include encryption status alongside device type, role, and owner
• Mark whether encryption is native (built-in) or added through third-party tools
3. Reference Compliance Standards
• Confirm use of validated encryption (e.g., FIPS 140-2/140-3)
• Document key management practices (e.g., centralized KMIP, HSM usage)
4. Review and Update Regularly
• Ensure changes to encryption tools, storage systems, or CUI locations are reflected
Evidence the Assessor Will Look For
• SSP entries describing CUI-at-rest encryption per system
• Policy documents requiring encryption for portable and fixed storage
• Inventory records showing encryption status
• Screenshots or audit logs showing encryption active on endpoints and servers
• Certifications or specs proving cryptographic tools meet FIPS/NIST standards
Common Gaps
• Encryption applied but not documented
• No clear tracking of which systems encrypt CUI at rest
• Policies reference encryption generally without system-specific mapping
• Documentation missing standards validation (e.g., FIPS compliance)
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Documenting system-by-system encryption coverage across your environment
• Mapping cryptographic protections to CUI-bearing assets
• Linking encryption methods to SSP and risk register entries
• Verifying encryption tools meet regulatory standards
• Providing audit-ready documentation of CUI-at-rest protections
With Cuick Trac, encryption isn’t just applied—it’s documented, compliant, and transparent.
Final CTA
Protecting data is critical—documenting it is compliance.
Schedule a Cuick Trac demo to document your encryption strategy for CUI at rest and make audit time stress-free.