Mapped to NIST 800-171 Requirement: 3.13.9
CMMC Assessment Objective: SC.L2-3.13.9[d]
What This Control Means
This is the enforcement checkpoint.
You must demonstrate that:
• Encryption at rest is forced on all CUI-related systems
• Users cannot opt out of encryption
• Devices and storage must comply automatically with encryption policies
• Noncompliant devices are blocked, isolated, or remediated
It’s not enough for encryption to be “available”—it must be unavoidable.
Why It Matters
If encryption isn’t enforced:
• New devices may store CUI without encryption
• External drives could bypass protections
• Lost or stolen systems could expose sensitive data
• Auditors will fail your security and compliance reviews
Enforced encryption ensures protection is consistent, automatic, and resilient to human error.
How to Implement It
1. Enforce Device Encryption at the Policy Level
• Use:
◦ Microsoft Group Policy for BitLocker enforcement
◦ MDM profiles for macOS/iOS (e.g., FileVault enforcement)
◦ Endpoint protection tools that block unencrypted devices
2. Require Encryption for External Storage
• Configure systems to:
◦ Only allow encrypted USB drives
◦ Block mounting of unencrypted external storage
3. Enforce Encryption for Cloud and Backup Storage
• Set cloud policies that:
◦ Require server-side encryption for buckets, containers, or blobs
◦ Require encryption keys to meet FIPS or NIST standards
4. Monitor and Remediate Noncompliance
• Alert on devices not reporting encryption status
• Quarantine or restrict access for noncompliant devices
• Require encryption during onboarding and provisioning workflows
Evidence the Assessor Will Look For
• Group Policies, MDM profiles, or endpoint management settings enforcing encryption
• Audit logs showing encryption compliance status for all devices
• Screenshots proving devices without encryption are blocked or flagged
• Cloud storage configuration settings requiring encryption
• Incident response records for noncompliance handling
Common Gaps
• Encryption recommended but not enforced
• Users allowed to disable encryption on endpoints
• No restriction on external storage device encryption
• New devices deployed without verifying encryption
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing encryption policies across all devices and cloud storage connected to CUI
• Monitoring compliance and alerting on violations
• Automatically tracking encryption status in device and system inventories
• Quarantining or alerting on noncompliant endpoints
• Documenting policy enforcement for auditors and internal governance
With Cuick Trac, encryption isn’t an option—it’s mandatory, verifiable, and continuously enforced.
Final CTA
Policy without enforcement is just a suggestion.
Schedule a Cuick Trac demo to enforce and verify encryption for every CUI storage location in your environment.