Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission
📖 What This Means
This control requires using encryption to protect Controlled Unclassified Information (CUI) when it's being sent over networks. Think of it like putting a letter in a locked box before mailing it – even if someone intercepts it, they can't read the contents. You need to use government-approved encryption methods (like TLS 1.2 or higher for web traffic or VPNs for remote connections) whenever CUI is transmitted outside your secure network. For example, when emailing CUI to a subcontractor, you'd use encrypted email. Or when uploading CUI to a cloud system, you'd ensure the connection uses HTTPS with strong encryption.
🎯 Why It Matters
Unencrypted data transmissions are like shouting secrets across a crowded room – anyone listening can capture sensitive information. In 2020, a defense contractor had blueprints for a missile system stolen because they sent files via unencrypted FTP. The average cost of a data breach is $4.45 million (IBM 2023). For DoD contractors, leaked CUI can mean lost contracts, legal penalties, and national security risks. The CMMC requires this because the DFARS clause 252.204-7012 mandates protection of CUI in transit, and modern adversaries routinely intercept unencrypted communications.
✅ How to Implement
- 1. Enable TLS 1.2+ on all cloud services (AWS ALB, Azure App Gateway) – disable older protocols
- 2. Configure S3/Blob Storage to only allow HTTPS connections
- 3. Use cloud-native certificate managers (AWS ACM, Azure Key Vault) for SSL/TLS certificates
- 4. Implement VPN or Direct Connect for hybrid connections (AWS Client VPN, Azure P2S VPN)
- 5. Encrypt all API calls between cloud services using mutual TLS (mTLS)
- 6. Enable encryption-in-transit for database connections (AWS RDS TLS, Azure SQL SSL)
- 7. Document all encryption configurations in cloud security policies
📋 Evidence Examples
Encryption Policy
SSL/TLS Configuration Screenshots
VPN Configuration Documentation
SSL Labs Scan Results
Certificate Inventory
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For SC.L2-3.13.4 ("Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe your network security architecture, including segmentation, encryption standards, VPN configuration, session management, key management, and monitoring capabilities. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"SC.L2-3.13.4 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to implement cryptographic mechanisms to prevent unauthorized disclosure of cui dur.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"SC.L2-3.13.4 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to implement cryptographic mechanisms to prevent unauthorized disclosure of cui dur.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"SC.L2-3.13.4 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Document network architecture with CUI boundary clearly marked
- • Identify all encryption mechanisms (at rest and in transit)
- • Specify network monitoring and IDS/IPS deployment
- • Ensure this control covers all systems within your defined CUI boundary where implement cryptographic mechanisms to prevent unauthorized disclosure of cui during transmission applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 System and Communications Protection Policy
- 📄 Network architecture diagram
- 📄 Firewall rule documentation
- 📄 Encryption configuration documentation
- 📄 Evidence artifacts specific to SC.L2-3.13.4
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will review network diagrams for proper segmentation, test encryption settings, verify VPN split tunneling is disabled, and check FIPS 140-2 validation of cryptographic modules.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do we have a documented policy requiring encryption for all CUI transmissions?
Question 2: Are all external web services (including portals) using TLS 1.2 or higher with FIPS-approved cipher suites?
Question 3: Do we have a process to monitor and renew SSL/TLS certificates before expiration?
Question 4: Are all remote access solutions (VPN, RDP) using FIPS-validated encryption?
Question 5: Can we produce evidence of recent encryption testing (e.g., SSL Labs scans)?
⚠️ Common Mistakes (What Auditors Flag)
1. Using outdated protocols (SSLv3, TLS 1.0/1.1)
2. Self-signed certificates in production
3. No documentation of cipher suite selections
4. Emailing CUI as unencrypted attachments
5. Assuming cloud providers handle all encryption
📚 Parent Policy
This practice is governed by the System and Communications Protection Policy