Implement cryptographic mechanisms to prevent unauthorized disclosure at rest
📖 What This Means
This control requires organizations to use encryption to protect sensitive data when it is stored (at rest). Encryption transforms data into a format that can only be read by someone who has the correct decryption key. This ensures that even if unauthorized individuals gain access to the storage media (like hard drives, databases, or cloud storage), they cannot read the data. For example, encrypting customer information in a database or encrypting files on a laptop ensures that the data remains secure if the device is lost or stolen. This practice is essential for protecting sensitive information, especially in industries like defense contracting, where data breaches can have severe consequences.
🎯 Why It Matters
Data at rest is a prime target for cybercriminals because it is often stored in one location for extended periods, making it easier to exploit. Without encryption, unauthorized access to storage devices or databases can lead to data breaches, resulting in financial losses, reputational damage, and legal penalties. For example, in 2021, a major healthcare provider suffered a breach where unencrypted patient data was stolen, costing the company millions in fines and remediation. From a DoD/CMMC perspective, this control is critical because it ensures that Controlled Unclassified Information (CUI) is protected, even if physical or logical security measures fail.
✅ How to Implement
- Enable server-side encryption for all storage services (e.g., AWS S3, Azure Blob Storage, Google Cloud Storage).
- Use cloud provider-managed keys or bring your own key (BYOK) for encryption.
- Encrypt databases using Transparent Data Encryption (TDE) for SQL databases or similar features for NoSQL databases.
- Ensure encryption is enabled for virtual machine disks (e.g., AWS EBS, Azure Managed Disks).
- Configure encryption for backups and snapshots.
- Regularly audit encryption settings using cloud provider tools or third-party solutions.
- Train staff on cloud encryption best practices and policies.
📋 Evidence Examples
Encryption Policy Document
Encryption Configuration Screenshots
Key Management Logs
Encryption Testing Results
Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For SC.L2-3.13.8 ("Implement cryptographic mechanisms to prevent unauthorized disclosure at rest"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe your network security architecture, including segmentation, encryption standards, VPN configuration, session management, key management, and monitoring capabilities. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"SC.L2-3.13.8 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to implement cryptographic mechanisms to prevent unauthorized disclosure at rest. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"SC.L2-3.13.8 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to implement cryptographic mechanisms to prevent unauthorized disclosure at rest. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"SC.L2-3.13.8 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Document network architecture with CUI boundary clearly marked
- • Identify all encryption mechanisms (at rest and in transit)
- • Specify network monitoring and IDS/IPS deployment
- • Ensure this control covers all systems within your defined CUI boundary where implement cryptographic mechanisms to prevent unauthorized disclosure at rest applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 System and Communications Protection Policy
- 📄 Network architecture diagram
- 📄 Firewall rule documentation
- 📄 Encryption configuration documentation
- 📄 Evidence artifacts specific to SC.L2-3.13.8
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will review network diagrams for proper segmentation, test encryption settings, verify VPN split tunneling is disabled, and check FIPS 140-2 validation of cryptographic modules.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Is encryption enabled for all data at rest, including databases, storage, and backups?
Question 2: Are encryption keys managed securely using a key management solution?
Question 3: Are encryption policies documented and communicated to all relevant staff?
Question 4: Are decryption processes tested regularly to ensure data accessibility?
Question 5: Are encryption configurations audited periodically?
⚠️ Common Mistakes (What Auditors Flag)
1. Encryption not enabled for all data at rest.
2. Using weak encryption algorithms.
3. Failure to securely manage encryption keys.
4. Not testing decryption processes.
5. Incomplete documentation of encryption policies.
📚 Parent Policy
This practice is governed by the System and Communications Protection Policy