NIST 800-171 3.8.6 (MP.L2-3.8.6): Encrypt Media in Transit
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
CMMC Level 2 practice MP.L2-3.8.6
What 3.8.6 means in practice
CUI on portable digital media, such as a USB drive or external disk carried between sites, is encrypted unless a physical safeguard, like a locked container under escort, protects it instead. Because the encryption protects CUI, it should be FIPS validated.
SPRS points and the CMMC POA&M
- CMMC Level 2 practice
- MP.L2-3.8.6
- SPRS points
- 1 point. When it is not met, the DoD Assessment Methodology subtracts 1 from the score of 110.
- CMMC POA&M
- Allowed. It is worth 1 point, and 32 CFR 170.21(a)(2)(ii) admits requirements worth 1 point. Conditional status also needs a score of at least 88, and the item must be closed within 180 days.
Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.
What an assessor checks for 3.8.6
NIST SP 800-171A gives one determination statement for 3.8.6.
Determine if the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.
NIST SP 800-171A (June 2018), assessment objectives for 3.8.6
Evidence that shows 3.8.6 is met
- Encryption settings for removable media, such as BitLocker To Go or hardware-encrypted drives.
- The list of approved encrypted devices.
- The documented physical safeguards, where encryption is not used.
How PolicyCortex gathers the evidence
No PolicyCortex collector reads the evidence for 3.8.6. Your team provides the evidence listed above.
Meet the requirement once. Keep the evidence current.
- Published
- Last updated
- Unchanged since publication