NIST 800-171 3.13.8 (SC.L2-3.13.8): Encryption in Transit

What 3.13.8 means in practice

CUI moving across any network is encrypted, unless it is physically protected some other way, such as a cable that runs entirely inside a controlled area. That covers web traffic, email, file transfers and links between sites, and because the encryption protects CUI it should be FIPS validated.

SPRS points and the CMMC POA&M

What an assessor checks for 3.13.8

NIST SP 800-171A gives 3 determination statements for 3.13.8, each found satisfied or other than satisfied. Determine if:

1. 3.13.8[a] cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified.
2. 3.13.8[b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified.
3. 3.13.8[c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission.

NIST SP 800-171A (June 2018), assessment objectives for 3.13.8

Evidence that shows 3.13.8 is met

• TLS settings for web servers, applications and email.
• VPN or link encryption between sites.
• An inventory of the paths CUI travels, with the protection on each.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.13.8 from it. Each line says what the product checks.

• Azure Storage: Storage accounts. Checks that every Azure Storage account accepts only HTTPS.
• Azure App Service: App settings. Checks that every App Service accepts only HTTPS and requires TLS 1.2 or later.
• AWS: S3 buckets · Data stores · Load balancers, API Gateway, CloudFront and Lambda. Checks that S3 bucket policies deny insecure transport, that Redshift and ElastiCache encrypt connections, that load balancers listen only on HTTPS or TLS with ACM certificates and redirect HTTP, and that API Gateway stages use a client certificate.