3.8.6

Requirement

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

Discussion

This requirement applies to portable storage devices (e.g., USB memory sticks, digital video disks, compact disks, external or removable hard disk drives). See [NIST CRYPTO]. [SP 800-111] provides guidance on storage encryption technologies for end user devices.

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: System media protection policy; procedures addressing media transport; system design documentation; security plan; system configuration settings and associated documentation; system media transport records; system audit logs and records; other relevant documents or records].
Interview

[SELECT FROM: Personnel with system media transport responsibilities; personnel with information security responsibilities].
Test

[SELECT FROM: Cryptographic mechanisms protecting information on digital media during transportation outside controlled areas].

ID	Assessment Objectives
3.8.6[a]	The confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!