CMMC AC.3.022 - Encrypt Mobile Devices

CMMC AC.3.022 - Encrypt Mobile Devices

Requirement text: AC.3.022: Encrypt CUI on mobile devices and mobile computing platforms.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Organizations can employ full-device encryption or container-based encryption to protect
the confidentiality of CUI on mobile devices and computing platforms. Container-based
encryption provides a more fine-grained approach to the encryption of data and information
including encrypting selected data structures such as files, records, or fields. Protecting
cryptographic keys is an essential element of any encryption solution.

CMMC CLARIFICATION
Ensure CUI is encrypted using approved and validated algorithms for full disk encryption
(FDE) or container-based encryption on all mobile devices and platforms to include
smartphones, tablets, E-readers, and notebook computers. Mobile phones will typically
encrypt a virtual container on the device; CUI should be held within the secure encrypted
container. A laptop will typically use FDE. One big advantage of using encrypted containers
on smartphones is applications and temporary files are not encrypted, preserving battery
life that would otherwise be shortened by unnecessary cryptographic operations.

Example
You are in charge of implementing encryption for your organization. One of the encryption
methods you chose for mobile devices is full disk encryption to encrypt all files, folders and
volumes. When an individual checks out digital media and leaves the building a thief who
obtains the media cannot access the information since everything on the disk is encrypted.
Similarly, all CUI on a smartphone is put in a secure encrypted container, and if a phone
containing CUI is lost, an adversary cannot recover it.

References
• NIST SP 800-171 Rev 1 3.1.19
• CIS Controls v7.1 13.6
• NIST CSF v1.1 PR.AC-3
• CERT RMM v1.2 KIM:SG4.SP1
• NIST SP 800-53 Rev 4 AC-19(5)

    • Related Articles

    • CMMC AC.3.020 - Control Mobile Connections

      Requirement text: AC.3.020: Control connection of mobile devices. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 A mobile device is a computing device that has a small form factor such that it can easily be carried by a single individual; is ...

    • CMMC AC.2.006 - Limit Storage Devices

      Requirement text: AC.2.006: Limit use of portable storage devices on external systems. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2  Limits on the use of organization-controlled portable storage devices in external systems include complete ...

    • CMMC SC.3.188 - Control the Use of Mobile Code

      Requirement text: SC.3.188: Control and monitor the use of mobile code. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Mobile code technologies include Java, JavaScript, ActiveX, Postscript, PDF, Shockwave movies, Flash animations, and VBScript. ...

    • CMMC IA.1.077 – Verify Users, Processes and Devices

      Requirement text:  IA.1.077: Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Individual ...

    • CMMC SC.2.179 - Encrypt Sessions for Network Devices Management

      Requirement text: SC.2.179: Use encrypted sessions for the management of network devices. DISCUSSION FROM SOURCE: CMMC Management of network devices is a security critical process and needs to have confidentiality protection and authentication to ...