CMMC SC.3.185 - Implement Cryptography Mechanisms to Protect CUI unless Physical Safeguards

CMMC SC.3.185 - Implement Cryptography Mechanisms to Protect CUI unless Physical Safeguards

Requirement text: SC.3.185: Implement cryptographic mechanisms to prevent unauthorized disclosure
of CUI during transmission unless otherwise protected by alternative physical safeguards.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
This requirement applies to internal and external networks and any system components that
can transmit information including servers, notebook computers, desktop computers,
mobile devices, printers, copiers, scanners, and facsimile machines. Communication paths
outside the physical protection of controlled boundaries are susceptible to both interception
and modification. Organizations relying on commercial providers offering transmission
services as commodity services rather than as fully dedicated services (i.e., services which
can be highly specialized to individual customer needs), may find it difficult to obtain the
necessary assurances regarding the implementation of the controls for transmission
confidentiality. In such situations, organizations determine what types of confidentiality
services are available in commercial telecommunication service packages. If it is infeasible
or impractical to obtain the necessary safeguards and assurances of the effectiveness of the
safeguards through appropriate contracting vehicles, organizations implement
compensating safeguards or explicitly accept the additional risk. An example of an
alternative physical safeguard is a protected distribution system (PDS) where the
distribution medium is protected against electronic or physical intercept, thereby ensuring
the confidentiality of the information being transmitted.

CMMC CLARIFICATION
Only use FIPS-validated cryptography to protect the confidentiality of CUI during
transmission since it has been tested and validated to meet FIPS 140-3 requirements. Any
other approved cryptography cannot be used since it has not been tested and validated to
protect CUI. FIPS-validated cryptography is not a requirement for all information, it is only
used for the protection of CUI. This encryption guideline must be followed unless an
alternative physical safeguard is in place to protect CUI.

Example
You are an IT administrator responsible for employing encryption on all devices that
contains CUI for your organization. You install a Secure FTP server to allow CUI to be
transmitted in a compliant manner. You verify that the server is using a FIPS-validated
encryption module by checking the NIST Cryptographic Module Validation Program website.
You turn on the “FIPS Compliance” setting for the server during configuration since that is
what is required for this product in order to use only FIPS-validated cryptography.

References
• NIST SP 800-171 Rev 1 3.13.8
• NIST CSF v1.1 PR.AC-2
• CERT RMM v1.2 KIM:SG4.SP1
• NIST SP 800-53 Rev 4 SC-8(1)

    • Related Articles

    • CMMC SC.3.177 - Employ FIPS-Validated Cryptography to Protect CUI

      Requirement text: SC.3.177: Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Cryptography can be employed to support many security solutions including the protection ...

    • CMMC SC.3.191 - Protect CUI at Rest

      Requirement text: SC.3.191: Protect the confidentiality of CUI at rest. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-17 R2 Information at rest refers to the state of information when it is not in process or in transit and is located on storage devices ...

    • Physical Protection: SP 800-171 Security Family 3.10

      The term physical and environmental security refers to measures taken to protect systems, buildings, and related supporting infrastructure against threats associated with their physical environment. Physical and environmental requirements cover three ...

    • CMMC RE.2.138 - Protect CUI at Storage Locations

      Requirement text: RE.2.138: Protect the confidentiality of backup CUI at storage locations. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Organizations can employ cryptographic mechanisms or alternative physical controls to protect the ...

    • Systems and Communications Protection: SP 800-171 Security Family 3.13

      System and communications protection requirements provide an array of safeguards for the system. Some of the requirements in this family address the confidentiality information at rest and in transit. The protection of confidentiality can be provided ...