3.1.19Encrypt CUI on mobile devices
Full-disk or container encryption on anything portable that holds CUI.
The requirement, verbatim
NIST SP 800-171 Rev. 2 · 3.1.19Encrypt CUI on mobile devices and mobile computing platforms.
NIST's discussion
Organizations can employ full-device encryption or container-based encryption to protect the confidentiality of CUI on mobile devices and computing platforms. Container-based encryption provides a more fine-grained approach to the encryption of data and information including encrypting selected data structures such as files, records, or fields.
NIST SP 800-171 Rev. 2, discussion under 3.1.19. Whitespace normalised; wording unchanged.
Assessment objectives
An assessor decides each of these separately. The requirement is met only when every objective is.
- [a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified
- [b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms
NIST SP 800-171A, determination statements for 3.1.19.
For assessors: examine, interview, test
NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.
Examine
- Access control policy
- procedures addressing access control for mobile devices
- system design documentation
- system security plan
- system configuration settings and associated documentation
- encryption mechanisms and associated configuration documentation
- system audit logs and records
- other relevant documents or records
Interview
- Personnel with access control responsibilities for mobile devices
- personnel with information security responsibilities
- system or network administrators
Test
- Encryption mechanisms protecting confidentiality of CUI on mobile devices
NIST SP 800-171A, potential assessment methods and objects for 3.1.19.
Evidence
No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.
Scoring weight
Worth 3 points. Not meeting this requirement subtracts 3 from your 110-point SPRS score.
DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.
In Rev. 3
Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is withdrawn and incorporated elsewhere: 03.01.18 Access Control for Mobile Devices.
See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.
Related requirements
Where this page's facts come from
- Requirement text
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
- Discussion
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
- Practice name
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
- Objectives
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
- Examine, interview, test
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
- Level
- bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
- Weight
- bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
- Rev. 3 mapping
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
- Plain-language title and summary
- editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)