MP.L2-3.8.6 Portable Storage Encryption

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

Source: NIST SP 800-171 Rev 2 3.8.6

Discussion: This requirement applies to portable storage devices (e.g., USB memory sticks, digital video disks, compact disks, external or removable hard disk drives). See [NIST CRYPTO]. [SP 800-111] provides guidance on storage encryption technologies for end user devices.

Assessment Objectives:

Determine if:

• [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.

Examine: [SELECT FROM: System media protection policy; procedures addressing media transport; system design documentation; security plan; system configuration settings and associated documentation; system media transport records; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system media transport responsibilities; personnel with information security responsibilities].

Test: [SELECT FROM: Cryptographic mechanisms protecting information on digital media during transportation outside controlled areas].

SPRS Score: 1

POA&M Allowed: Yes