Transmission and Storage Confidentiality (03.13.08)_transmission-and-storage-confidentiality

Transmission and Storage Confidentiality (03.13.08) Transmission and Storage Confidentiality

High-Level Description

Family: System and Communications Protection Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Transmission and Storage Confidentiality

What to Check

• Verify Transmission and Storage Confidentiality (03.13.08) Transmission and Storage Confidentiality is implemented for CUI systems
• Review SSP documentation for Transmission and Storage Confidentiality (03.13.08)
• Validate CMMC Level 2 assessment objective for Transmission and Storage Confidentiality (03.13.08)
• Confirm POA&M addresses any gaps for Transmission and Storage Confidentiality (03.13.08)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Transmission and Storage Confidentiality (03.13.08) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Implement Transmission and Storage Confidentiality per NIST SP 800-171 Rev 3.

Supplemental Guidance

This requirement applies to internal and external networks and any system components that can transmit CUI, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are susceptible to interception and modification. Encryption protects CUI from unauthorized disclosure during transmission and while in storage. Cryptographic mechanisms that protect the confidentiality of CUI during transmission include TLS and IPsec. Information in storage (i.e., information at rest) refers to the state of CUI when it is not in process or in transit and resides on internal or external storage devices, storage area network devices, and databases. Protecting CUI in storage does not focus on the type of storage device or the frequency of access to that device but rather on the state of the information. This requirement relates to 03.13.11.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Transmission and Storage Confidentiality (03.13.08) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active