- Map CUI's transmission paths first: failures here are unknown paths — an unencrypted legacy transfer job, an SMTP hop outside the tenant — more often than weak ciphers on known ones.
- The physical-safeguards alternative is narrow: it means controlled areas the traffic never leaves, and claiming it requires being able to show it.
- Where encryption is what protects CUI confidentiality, 3.13.11's FIPS-validation expectation applies to the modules doing the work.
3.13.8OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.13.8 — Transmission confidentiality
3.13 System and Communications Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
CUI in transit is encrypted unless physical safeguards do the protecting. Every path CUI travels — email, file transfer, application sessions, site-to-site links — either runs under cryptographic protection or stays inside physically protected space end to end.
Across revisions
Notable consolidation: Rev. 3 merges transmission confidentiality with at-rest confidentiality (3.13.16) into a single Transmission and Storage Confidentiality requirement, 03.13.08.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- A transmission-path inventory for CUI with the protection named per path
- TLS and VPN configuration exports for the paths claimed as encrypted
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |