Skip to content
ControlVerdict
Sign in
MP.L2-3.8.6CMMC Level 2Level 2

Portable Storage Encryption

Submit your own example

Practice statement

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.8.6.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(1)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    MP.L2-3.8.6Portable Storage Encryption
    Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

    • [a]

      the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.

    Hardware-encrypted drives only; the courier never carries a plaintext disk

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses the Portable Storage Encryption objective: the confidentiality of CUI on digital media during transport is protected by cryptographic mechanisms. We rely on cryptography rather than alternative physical safeguards, because a courier van is not a controlled area.

    Issued media only. The only removable media permitted to leave the building with CUI is an organization-issued drive with onboard hardware encryption using an approved algorithm, or a tape written by the backup system with encryption enabled. Consumer drives cannot mount on managed endpoints at all, so this is enforced rather than requested.

    Encryption specifics. Drives use hardware AES with the key material held on the device and unlocked by a passphrase entered on the drive or via the managed unlock utility; the encryption is always on and cannot be disabled by the user. Where a drive must be readable by a customer without our utility, we fall back to a container encrypted with a documented tool and a passphrase exchanged out of band. Tapes are encrypted by the backup application with keys held in escrow, not on the tape.

    Key handling. Passphrases are generated in the password manager and never travel with the media — the recipient gets the passphrase by a separate channel, typically a phone call to a known number after the shipment is confirmed received. Escrowed recovery keys for issued drives are held by IT so a forgotten passphrase does not become a data loss event.

    Before it ships. The write-out procedure requires confirming the target is an issued encrypted drive, verifying the encryption state, and recording the drive's asset tag on the chain-of-custody form. The verification step is a real check of the drive status, not a checkbox.

    Maintenance. Annual review of the drive model and its validation status against the crypto module inventory; quarterly confirmation that device control still blocks unencrypted media after endpoint platform updates.

    Accepted gap. One customer's receiving system can only read optical media. Those discs are written as an encrypted archive using an approved algorithm, with the passphrase exchanged by phone; the disc itself has no hardware protection, so the archive encryption is the entire control and the disc is treated as destroyed-on-arrival by the recipient.

    What the evidence looks like

    • Issued media inventory with model, encryption type, and asset tags
    • Device control policy blocking non-issued removable media
    • Backup application configuration showing tape encryption and key escrow
    • Write-out procedure with the encryption verification step
    • Out-of-band passphrase exchange procedure and a completed transport record

    Environment

    Design files too large for the customer portal move on physical media a few times a quarter. Backup tapes go off-site monthly. Everything else stays on the network.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.