Skip to content
ControlVerdict
Sign in
SC.L2-3.13.16CMMC Level 2Level 2

Data At Rest

Submit your own example

Practice statement

Protect the confidentiality of CUI at rest.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.13.16.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(1)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the confidentiality of CUI at rest is protected.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SC.L2-3.13.16Data At Rest
    Protect the confidentiality of CUI at rest.

    • [a]

      the confidentiality of CUI at rest is protected.

    Encryption at rest everywhere CUI lands, with a written list of where that is

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses the single Data At Rest objective for every location where CUI is authorized to reside.

    Locations enumerated. The control is only as good as the list, so the list is explicit: managed endpoint disks, the enclave SharePoint Online site collection, the Azure Storage account holding CAD and simulation output, the lab NAS volume, the backup repository and its offsite copy, and the two databases behind the MRP integration. Any other location is an unauthorized location, which is what DLP and the labeling policy are for.

    Endpoints. BitLocker with XTS-AES is required by compliance policy, enforced through MDM, with recovery keys escrowed to the directory. A device that reports unencrypted loses CUI access through Conditional Access rather than sitting on a report waiting for someone to notice. Suspending BitLocker requires a ticket and re-enables automatically after the maintenance window.

    Cloud storage. The enclave storage account uses service-side encryption with a customer-managed key held in the HSM-backed vault, so key revocation is a usable containment action. SharePoint Online relies on service encryption plus sensitivity labels that carry their own protection with the file. Infrastructure encryption is enabled on the storage account where the workload supports it.

    On-prem and backup. The lab NAS uses volume encryption with its key in the vault rather than on the appliance. Backups are encrypted at the repository with a key that is not stored alongside the backup data, and the offsite copy is encrypted before it leaves. The restore runbook includes retrieving the key from escrow, which is tested rather than assumed.

    Databases. Transparent database encryption is enabled, and the columns holding the most sensitive fields carry application-level encryption so a database file copy is not sufficient to read them.

    Maintenance. Weekly compliance report of unencrypted or encryption-suspended devices, with anything over three days becoming a ticket. Quarterly reconciliation of the authorized-location list against actual storage inventory, since new storage accounts and shares are how unencrypted copies appear. Annual restore test that exercises key retrieval from escrow.

    Accepted gap. One CNC controller writes toolpath files to an internal disk that cannot run organizational encryption. It is air-gapped, physically secured in the machine cell, holds only derived toolpaths rather than source CUI drawings, and is always physically destroyed at end of life under the sanitization SOP.

    What the evidence looks like

    • Written list of authorized CUI-at-rest locations with the encryption mechanism for each
    • BitLocker / MDM policy export and the compliance report showing encryption state
    • Storage account configuration showing customer-managed key and infrastructure encryption
    • Backup repository encryption settings and a completed restore test including key retrieval
    • Exception record for the CNC controller with its physical and destruction controls

    Environment

    Windows 11 laptops with BitLocker, enclave data in SharePoint Online and Azure Storage, one on-prem NAS in the engineering lab, plus backups.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.