# NIST 800-171 3.13.15 Protect the authenticity of communications sessions.

- Source: https://support.icompaas.com/support/solutions/articles/62000229244-nist-800-171-3-13-15-protect-the-authenticity-of-communications-sessions-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

Authenticity protection includes protecting against man-in-the-middle attacks, session hijacking, and the insertion of false information into communications sessions. This requirement addresses communications protection at the session versus packet level (e.g., sessions in service-oriented architectures providing web-based services) and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted.  \[SP 800-77\], \[SP 800-95\], and \[SP 800-3\] provide guidance on secure communications sessions. 

  

**Priority**: High

  

**  
Category**:  Network Security 

  

  

**Services Associated with AWS:**

1.  AWS Shield
2.  Amazon GuardDuty
3.  AWS Certificate Manager
4.  AWS Key Management Service (KMS)
5.  Amazon API Gateway

  

**Objective Evidence:**  

-   Administrative: documented policies, standards & procedures  
    
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations  
    
-   Technical: screen shot of configuration settings  
    
-   Technical: screen shot of cryptography in use

  

Possible Technology Considerations : 

-   Secure Baseline Configurations (SBC)  
    
-   Cryptographic Solution (data in transit)  
    

  

**What needs to be answered?**

Are implemented controls in place to protect session communications (e.g., the controls implemented to validate identities and information transmitted to protect against man-in-the-middle attacks, session hijacking, and insertion of false information into sessions)? Does the system provide mechanisms to protect the authenticity of device-to-device communications sessions?  

-   Session Authenticity Protection Check  
    Description: This check ensures that the authenticity of communications sessions is protected. It verifies that measures are in place to prevent man-in-the-middle attacks, session hijacking, and the insertion of false information into communications sessions. It also ensures that there is confidence in the ongoing identities of other parties and the validity of the information transmitted.
-   Secure Communication Session Check  
    Description: This check ensures that secure communications sessions are established and maintained. It verifies that protocols and mechanisms for secure communication are in place, including TLS/SSL encryption, secure key exchange, and other methods for ensuring the security and integrity of data in transit.

  

**More Details:**

Communication sessions monitored and encrypted to prevent man in the middle attacks.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.