# NIST 800-171 3.8.6 Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

- Source: https://support.icompaas.com/support/solutions/articles/62000229315-nist-800-171-3-8-6-implement-cryptographic-mechanisms-to-protect-the-confidentiality-of-cui-stored-on
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

This requirement applies to portable storage devices (e.g., USB memory sticks, digital video disks, compact disks, external or removable hard disk drives). See \[NIST CRYPTO\].  \[SP 800-\] provides guidance on storage encryption technologies for end user devices. 

  

**Priority**: High   

  

**Category**: Network Security 

  

**Services Associated with AWS:**   

-   AWS Key Management Service (KMS), AWS CloudHSM, AWS Secrets Manager 

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Administrative: supporting documentation to demonstrate how cryptographic solutions are implemented
-   Technical: screenshot of sanitization technology, if applicable 

  

Possible Technology Considerations : 

-   Cryptographic Solution (data at rest)
-   Physical Access Control (PAC) 

  

**What needs to be answered :**  

  

Are cryptographic mechanisms used to protect digital media during transport outside of controlled areas? Does removable media support physical encryption? Is key vaulting utilized to ensure recoverability? Are data backups encrypted on media before removal from the company's secured facility?  

-   Cryptographic Protection of CUI during Media Transport  
    Description: This check ensures that organizations implement cryptographic mechanisms to protect the confidentiality of Controlled Unclassified Information (CUI) stored on digital media during transport, unless the media is already protected by alternative physical safeguards. Portable storage devices, such as USB memory sticks, digital video disks, compact disks, and external or removable hard disk drives, are susceptible to data breaches if lost or stolen during transport. Cryptographic protection provides an additional layer of security by encrypting the CUI stored on the media, making it inaccessible to unauthorized individuals in case of a breach. Organizations should follow cryptographic guidelines and standards, such as those provided by NIST, to select and implement appropriate encryption algorithms and key management practices. 

  

**More Details:**   

CUI is not stored on removable media.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.