# CMMC 2.0 AC.3.022 Encrypt CUI on mobile devices and mobile computing platforms.

- Source: https://support.icompaas.com/support/solutions/articles/62000229420-cmmc-2-0-ac-3-022-encrypt-cui-on-mobile-devices-and-mobile-computing-platforms-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CMMC](https://support.icompaas.com/support/solutions/62000112530) › [2.0](https://support.icompaas.com/support/solutions/folders/62000168778)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Level 2**

  

**Description:**

Organizations can employ full-device encryption or container-based encryption to protect the confidentiality of CUI on mobile devices and computing platforms. Container-based encryption provides a more fine-grained approach to the encryption of data and information including encrypting selected data structures such as files, records, or fields. See \[NIST CRYPTO\].  
  
\[23\] Mobile devices and computing platforms include, for example, smartphones and tablets.  

  

**Priority:** High 

  

**Domain: ACCESS CONTROL (AC)** 

  

**Services Associated with AWS:** 

-   AWS Key Management Service (KMS), AWS Secrets Manager, AWS Mobile Hub  
    

  

**Services Associated with Azure:**

-   Azure Information Protection

-   Azure Key Vault

-   Azure Disk Encryption

-   Azure Virtual Machines

-   Azure Security Center

-   Azure Active Directory (Azure AD)

-   Azure Backup

-   Azure Site Recovery

-   Azure Storage

-   Azure SQL Database

  

Objective Evidence: 

-   Administrative: documented policies, standards & procedures 

-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations 

-   Administrative: supporting documentation to demonstrate how Mobile Device Management (MDM) is properly & securely implemented 

-   Technical: screen shot of MDM settings  
    

  

Possible Technology Considerations:

-   **Mobile Device Management (MDM) Secure Baseline Configurations (SBC)** 

  

**What needs to be answered:**

Does the company encrypt CUI on mobile devices?

  

**Checks for AWS**

-   Implement Full-Device Encryption for Mobile Devices  
    Description: This check ensures that full-device encryption is implemented on mobile devices to protect the confidentiality of Controlled Unclassified Information (CUI) stored on those devices. Full-device encryption ensures that all data and information on the device are encrypted.

-   Employ Container-Based Encryption for Mobile Computing Platforms  
    Description: This check verifies that container-based encryption is employed on mobile computing platforms to protect the confidentiality of CUI. Container-based encryption provides a more fine-grained approach to encrypting data and information, allowing for the encryption of selected data structures such as files, records, or fields.  

  

**Checks for Azure**

-   Enable Full-Device Encryption for Mobile Devices:  
    Description: This check ensures that full-device encryption is enabled on mobile devices. Full-device encryption protects the confidentiality of Controlled Unclassified Information (CUI) stored on those devices by encrypting all data and information present on the device. Enabling full-device encryption helps safeguard sensitive data and mitigates the risk of unauthorized access to CUI in case of device loss or theft.

-   Implement Container-Based Encryption for Mobile Computing Platforms:  
    Description: This check verifies that container-based encryption is implemented on mobile computing platforms. Container-based encryption provides a more fine-grained approach to encryption by encrypting selected data structures such as files, records, or fields. This policy check ensures that CUI on mobile computing platforms is protected through container-based encryption, enhancing the confidentiality of the information.

  

**More Details:** All access to CUI information cloud based. CUI within cloud system is encrypted and secured at all times.

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.