# NIST800 171 3.13.8 — Transmission and Storage Confidentiality

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist800171_3138_8ddf768404-nist800-171-3138-transmission-and-storage-confidentiality
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST SP 800-171 Readiness](https://support.icompaas.com/support/solutions/c_gen_nist800171) › [Situational Awareness](https://support.icompaas.com/support/solutions/folders/f_gen_cgennist800171_situationalawareness)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 171 · Control 3.13.8 · Priority: critical · Component: Situational Awareness

### What this control covers

This control requires implementing cryptographic mechanisms to protect the confidentiality of Controlled Unclassified Information (CUI) during transmission and while in storage. It ensures that CUI is safeguarded from unauthorized disclosure using encryption methods like TLS for transmission and storage encryption for data at rest. This control supports the Cryptographic Protection capability within the Situational Awareness (3.13) family.

### Why it matters

Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.

### How to implement

#### AWS

Default to **SSE-KMS** with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use **S3 Bucket Keys** and **S3 Block Public Access** at the account level, and turn on **S3 Object Lock** on backup buckets for ransomware resilience.

#### Azure

Store secrets in **Key Vault** (HSM-backed where required) with soft-delete + purge protection; use **customer-managed keys** for Storage, SQL, and Azure Disk Encryption. Tag PII data via **Microsoft Purview**.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Transmission and Storage Confidentiality.

### Quick checklist

-   Information — Management / Cui
-   Protection — Management / Cui
-   Configuration — Management / Cui
-   Security — Management / Cui
-   Network — Management / Cui
-   Transmission — Management / Cui

### Related articles on this site

-   [NIST 800-171 3.8.6 Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.](https://support.icompaas.com/support/solutions/articles/62000229315-nist-800-171-3-8-6-implement-cryptographic-mechanisms-to-protect-the-confidentiality-of-cui-stored-on)
-   [NIST 800-171 3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.](https://support.icompaas.com/support/solutions/articles/62000229258-nist-800-171-3-13-8-implement-cryptographic-mechanisms-to-prevent-unauthorized-disclosure-of-cui-duri)
-   [CMMC 2.0 SC.3.185 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.](https://support.icompaas.com/support/solutions/articles/62000229746-cmmc-2-0-sc-3-185-implement-cryptographic-mechanisms-to-prevent-unauthorized-disclosure-of-cui-during)
-   [NIST 800-171 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.](https://support.icompaas.com/support/solutions/articles/62000229245-nist-800-171-3-1-13-employ-cryptographic-mechanisms-to-protect-the-confidentiality-of-remote-access-s)

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.