What this control covers
This control requires implementing cryptographic mechanisms to protect the confidentiality of backup information and prevent the unauthorized disclosure of Controlled Unclassified Information (CUI) at backup storage locations. It suggests using hardware security modules (HSM) for managing cryptographic keys and performing cryptographic operations such as encryption and decryption. This control supports the Cryptographic Protection capability within the Media Protection (3.8) family.
Why it matters
Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.
How to implement
AWS
Default to SSE-KMS with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use S3 Bucket Keys and S3 Block Public Access at the account level, and turn on S3 Object Lock on backup buckets for ransomware resilience.
Azure
Store secrets in Key Vault (HSM-backed where required) with soft-delete + purge protection; use customer-managed keys for Storage, SQL, and Azure Disk Encryption. Tag PII data via Microsoft Purview.
GCP
Use Cloud KMS with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. Sensitive Data Protection (DLP API) inspects/de-identifies PII at scale.
Google Workspace
Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: System Backup - Cryptographic Protection.
Quick checklist
- Information — Management / Cui
- Protection — Management / Cui
- Configuration — Management / Cui
- System — Management / Cui
- Media — Management / Cui
- System Backup — Management / Cui
Related articles on this site
- NIST 800-171 3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- CMMC 2.0 SC.3.185 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- NIST 800-171 3.8.6 Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
- NIST 800-171 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.