AC.L2-3.1.19
Encrypt CUI on Mobile
Requirement
Assessment objectives
An assessor checks each lettered objective separately. The letters in brackets elsewhere on this page, such as [a] or [b,c], refer to these.
Determine if:
- amobile devices and mobile computing platforms that process, store, or transmit CUI are identified; and
- bencryption is employed to protect CUI on identified mobile devices and mobile computing platforms.
From the CMMC Level 2 Assessment Guide v2.13 · publisher approved 2026-10-31.
How to implement
Any mobile device that can hold CUI must encrypt it with FIPS-validated cryptography. Turn on full-disk encryption on every laptop (BitLocker, FileVault), require device encryption on phones and tablets through MDM, keep recovery keys escrowed, and record the FIPS status of each platform in the SSP.
- 1ProcessFrom the mobile device inventory (3.1.18), mark which devices can store CUI (laptops, tablets, phones with CUI mail or files, removable drives used in the field).[a]
- 2TechnicalEnforce encryption through device management: BitLocker (XTS-AES 256, TPM + PIN recommended) via Intune or Group Policy with recovery keys escrowed to Entra ID/AD; FileVault via Intune or Jamf with escrowed keys; iOS and Android device encryption required by the compliance policy.[b]
- 3TechnicalUse encryption whose module has a CMVP certificate for the version you run, operated as its security policy prescribes: BitLocker on a Windows build Microsoft lists with certificates, and FileVault and iOS data protection on an OS version Apple's CoreCrypto certificates cover (not only 'in process'). Turn on the Windows legacy FIPS policy only if BitLocker uses a PIN or password protector, before creating it. Make compliance block access when a device reports encryption off.[b]
You can tell it worked when the encryption compliance report shows every mobile device encrypted, and each platform's OS version matches a certificate in your SSP table.
- 4
Evidence to collect
Artifacts that show the practice is implemented and operating. Tags show which assessment objectives each one supports.
Devices identified as CUI-capable[a]
record · dated within 90 days
Inventory column or MDM group of CUI mobile devices.
Encryption policy configuration[b]
configuration export · current configuration
Intune/Group Policy BitLocker settings, FileVault profile, mobile compliance policy requiring encryption.
Encryption compliance report[b]
record · dated within 90 days
MDM report showing encryption status per device; recovery key escrow evidence.
FIPS validation references[b]
record · reviewed annually
SSP table with CMVP certificate numbers for each platform's cryptographic module.
How assessors check
- Examine
- Inventory, encryption policies, compliance reports, SSP FIPS references.
- Interview
- Device administrator; users about field devices and removable media.
- Test
- Pick a laptop and show BitLocker/FileVault status and the escrowed key; show a phone's encryption state in MDM; show that a non-encrypted device is marked non-compliant and blocked.
Tools and products
Named options a contractor can adopt, with an honest cost tier. The industry standard is listed even when it is expensive, alongside what is free and acceptable for a very small shop.
Included in Windows Pro/Enterprise; uses Windows modules with CMVP certificates for the builds Microsoft lists; check your build on Microsoft's FIPS 140 validation page. Avoid Windows Home devices, which lack it.
- Assumes
- Windows Pro, Enterprise or Education on a build Microsoft lists with CMVP certificates, with TPM-backed BitLocker turned on before any CUI is stored.
- Still yours
- Enforcing it on every device, escrowing and protecting recovery keys, deciding on the legacy FIPS policy if you use PIN or password protectors, and reporting encryption status.
- Get from the vendor
- Microsoft's FIPS 140 validation page for your Windows build, the BitLocker compliance report, and your recovery-key escrow records.
Included in macOS; escrow keys through Intune or Jamf.
- Assumes
- macOS on a version Apple's CoreCrypto CMVP certificates cover, with FileVault turned on before any CUI is stored.
- Still yours
- Enforcing it through device management, escrowing recovery keys, and reporting encryption status.
- Get from the vendor
- Apple's security certifications page for your macOS version and your MDM FileVault compliance report.
Uses the MDM you already run; produces the compliance report assessors ask for.
Roughly 60–200 USD each; the simple way to carry CUI in the field.
- Assumes
- A drive model with an active CMVP certificate for its hardware module, used with a strong PIN.
- Still yours
- Buying only certified models, issuing and tracking each drive, setting PIN rules, and deciding what may be copied to it.
- Get from the vendor
- The model's CMVP certificate page, and your drive inventory and issue log.
Editorial mentions, not endorsements. Pricing and tiers change; confirm with the vendor and check FedRAMP or GCC High availability where CUI is involved.
Common pitfalls
- BitLocker 'on' but recovery keys stored nowhere, so a lost PIN means lost CUI.
- Encryption required for laptops but phones with CUI mail not covered.
- USB drives used in the field with no encryption (also see MP.L2-3.8.6).
Platform notes
Microsoft 365 (GCC / GCC High)
Intune Endpoint security → Disk encryption (BitLocker) with silent enablement and Entra key escrow; FileVault policy for Macs; compliance policies requiring encryption on all platforms; the Windows legacy FIPS policy (Settings Catalog) only where BitLocker uses a PIN or password protector.
Google Workspace
Managed device policies can require encryption on Windows/macOS/ChromeOS (ChromeOS is encrypted by default) and on mobile devices.
On-premises or MSP-managed
Group Policy BitLocker with recovery keys in AD (MBAM is retired; use AD DS or Intune escrow), Jamf for Macs, and the MSP's RMM reporting encryption status.
Related practices: AC.L2-3.1.18, MP.L2-3.8.6, SC.L2-3.13.11, SC.L2-3.13.16
Editorial implementation guidance published November 11, 2026. It is not part of the official requirement and does not replace the assessment guide.
Crosswalk
Full crosswalkThe NIST requirements this practice is built on, what NIST made of each in the newer edition, and the SP 800-53 controls behind them, each from an official NIST or DoD table. Open any one to read it and see every CMMC practice it supports.
NIST SP 800-171 Rev 2
3.1.19SP 800-171 Rev 3
03.01.1803.01.19 withdrawn; incorporated intoSP 800-53 Rev 4
AC-19 (5)SP 800-53 Rev 5
AC-19SAC-19(5)DSHow these were reachedHide how these were reached
- AC-19 · Access Control for Mobile Devices
- S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL) · via 800-171 Rev 3 03.01.18 → 800-53 Rev 5 AC-19
- AC-19(5) · Access Control for Mobile Devices | Full Device or Container-based Encryption
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 AC-19 (5) → 800-53 Rev 5 AC-19(5)
- S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL) · via 800-171 Rev 3 03.01.18 → 800-53 Rev 5 AC-19(5)
Rev 5 paths: D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison; S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL); C SP 800-172 (Feb 2021) Appendix C. NIST also names this Rev 3 requirement as the successor of other withdrawn requirements: open “How these were reached” under the Rev 5 controls for which, in NIST's words.
Where each link comes from (7 links from 5 official documents)
32 CFR Part 170 Office of the Federal Register / GPO
- AC.L2-3.1.19 → 3.1.19“Level 2 security requirement”32 CFR 170.14(c)(1) numbering (REQ is the NIST SP 800-171 R2 requirement number) and 170.14(c)(3)
Further discussion
Practice guide notes
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Encrypt controlled information stored on mobile devices and mobile computing platforms.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of mobile device security for a company that processes CUI. You configure all laptops to use the full- disk encryption technology built into the operating system. This approach is FIPS-validated and encrypts all files, folders, and volumes. Phones and tablets pose a greater technical challenge with their wide range of manufacturers and operating systems. You select a proprietary mobile device management (MDM) solution to enforce FIPS-validated encryption on those devices [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing access control for mobile devices; system design documentation; system configuration settings and associated documentation; encryption mechanisms and associated configuration documentation; system security plan; system audit logs and records; other relevant documents or records
Common mistakes
Protecting a laptop while overlooking another mobile platform that stores controlled information.
Track this in a workspace
The compliance workspace tracks each objective, its evidence and the tasks to close gaps. It is open to invited contractors while in pilot: request access below.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Source: DoD CIO · https://dodcio.defense.gov/CMMC/