CMMC · Rev 2.132SC · System & Communications Protection

SC.L2-3.13.16

Data at Rest

Requirement

Protect the confidentiality of CUI at rest.

Assessment objectives

An assessor checks each lettered objective separately. The letters in brackets elsewhere on this page, such as [a] or [b,c], refer to these.

Determine if:

athe confidentiality of CUI at rest is protected.

From the CMMC Level 2 Assessment Guide v2.13 · publisher approved 2026-10-31.

Further discussion

CUI at rest means information that is not moving through the network; typically this means data currently stored on hard drives, media, and mobile devices. Implement the necessary security controls to protect the confidentiality of CUI at rest. Although an approved encryption method protects data stored at rest, there are other technical and physical solutions. The methods chosen should depend on the environment and business needs. Implementing encryption for CUI is one approach to this requirement, but it is not mandatory. Physical security is often employed to restrict access to CUI, particularly when it resides on servers within a company’s offices. Other approaches for protecting CUI include system-related protections such as configurations and rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content that eliminate attempts at exfiltration. You may also employ other security requirements including secure off-line storage. Because the use of cryptography in this requirement is to protect the confidentiality of CUI, the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. This requirement, SC.L2-3.13.16, specifies confidentially be provided for CUI at rest and complements MP.L2-3.8.9, which specifies confidentially of CUI at backup storage locations. This requirement, SC.L2-3.13.16, also leverages SC.L2-3.13.11, which specifies that the algorithms used must be FIPS-validated cryptography. Example 1 Your company has a policy stating CUI must be protected at rest and you work to enforce that policy. You research Full Disk Encryption (FDE) products that meet the FIPS encryption requirement. After testing, you deploy the encryption to all computers to protect CUI at rest [a]. Example 2 You have used encryption to protect the CUI on most of the computers at your company, but you have some devices that do not support encryption. You create a policy requiring these devices to be signed out when needed, stay in possession of the signer when checked out, and to be signed back in and locked up in a secured closet when the user is done with the device [a]. At the end of the day each Friday, you audit the sign-out sheet and make sure all devices are returned to the closet. Potential Assessment Considerations • Is the confidentiality of CUI at rest protected using encryption of storage devices and/or appropriate physical methods [a]?

Practice guide notes

Implementation guidance

Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.

In plain language

Protect the confidentiality of controlled information at rest.

Implementation example

Example from the source assessment guide (not a mandatory implementation): Your company has a policy stating CUI must be protected at rest and y ou work to enforce that policy. You research Full Disk Encryption (FDE) products that meet the FIPS encryption requirement. After testing, you deploy the encryption to all computers to protect CUI at rest [a]. Example 2 You have used encryption to protect the CUI on most of the computers at your company, but you have some devices that do not support encryption . You create a policy requiring these devices to be signed out when needed, stay in possession of the signer when checked out, and to be signed back in and locked up in a secured closet when the user is done with the device [a]. At the end of the day each Friday, you audit the sign- out sheet and make sure all devices are returned to the closet.

Evidence examples

Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing protection of information at rest; system security plan; system design documentation; list of information at rest requiring confidentiality protections; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; other relevant documents or records

Common mistakes

Protecting transmitted data while leaving stored copies inadequately protected.

Crosswalk

Full crosswalk

The NIST requirements this practice is built on and the SP 800-53 controls behind them. Open any one to read it and see every CMMC practice it supports.

NIST SP 800-171 Rev 2Rev 3 counterpartNIST SP 800-53

NIST SP 800-171 Rev 2

3.13.16

Rev 3 counterpart

—

NIST SP 800-53

SC-28

How to implement

Protect CUI wherever it is stored: laptops, desktops, servers, file shares and NAS units, removable media, phones and tablets, cloud storage and email. Encryption with FIPS-validated modules is the usual answer and the only practical one for anything that leaves the office; physical protection (locked rooms, locked storage, sign-out logs) is an accepted alternative for equipment that stays inside a controlled space, as the guide's second example shows. Backups are covered separately by MP.L2-3.8.9.

1
ProcessIdentify where CUI rests: endpoints, servers and virtual machines, NAS and file shares, removable media, mobile devices, cloud storage and mailboxes, line-of-business databases, and copier or scanner storage. For each location, record the protection method: validated encryption, physical protection, or both [a].[a]
2
TechnicalEncrypt every laptop and desktop in the CUI environment with full-disk encryption (BitLocker with XTS-AES 256 on Windows Pro or Enterprise, FileVault on macOS), enforced through Intune, Jamf or Group Policy with recovery keys escrowed, and a compliance policy that blocks unencrypted devices from CUI services [a].[a]
3
TechnicalEncrypt servers and storage that hold CUI (BitLocker on Windows Server volumes, encrypted storage on hypervisors or SANs with validated modules). Where a NAS or appliance cannot use validated encryption, keep it in a locked, access-controlled room and document the physical protection, or replace it.[a]
4
TechnicalControl removable media: allow writing only to BitLocker To Go-encrypted drives or FIPS-validated hardware-encrypted drives (Intune or GPO 'Deny write access to removable drives not protected by BitLocker'), and require passcodes and device encryption on managed phones and tablets [a].[a]
5
ProcessFor devices that cannot be encrypted, use the physical alternative from the guide: a sign-out log, the device stays with the person who signed it out, and it is returned to locked storage; audit the log weekly. Rely on your FedRAMP-authorized cloud provider's encryption at rest for cloud data and record it in the SSP.[a]

Evidence to collect

Artifacts that show the practice is implemented and operating. Tags show which assessment objectives each one supports.

CUI storage location inventory[a]

record · reviewed annually and on change

Table of each place CUI is stored, the protection method (encryption with CMVP certificate, or physical controls) and the owner.

Endpoint encryption compliance report[a]

configuration export · dated within 30 days

Intune encryption report, Jamf FileVault report or manage-bde -status output showing every CUI device encrypted, plus the enforcing policy.

Server and storage encryption evidence[a]

configuration export · current configuration

BitLocker status for server volumes or storage encryption settings, with the module's CMVP certificate.

Removable media and mobile device policies[a]

configuration export · current configuration

Intune or GPO removable storage policy and mobile compliance policy requiring encryption and a passcode.

Physical protection records[a]

record · most recent three months

Sign-out logs, weekly audit notes, and photos or access lists for the locked storage or server room used instead of encryption.

Cloud provider encryption-at-rest documentation[a]

other · current version

Provider documentation or FedRAMP package excerpt describing encryption at rest for the CUI service.

How assessors check

Examine: SSP, media and data protection policies, storage inventory, encryption and device management configurations, compliance reports, physical protection records.
Interview: System administrators or the MSP, and users who carry CUI on laptops or removable media.
Test: Show BitLocker or FileVault status on a sampled laptop; insert an unencrypted USB drive and show writing is blocked; show an unencrypted device is denied access to CUI services; inspect the sign-out log and locked storage for non-encryptable devices.

Tools and products

Named options a contractor can adopt, with an honest cost tier. The industry standard is listed even when it is expensive, alongside what is free and acceptable for a very small shop.

BitLocker (Windows Pro/Enterprise)Full-disk encryptionFreeGood fit for a small shop

Included with Windows Pro and Enterprise; uses validated Windows cryptographic modules. Manage it centrally so you can prove it.

Apple FileVault with Intune or JamfFull-disk encryptionFreeGood fit for a small shop

Built into macOS; device management (paid) escrows keys and reports status.

Microsoft IntuneEncryption enforcement and reportingPaidGood fit for a small shop

Included in Microsoft 365 Business Premium and E3/G3 and above; enforces BitLocker, FileVault and mobile encryption and produces the compliance report assessors ask for.

Jamf ProMac encryption managementPaidWorkable for a small shop

Industry standard for managing Macs; worth it if you have more than a handful of Macs.

Kingston IronKey or Apricorn Aegis encrypted drivesEncrypted removable mediaPaidGood fit for a small shop

Hardware-encrypted USB drives with FIPS 140-validated models; check the certificate for the exact model before buying.

Locked storage and sign-out logPhysical alternativeFreeGood fit for a small shop

The guide's own example for devices that cannot be encrypted: sign-out sheet, locked closet and a weekly audit.

Editorial mentions, not endorsements. Pricing and tiers change; confirm with the vendor and check FedRAMP or GCC High availability where CUI is involved.

Common pitfalls

Laptops on Windows Home, which has no BitLocker management, or encryption enabled but recovery keys never escrowed.
A NAS with its own encryption feature that is not FIPS validated, sitting in an unlocked office.
VeraCrypt or password-protected ZIP files used for CUI on USB drives.
Forgetting copier and scanner hard drives, phones that receive CUI by email, and exported database files on desktops.

Platform notes

Microsoft 365 (GCC / GCC High)

GCC and GCC High encrypt data at rest with validated modules (BitLocker and service encryption). Use Intune disk encryption and compliance policies, Conditional Access to block non-compliant devices, and optionally Purview sensitivity labels with encryption for files that travel. Endpoint DLP can block copying CUI to unencrypted removable media (higher-tier licensing).

Google Workspace

Google encrypts Workspace data at rest; for endpoints, use Google endpoint management to require encryption on mobile devices and Windows device management for BitLocker, or a separate device management tool for Windows and macOS. Client-side encryption (Enterprise Plus and similar tiers) adds customer-held keys.

On-premises or MSP-managed

BitLocker through Group Policy with keys in Active Directory, encrypted server volumes, and a locked server room with an access list for any storage that cannot use validated encryption. Ask the MSP for a monthly encryption compliance report across all CUI devices.

Related practices: SC.L2-3.13.11, SC.L2-3.13.10, MP.L2-3.8.9, MP.L2-3.8.6, AC.L2-3.1.19, PE.L2-3.10.1

Editorial implementation guidance published November 2, 2026. It is not part of the official requirement and does not replace the assessment guide.

Track this in a workspace

The compliance workspace tracks each objective, its evidence and the tasks to close gaps. It is open to invited contractors while in pilot: request access below.

Source: DoD CIO · https://dodcio.defense.gov/CMMC/