- Confirm each pathway on the remote-access inventory actually encrypts, including vendor support tools whose transport you have never examined.
- Where the cryptography protects CUI confidentiality, FIPS validation of the modules becomes relevant — this requirement intersects 3.13.11 rather than standing alone.
3.1.13OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.1.13 — Remote access confidentiality
3.1 Access Control · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Remote sessions ride encrypted channels, so credentials and CUI in transit cannot be read off the wire. In practice this means every remote pathway terminates in a VPN or TLS-protected service — and none of the legacy cleartext protocols face the internet.
Across revisions
Withdrawn as a standalone slot in Rev. 3 (03.01.13); session encryption is carried inside the consolidated Remote Access requirement, 03.01.12.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- VPN and gateway configuration showing protocol and cipher settings
- An external scan confirming no cleartext remote protocols are exposed
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |