- Use full-media encryption — hardware-encrypted drives, encrypted backup sets — with keys that do not travel alongside the media they protect.
- Where encryption is the protecting mechanism for CUI confidentiality, 3.13.11's FIPS-validated cryptography expectation reaches into this requirement.
3.8.6OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.8.6 — Media transport encryption
3.8 Media Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Digital media in transit is encrypted unless a physical safeguard genuinely stands in for it. Encryption is what turns a tape lost in shipping into an inconvenience instead of a reportable incident.
Across revisions
The standalone slot (03.08.06) is withdrawn in Rev. 3; transport encryption folds into the Media Transport requirement, 03.08.05.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- Encryption configuration for backup media and transported drives
- Key management records showing keys held separately from media
- Where an alternative physical safeguard is claimed, the documented safeguard itself
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |