MP.L2-3.8.6 — Encrypt CUI on media during transport
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
Verbatim NIST SP 800-171 Rev 2 requirement text (3.8.6).
How it's scored
1 point deducted from your SPRS score if unmet.
An open gap here may sit on a POA&M at conditional Level 2 certification (32 CFR 170.21), provided your total score is at least 88 of 110 — and it must close within 180 days of the conditional status date.
What an assessor checks: the 1 assessment objective
NIST SP 800-171A determination statements, verbatim. A CMMC Level 2 assessor marks MP.L2-3.8.6 MET only when every applicable objective is satisfied — and examines evidence, not assertions.
| Objective | Determination statement |
|---|---|
| 3.8.6 | the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards. |
Where do you stand on MP.L2-3.8.6?
The free Muster Score walks all 110 requirements — including every objective above — and computes your exact SPRS score in your browser. No signup, no upload, and your answers never leave your device.
Get your free Muster Score →Requirement and objective text: NIST SP 800-171 Rev 2 / SP 800-171A (verbatim). Scoring: DoD Assessment Methodology v1.2.1; POA&M eligibility: 32 CFR 170.21. Muster is independent and not affiliated with the U.S. Department of Defense or the Cyber AB; this page is compliance information, not legal advice or a certification.