MP.L2-3.8.6 Portable storage encryption

What MP.L2-3.8.6 portable storage encryption requires

MP.L2-3.8.6 asks you to protect the confidentiality of CUI stored on digital media during transport outside your controlled areas, using cryptographic mechanisms, unless alternative physical safeguards protect that media. In practice, a laptop, external drive, USB stick or other portable device carrying CUI that leaves a controlled area must either be encrypted or be protected by a physical safeguard you can describe and show. The risk is straightforward: a lost or stolen device with unencrypted CUI exposes that information to whoever finds it. NIST SP 800-171A assesses the requirement with a single objective, namely that the confidentiality of CUI on digital media is protected during transport by cryptographic mechanisms or alternative physical safeguards. The requirement is worth 1 point in the CMMC scoring methodology under 32 CFR 170.24. Your organization owns this control and the decision about how it is met. An implementation partner such as DeployOpen can prepare encryption configurations, procedures and evidence, but only an independent assessor can judge whether the requirement is met.

The hard part is usually discovery and decision-making, not the encryption itself. Start by listing every device that can hold CUI and leave a controlled area: company laptops, removable drives, phones with synced files, field equipment and devices carried by staff or couriers. Then confirm which of them already use full-disk or container encryption with FIPS-validated cryptography, because the CMMC Assessment Guide ties this protection to the criteria of SC.L2-3.13.11. For each transport, someone must decide whether encryption applies or whether an alternative physical safeguard, such as a locked case under continuous custody, is the control. Record that decision in a way an assessor can follow. Confirm with your assessor, your cryptographic module vendors and your own environment which devices and transport paths are in scope before you rely on any given method.

Evidence for this requirement usually includes the media transport procedure, a current inventory of portable devices and their encryption status, transport records or audit records showing when CUI left controlled areas, and test results showing that encryption is active on those devices. Where you rely on physical safeguards, keep written records of the safeguard and its use for each transport. Encrypt the device at the boundary, not only the files, and make sure the evidence is in final form, because drafts do not count toward a MET finding. Ask any service provider or tool vendor to document its cryptographic modules and validation status in writing before you include it in your scope.

Which devices, transports and teams fall under MP.L2-3.8.6

MP.L2-3.8.6 applies when CUI on digital media leaves a controlled area. The cards below cover the devices, people and third parties that create that transport event, so you can confirm scope before choosing encryption or alternative physical safeguards. Start with your CUI boundary, then trace every path where digital media travels out of it.

Laptops and mobile devices

Laptops, tablets and phones that store CUI and go home, to customer sites or to conferences are transported media in practice, even when no one thinks of them as drives. Check whether full-disk encryption is already enforced on each device and whether that encryption is validated under FIPS, because the requirement expects cryptographic protection of CUI, not only a passcode. Build an inventory of which endpoints are allowed to hold CUI at all, and remove the ones that are not in the boundary.

External drives and USB media

External hard drives, USB sticks and optical discs carrying CUI are the classic case for this requirement, since they are easy to lose and easy to hand to someone else. Confirm which ones exist, who owns them, and whether they are approved for CUI at all. Where a drive is encrypted, record the method and the key custody, and where it is not, document the alternative physical safeguard you rely on instead.

Backup media that leaves the site

Backup tapes, removable backup disks and replicated media sent to an off-site vault are transported digital media, so they fall under this requirement as well as MP.L2-3.8.9. Ask whether backup jobs write CUI to any device that is physically moved, and whether the vault or recovery site is inside your system boundary. Keep backup transport records with the same rigor as the production media they copy.

Couriers, shipping and remote staff

Any media that moves by courier, overnight shipping or hand delivery between offices, subcontractors or program sites is covered, and so is media carried by staff who work remotely. Identify each transport path, the people who initiate it and the people who receive it. Confirm that transport records show the sender, the recipient, the method and the date, so an assessor can trace each movement.

Third-party carriers and service providers

Outside carriers, managed service providers, data recovery firms and disposal vendors that handle CUI media extend your transport boundary. Review contracts to see who controls encryption, key handling and custody during transit, and confirm that subcontracts flow down the protection requirement. Ask each provider for written evidence of how it protects CUI, and record which party is responsible for each step.

Media that stays in a controlled area

Digital media that never leaves a controlled area is not transported outside it, so MP.L2-3.8.6 may not apply to that media directly. Those assets may instead fall under other media protection, access or physical requirements, so do not drop them from scope without checking. Document the controlled area boundary and the rules that keep media inside it, and confirm the rules are enforced in practice.

How an assessor tests MP.L2-3.8.6

This table walks through how an assessor works through the single NIST SP 800-171A objective for MP.L2-3.8.6, listing the test activity, the evidence requested and a common finding for each step. Read it as a checklist of what to prepare before an assessment, since the objective is met only when the cryptography or alternative physical safeguard is demonstrated for CUI in transit. Most failures come from missing transport records and unverified encryption settings rather than from the absence of encryption itself.

Assessment step	Test activity	Evidence requested	Common finding
Review media transport procedures	Read the documented procedures for moving digital media containing CUI outside controlled areas and confirm they require encryption or an approved alternative.	Current written procedure, its approval date and the owner, plus training records for staff who transport media.	Procedure exists but does not name the devices in scope or say when physical safeguards may replace encryption.
Identify in-scope media	Confirm which portable devices, external drives and removable media leave controlled areas and therefore fall under the requirement.	Asset inventory entries for portable media, with owner, location and CUI designation.	Inventory omits laptops, backup drives or courier-carried devices that carry CUI.
Inspect transport records	Sample transport records and check that each movement of CUI on digital media shows the cryptographic protection or the physical safeguard used.	System media transport records and related audit records, with dates, custodians, destinations and protection method.	Records show the movement but not the protection method, or the protection method is recorded as 'standard' without detail.
Test cryptographic mechanisms	Select a sample of encrypted media and verify that the encryption is active, uses FIPS-validated cryptography and protects the content during transport.	Encryption configuration, algorithm and module settings, key management records and the FIPS validation status of the cryptographic module.	Encryption is enabled on the device but the module is not FIPS-validated, or the validation certificate does not cover the version in use.
Check the SC.L2-3.13.11 link	Confirm that the cryptography used for transport meets the criteria of SC.L2-3.13.11, which covers FIPS-validated cryptography for CUI confidentiality.	Cross-reference between the encryption method and the SC.L2-3.13.11 implementation, and the system security plan entry.	Teams assess MP.L2-3.8.6 without linking it to the cryptography requirement, so the SSP does not explain the module used.
Test alternative physical safeguards	Where encryption was not used, verify that a documented exception exists and that physical safeguards protected the media during transport.	Exception approval, the reason encryption was not an option, custody logs, tamper-evident packaging records and courier agreements.	Exceptions are used by default for convenience, or safeguards are described in general terms without records for each shipment.
Confirm evidence is final	Check that procedures, records and configuration exports are final versions, not drafts, and that they cover the assessment period.	Dated final documents, version history and change records for encryption settings.	Screenshots or draft procedures are offered as proof, which assessors do not accept as final evidence.

How to implement encryption for CUI in transport

This sequence takes CUI on digital media from an unknown exposure to a documented, tested state in which every portable device is either encrypted with validated cryptography or protected by an approved physical safeguard. Each step ends with a record you can hand to an assessor.

Inventory digital media that leaves controlled areas
Start with a complete list of every digital medium that holds CUI and can leave a controlled area, including laptops, external drives, USB sticks, tapes, phones and media used for courier or shipping. Your asset owners and IT team build the list from system inventories, asset tags and interviews with staff who move data. The output is a media inventory that names each device, its owner, the CUI it holds and how it leaves the facility. Confirm the list against the system security plan so that the boundary and the transport routes match what you have documented.
Classify each transport class for protection
Group the inventoried media into transport classes, such as encrypted laptops carried by staff, drives shipped by courier and devices sent to external parties. For each class, decide whether cryptographic protection applies or whether an alternative physical safeguard, such as a locked container with custody records, protects the CUI. Record the reason for each decision. The output is a written classification that names the protection method for every class and that your security lead has approved.
Select and confirm FIPS-validated cryptography
For every class that relies on encryption, choose a mechanism that uses FIPS-validated cryptographic modules, then confirm the validation status in writing with the vendor or in the vendor's published validation records. Check the exact module name, version and operating mode, because a product can be validated in one mode and not another. Keep the validation certificate references in your evidence file. The output is a cryptography register that lists each product, its validated module and the configuration that meets the requirement.
Configure and enforce encryption on every device
Your IT or platform team turns on full-disk or container encryption for devices and applies it to portable storage, and it configures server-side or client-side encryption on any transfer tool that moves CUI on media. Use central management where possible so that policy is enforced rather than left to the user, and block unencrypted removable devices where your configuration allows it. Test the configuration on a sample device and confirm that the encryption status is reported. The output is a configuration baseline and a compliance report showing which devices are encrypted.
Write the transport procedure and records
Document how CUI media is prepared, encrypted, handed over, transported and received, including who approves a transfer and how key material is kept separate from the media. Define the transport record that accompanies each movement, such as a log entry with the device identifier, the sender, the recipient, the protection method and the date. The output is an approved transport procedure and a blank record template that staff use for every transfer. Confirm that the procedure matches how people actually work.
Test protection and collect final evidence
Test a representative set of transports end to end. Confirm that the device is encrypted, that the cryptographic mechanism is the validated one you documented, that an unencrypted device cannot be used in the approved class, and that the transport record is complete. Where you use an alternative physical safeguard, test the custody controls too. Your assessment lead then collects the final, signed versions of the inventory, classification, cryptography register, configuration baseline, procedure and records. Only final evidence counts toward a MET result, so resolve every draft before the assessment.

Evidence that satisfies MP.L2-3.8.6

MP.L2-3.8.6 is met only when the organization can show, with final-form records, where CUI on digital media is protected in transit and how. The artifacts below connect the written procedure, the device inventory, the technical configuration, the transport history and any exceptions, so an assessor can trace each claim back to a system. Assessors look for final, approved documents rather than drafts, and each artifact should carry a version, an owner and a review date.

Media transport procedure

The approved written procedure states when CUI on digital media must be encrypted before it leaves a controlled area, which cryptographic mechanisms apply, who may approve an exception, and who holds the decryption keys. It should name the FIPS-validated module used and reference the system security plan. Check that the procedure matches what staff actually do, because assessors compare the document against interviews and transport records. Review it on a fixed schedule and after any change in carriers, devices or tooling.

Inventory of in-scope portable devices

This inventory lists every laptop, external drive, USB device and other portable media that can hold CUI outside a controlled area. For each device, record the identifier, the custodian, the encryption tool, and whether full-disk or container encryption is enabled and verified. Include the date of the last check. Gaps in this list are a common reason an assessor cannot confirm that the procedure covers all transport. Reconcile it against asset management and endpoint records.

Encryption configuration exports

Configuration exports or dated screenshots show that encryption is enabled on each device class and that the cryptographic module is operating in a FIPS-validated mode. Ask the platform or endpoint team to confirm the validation status of the specific module version in use, because FIPS validation applies to a module version rather than a product name. Store exports with the hostname and date, and repeat them after updates that could reset settings.

Transport records with device identifiers

Transport records log each movement of CUI-bearing digital media outside a controlled area, with the device identifier, the date, the sender, the recipient and the encryption status at departure. Assessors test whether the records show encryption applied during the actual transports, so sampling matters. Where media moves through a courier, keep the custody record alongside the transport entry. Records should be produced by the workflow itself rather than reconstructed after the fact.

Physical safeguard and exception records

Where encryption was not possible, the records must show the alternative physical safeguards used, such as locked containers, escorted transport or controlled custody, and the approval for each case. An exception without a documented safeguard does not satisfy the requirement. Record the justification, the approver, the device identifier and the dates. Keep the approved exception list current, and remove exceptions once the device is encrypted or retired.

Retention and review cycle

Each artifact needs an owner, a version history and a review cadence set in the system security plan. Store final signed versions in the evidence repository, and keep superseded copies only as history. Confirm with your assessor which evidence period they expect, since the assessment looks at how the control operates over time and not only on the day of review. Ask the platform or consulting partner for a checklist that maps each artifact to the MP.L2-3.8.6 objective.

What meeting MP.L2-3.8.6 costs in money and effort

This table compares each cost component of encrypting or physically safeguarding CUI in transit, who is paid for it, whether it is one-time or recurring, and what pushes it up or down. No supplied figures exist for these costs, so use the drivers and quote questions to compare written proposals. Fees for any DeployOpen work follow a written scope, not a published price list.

Cost component	Who is paid or who bears it	One-time or recurring	Drivers and what to ask for in a quote
Encryption tooling or licenses for endpoints and media	Software vendor or open-source operator, plus your IT staff for deployment	Licenses often recur; open-source tooling has no license fee but still needs hosting and support	Number of laptops, drives and phones in scope. Ask whether licenses are per device or per user, and whether FIPS-validated modules are included and documented.
Engineering time to configure and verify encryption	Internal engineers or an implementation partner under a written scope	One-time for initial setup, then recurring for re-verification after changes	Number of device images, operating systems and transport workflows. Ask for a deliverable list covering configuration, test records and sign-off.
Physical safeguard hardware (locked transit cases, tamper-evident containers)	Your organization purchases and maintains the hardware	One-time purchase, with replacement and seal stock recurring	Volume of media moved outside controlled areas and the mix of physically safeguarded versus encrypted media. Ask for the seal inventory and reorder process.
Transport record upkeep	Your logistics, security or program staff	Recurring for every transport event	Number of transport routes and frequency of moves. Ask how records link media identifiers, destinations, custodians and encryption status.
External assessment support	Independent assessor or certification body (fees set by them), plus any consultant you hire	One-time per assessment cycle, with preparation recurring	Scope size and readiness of evidence. Consultants do not issue assessment results. Ask what the consultant prepares and what the assessor will independently test.
Assessor sampling time	Your staff, who answer questions and produce samples during the assessment	One-time per assessment cycle	Number of transport events the assessor samples and how quickly you can produce encryption configuration and transport records in final form.

Open-source tools that support the encryption evidence

Two self-hosted open-source platforms can produce part of the evidence for MP.L2-3.8.6. Each covers a different slice of the requirement, so an assessor will expect the organization to explain which slice each one addresses and where the rest of the evidence comes from.

Nextcloud server-side encryption

Nextcloud's server-side encryption protects file contents at rest on local and external storage, with keys kept on the server. It does not encrypt file names or folder structure, so metadata about CUI files stays visible to anyone with access to the storage. Treat it as support for the evidence on stored CUI files, not as a complete transport control. Confirm with the vendor whether the cryptographic module has FIPS-validated status in the version you deploy, and record the answer in the system security plan.

OpenBao transit secrets engine

OpenBao's transit secrets engine encrypts and decrypts application data without storing that data, and it supports versioned encryption keys with key rotation. This helps when in-house transport tooling needs centrally managed keys, so the keys are not hard-coded in scripts or copied onto laptops. It does not encrypt removable media by itself. Your team still has to wire it into the transfer process and show, with transport records, which CUI passed through it and when.

Who owns, who prepares and who assesses MP.L2-3.8.6

Your organization owns MP.L2-3.8.6. The requirement asks that CUI on digital media be protected by cryptography during transport, or by alternative physical safeguards, and that obligation stays with the organization that handles the CUI. Your team decides which devices and media are in scope, approves any exception where encryption is not used, and runs the transports themselves. Records of who carried what, when and under which safeguard are created and kept by your staff, because an assessor will ask for them directly.

Scope decisions: Name the owner of the list of portable devices, drives and media that can carry CUI, and keep that list current.
Exception approval: Document each case where physical safeguards replace encryption, with the rationale and an approver who is accountable for it.
Transport operations: Run the courier, shipment or hand-carry process and confirm that the chosen safeguard is applied each time.
Records: Maintain transport logs and custody records in a form an assessor can review in final form, not drafts.
Ownership of the outcome: Accept the assessment result and any plan of action that follows.

Before engaging anyone, confirm internally who holds each of these duties and whether they are written into your System Security Plan.

Where MP.L2-3.8.6 usually fails and how to close each gap

Most failures on MP.L2-3.8.6 are not cryptography problems. They are gaps in knowing which devices carry CUI, proving that protection is actually on, and writing down the decisions and records an assessor will ask for. Each card below names one gap and the closing action that addresses it.

Unknown inventory of portable devices

Many organizations cannot list every USB drive, external disk, laptop or phone that leaves a controlled area with CUI on it. Without that list, no one can show that every in-scope device is encrypted or covered by a physical safeguard. Start by mapping where CUI is copied to digital media, then build an inventory with an owner, device type and serial number for each item. Reconcile it against media transport records every quarter and ask the assessor which evidence they expect to see for each device.

Encryption on some devices, unverified on others

Teams often turn on full-disk or container encryption for laptops and assume the same is true for external drives, which are frequently formatted without it. The assessor will test the actual state, not the intent. For each device on the inventory, check the encryption status with the platform's own tool and record the result, the date and the person who verified it. Remove any device that cannot show encryption from CUI transport until it can.

No rule for physical safeguards

The requirement allows alternative physical safeguards when cryptography is not used, but organizations often apply that exception informally, device by device. A written rule should state when encryption is required, which safeguards replace it (such as locked transport cases and custody controls), who approves the exception and how it is recorded. Because the exception must still protect CUI confidentiality, document how each safeguard works in practice. The assessment guide also expects that the cryptography used meets SC.L2-3.13.11, so confirm that requirement is covered too.

Transport records missing identifiers and dates

A transport log that says "external drive sent to site B" does not show which device carried CUI, when it left, who held it or whether it was encrypted. Assessors look for system media transport records and audit records that tie each movement to a specific device identifier and date. Add fields for device serial number, sender, recipient, departure and arrival dates, encryption status at departure and the approving owner. Test a sample of entries against the inventory before the assessment does.

Draft procedures presented as final

Transport procedures and encryption standards that exist only as drafts, or that were never approved and dated, do not count as evidence. A requirement is met only when every applicable assessment objective is satisfied with evidence in final form. Confirm that each procedure has an approved version, an effective date, an owner and a review cycle, and that staff are working from that version. Remove superseded drafts from the evidence folder so the assessor sees only the current record.

Module validation never confirmed

Teams often assume that an encryption tool is FIPS compliant because it uses strong algorithms. The requirement that covers this area calls for FIPS-validated cryptography, so the question is whether the specific module and version in use appear on a validated list, and whether the platform is configured to use that validated mode. Record the module name, certificate reference and the configuration setting that enforces it. Ask the vendor to confirm these details in writing for your version, because validation status applies to particular builds.

Common questions about MP.L2-3.8.6 cost, effort and outsourcing

Is MP.L2-3.8.6 less work than the other media protection requirements?

Usually, yes. It is worth 1 point under 32 CFR 170.24, while MP.L2-3.8.1, MP.L2-3.8.2 and MP.L2-3.8.8 are each worth 3 points and MP.L2-3.8.7 is worth 5. NIST SP 800-171A tests it with one assessment objective: CUI on digital media is protected during transport by cryptographic mechanisms or alternative physical safeguards. The effort sits in discovery, not design. Cost rises with the number of laptops, drives and transport paths, the number of teams that move media, and how many exceptions rely on physical safeguards instead of encryption.

Can an internal team implement MP.L2-3.8.6 without an outside partner?

Yes, if the organization has staff who can configure encryption, manage keys and document the result. Nothing in the requirement calls for an outside firm. The CMMC Assessment Guide ties this cryptography to the criteria of SC.L2-3.13.11, so the team must select and configure FIPS-validated cryptography correctly and be able to explain it. Most of the cost is internal staff time for inventory, configuration, testing and records. Recurring work includes onboarding new devices, rotating keys and reviewing exceptions. Ask whether the team has done this before and whether devices are managed centrally.

What does MP.L2-3.8.6 need from IT and security staff?

The work draws on four groups of people and records:

Asset owners who confirm which laptops, drives and other digital media leave controlled areas.
Engineers who enforce encryption on those devices and confirm the modules are FIPS-validated.
Key custodians who define who holds keys, how they are stored and how they are recovered.
Records owners who keep transport logs and exception approvals in final form.

Check tool coverage carefully. The Nextcloud admin manual notes that its server-side encryption protects file contents at rest but does not encrypt file names or folder structure, so it may need supplementing where the transport path matters. Confirm each tool's behavior in your own environment before you rely on it.

How long does it take to get MP.L2-3.8.6 evidence ready?

The timeline depends on the device inventory and the number of transport paths, not on the control design. Evidence must be in final form, because a requirement is MET only when all applicable objectives are satisfied with evidence that is final, not drafts (32 CFR 170.16, 170.17 and 170.24(b)). Plan time for finding every relevant device, configuring and testing encryption, writing transport procedures, and collecting transport records that show the process working in practice. A process that has been written but never used leaves little to show an assessor. Ask any provider for a fixed scope and timeline in writing before work starts.

How do the 1-point score and POA&M rules affect MP.L2-3.8.6 urgency?

The 1-point weight makes this a small score item, but it is not a reason to delay. Under 32 CFR 170.21, a 1-point requirement that is not on the exclusion list can go on a plan of action and milestones (POA&M) for Conditional Level 2 status if the score is at least 88 of 110, with closeout due within 180 days. A POA&M is a bridge, not an exemption, and it only helps if the fix is achievable within that window. On 13 July 2026, the Department of War suspended CMMC Phase II, but Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Confirm current status with the contracting officer.

Can an outside partner sign off that MP.L2-3.8.6 is met?

No. An implementation partner can prepare the encryption configuration, device records, procedures and evidence, but the organization owns its controls and its status. Only an independent assessor can issue an assessment result. Level 2 certification assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. DeployOpen prepares systems, controls and evidence for assessments, and it does not issue audit reports, attestations or certifications. Ask any partner to put in writing what it will deliver, and confirm that it will not perform the assessment itself.

How DeployOpen scopes and prepares MP.L2-3.8.6 evidence

DeployOpen works on MP.L2-3.8.6 by scoping which digital media carry CUI outside controlled areas, then building and documenting the encryption or alternative physical safeguards that protect it in transit. The organization owns its controls and decisions, and DeployOpen prepares the systems and evidence an independent assessor will review.

How we scope

Identify every portable device, drive and removable medium that could carry CUI outside controlled areas.
Record which transport routes, couriers and shipments fall inside the written scope.
Confirm with the client which protection method applies to each device class before work starts.

How we build

Configure FIPS-validated encryption on in-scope devices and systems, with the module versions confirmed in the environment.
Document the alternative physical safeguards for any media where encryption is not an option.
Test that encrypted media and transfer tools refuse to operate without the required cryptographic mechanisms in place.

How we hand over

Deliver the device inventory, encryption configuration records and transport procedures in final form.
Provide the test results and audit records an assessor would ask to see for this requirement.
Walk the client's staff through the procedures so the evidence reflects day-to-day practice.

How we support

Scope and fixed-scope deliverables, timelines and responsibilities are agreed in writing before work begins.
Ongoing support, upgrades and continuous testing are available as a retainer for changes to devices and transport methods.
Confirm with your assessor or certification body which evidence they accept before finalizing the package.