Are encryption requirements applicable to CUI at rest and in transit?

• A. Encryption is optional for CUI at rest and in transit.
• B. Encryption is required only for CUI in transit.
• C. Encryption is required only for CUI at rest.
• D. Yes; use approved encryption for both at rest and in transit where applicable.

Answer: (D)

Encryption protects CUI by making it unreadable to anyone who doesn’t have the key. For CUI, the protection must cover both storage and transmission. When data rests on a device or in a repository, encryption helps guard against theft or unauthorized access to the storage medium. When data moves across networks, encryption protects it from interception, eavesdropping, or tampering. Using approved encryption means applying vetted algorithms and key management that meet baselines such as NIST standards and DoD guidance, ensuring interoperability and auditable compliance. The phrase “where applicable” recognizes that there may be specific constraints in some environments, but the standard expectation is to encrypt for both at rest and in transit whenever feasible. Therefore, require approved encryption for both states of CUI to maintain confidentiality throughout the data’s lifecycle.