AC.L2-3.1.19
Encrypt CUI on Mobile
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.19 in the reference catalog with its NIST cross-references
Official requirement
Encrypt CUI on mobile devices and mobile computing platforms.
Assessment objectives
a. mobile devices and mobile computing platforms that process, store, or transmit CUI are identified; and
b. encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Encrypt controlled information stored on mobile devices and mobile computing platforms.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of mobile device security for a company that processes CUI. You configure all laptops to use the full- disk encryption technology built into the operating system. This approach is FIPS-validated and encrypts all files, folders, and volumes. Phones and tablets pose a greater technical challenge with their wide range of manufacturers and operating systems. You select a proprietary mobile device management (MDM) solution to enforce FIPS-validated encryption on those devices [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing access control for mobile devices; system design documentation; system configuration settings and associated documentation; encryption mechanisms and associated configuration documentation; system security plan; system audit logs and records; other relevant documents or records
Common mistakes
Protecting a laptop while overlooking another mobile platform that stores controlled information.