CMMC 1.0 Practice MP.3.125 Requirement:

Implement cryptographic mechanisms to protect the confidentiality of “Controlled Unclassified Information” (CUI) stored on digital media during transport unless otherwise protected by alternative physical safeguards.

CMMC 1.0 MP.3.125 Requirement Explanation:

This requirement generally applies to portable storage devices such as USB thumb drives, CDs, DVDs, and external hard drives. Any digital media containing FCI or CUI that is transported outside of your facility must be encrypted or stored in a locked container.

Example CMMC 1.0 MP.3.125 Implementation:

Encrypt any digital media containing FCI or CUI that you intend to transport outside of your facilities. In general it is a good idea to encrypt all digital media when feasible.

CMMC 1.0 MP.3.125 Scenario(s):

- Scenario 1:

Your company wants to store its backups with a third party off-site. To protect the CUI on the backup drives it encrypts them. The third party is thus unable to access the CUI on the drives.

Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:


Compliance Accelerator

Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.

Quantum Assessor

Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.

Supply Chain Verifier

Trust is everything. Verify, monitor, and support subcontactor compliance.