Implement cryptographic mechanisms to protect the confidentiality of “Controlled Unclassified Information” (CUI) stored on digital media during transport unless otherwise protected by alternative physical safeguards.

This requirement generally applies to portable storage devices such as USB thumb drives, CDs, DVDs, and external hard drives. Any digital media containing CUI that is transported outside of your facility must be encrypted or stored in a locked container.

Encrypt any digital media containing CUI that you intend to transport outside of your facilities. In general, it is a good idea to encrypt all portable digital media.