System and Communications Protection is the second-largest family in NIST SP 800-171 and the home of the most-failed requirement in DCMA DIBCAC data: 3.13.11, FIPS-validated cryptography. Its sixteen requirements cover network boundaries, segmentation, encryption in transit and at rest, key management and a set of specific technologies.
It is where architecture decisions — enclave or whole network, which cloud, which VPN — turn into points.
What the System and Communications Protection family covers
System and Communications Protection contains 16 requirements, numbered 3.13.1 to 3.13.16 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix SC.L2, so 3.13.1 appears as SC.L2-3.13.1.
The family spans boundary protection and architecture (3.13.1–3.13.6), remote and session controls (3.13.7, 3.13.9), cryptography (3.13.8, 3.13.10, 3.13.11, 3.13.16), specific technologies such as collaborative devices, mobile code and VoIP (3.13.12–3.13.14), and session authenticity (3.13.15). Boundary choices are discussed in CMMC enclave vs GCC High.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.13.1 | Monitor, control and protect communications at external and key internal boundaries | 5 | No |
| 3.13.2 | Employ architectural designs, development techniques and engineering principles that promote security | 5 | No |
| 3.13.3 | Separate user functionality from system management functionality | 1 | Eligible |
| 3.13.4 | Prevent unauthorized and unintended information transfer via shared system resources | 1 | Eligible |
| 3.13.5 | Implement subnetworks for publicly accessible components, separated from internal networks | 5 | No |
| 3.13.6 | Deny network traffic by default and allow by exception | 5 | No |
| 3.13.7 | Prevent remote devices from split tunneling | 1 | Eligible |
| 3.13.8 | Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected | 3 | No |
| 3.13.9 | Terminate network connections at the end of sessions or after a defined period of inactivity | 1 | Eligible |
| 3.13.10 | Establish and manage cryptographic keys | 1 | Eligible |
| 3.13.11 | Employ FIPS-validated cryptography when used to protect the confidentiality of CUI | 5 (3 if partial) | Only if encryption is not FIPS-validated |
| 3.13.12 | Prohibit remote activation of collaborative computing devices and indicate devices in use | 1 | Eligible |
| 3.13.13 | Control and monitor the use of mobile code | 1 | Eligible |
| 3.13.14 | Control and monitor the use of Voice over Internet Protocol technologies | 1 | Eligible |
| 3.13.15 | Protect the authenticity of communications sessions | 5 | No |
| 3.13.16 | Protect the confidentiality of CUI at rest | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 42 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.13.1, 3.13.2, 3.13.5, 3.13.6, 3.13.11 and 3.13.15. 3.13.8 is worth three points. The remaining 9 are worth one point each.
3.13.11 has partial credit: five points if CUI is not encrypted, three if it is encrypted with a module that is not FIPS-validated. It is also the only requirement worth more than one point that may be placed on a POA&M — but only in that partially implemented state.
Why 3.13.11 is the most-failed requirement
FIPS validation applies to the cryptographic module, not the algorithm. A product using AES-256 is not compliant unless its module holds a current certificate from NIST's Cryptographic Module Validation Program under FIPS 140-2 or 140-3, and unless it is running in the validated mode. Assessors ask for the certificate numbers.
Organizations fail by citing algorithms instead of modules, by using FIPS-capable products with FIPS mode disabled, or by overlooking places CUI is encrypted: backups, email, file transfer tools, mobile devices and cloud services. The fix starts with an inventory of every place CUI is encrypted and the module used in each — see technical implementation.
Implementation priorities for SC
Draw the boundary first, because every other SC requirement is applied at it. Implement deny-by-default firewall rules and a separate subnetwork for anything publicly accessible. Then inventory every place CUI is encrypted and record the module and certificate number, enabling FIPS mode where needed. Disable split tunneling on the VPN. Finish with session termination, key management procedures and the device-specific controls for collaborative devices, mobile code and VoIP.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.13.3, 3.13.4, 3.13.7, 3.13.9, 3.13.10, 3.13.12, 3.13.13, 3.13.14 and 3.13.16 eligible for deferral.
Nine one-point requirements and the 3.13.11 partial-credit case are deferrable. The boundary and deny-by-default requirements (3.13.1, 3.13.6) are five-pointers and must be in place.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- Network diagrams showing external and key internal boundaries.
- Firewall rule sets demonstrating deny-by-default, allow-by-exception.
- A list of cryptographic modules with CMVP certificate numbers and FIPS mode settings.
- Encryption settings for data in transit and at rest, including backups.
- VPN configuration preventing split tunneling.
- Key management procedures.
Frequently asked questions
Is TLS 1.2 enough for 3.13.8?
It protects data in transit, but to satisfy 3.13.11 as well the TLS implementation must use a FIPS-validated module.
Does Microsoft 365 commercial meet 3.13.11?
Encryption in Microsoft cloud services uses validated modules, but DFARS 252.204-7012 also requires FedRAMP Moderate or equivalent for CUI, and ITAR data adds further restrictions. Many defense contractors use GCC High.
Can we defer 3.13.11?
Only if CUI is already encrypted and the gap is FIPS validation. Unencrypted CUI cannot be deferred.
Does 3.13.16 require full-disk encryption?
It requires protecting the confidentiality of CUI at rest. Full-disk encryption on endpoints and encrypted storage on servers are the usual ways, and the encryption must also meet 3.13.11.