NIST 800-171 Controls · Media Protection

MP.2.123 — Implement cryptographic mechanisms to protect CUI during transport

CMMC Level 2SPRS if unmet: -1MEDIUM priority~5h to implement

Implement cryptographic mechanisms to protect the confidentiality of CUI during transmission unless otherwise protected by alternative physical safeguards.

What MP.2.123 means in plain English

Whenever CUI travels over a network or the internet — email, file transfer, web upload — it must be encrypted in transit so it cannot be intercepted and read. "Encryption in transit" means the connection is protected with TLS (you see "https://" in the browser or the email is sent over an encrypted connection). For your team, this means: only send CUI by email using Microsoft 365 encrypted email, only upload CUI to systems accessed over HTTPS, and never transmit CUI over unencrypted connections like plain HTTP, plain FTP, or unprotected public Wi-Fi without a VPN.

The assessment question

“Is all CUI transmitted over networks protected by FIPS-validated cryptographic mechanisms (TLS 1.2+, AES-256) — and are employees prevented from transmitting CUI over unencrypted channels?”

How to implement MP.2.123

Verify all services used for CUI file sharing use HTTPS with TLS 1.2 or higher: check SharePoint, email, and any cloud storage — use SSL Labs (free) to confirm the TLS version.
Configure Microsoft 365 to automatically encrypt outbound emails containing CUI using Microsoft Purview Message Encryption — set up transport rules that trigger encryption when the subject includes "CUI" or the sensitivity label is applied.
Block unencrypted transmission channels: configure your email server to reject connections that do not use TLS (Microsoft 365 enforces TLS by default — verify this has not been disabled).
Deploy a VPN for employees working from locations with untrusted Wi-Fi (coffee shops, hotels) — any CUI work on public Wi-Fi must go through the VPN tunnel.
Update your CUI Handling Policy and employee training to explicitly prohibit sending CUI via personal email, unencrypted FTP, or direct messaging apps that do not support end-to-end encryption.

Evidence your assessor will ask for

SSL Labs test results for all web-accessible services showing TLS 1.2+
Microsoft 365 transport rule configuration showing encrypted email enforcement
Purview Message Encryption configuration screenshot
VPN policy and employee acknowledgment for CUI work on public networks
CUI Handling Policy section specifying encrypted transmission requirements

Does AI prompt monitoring help with this control? Honestly, no.

MP.2.123 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Media Protection controls

MP.1.118

Protect system media containing CUI

MP.1.119

Limit access to CUI on system media

MP.1.120

Sanitize or destroy system media before disposal or reuse

MP.2.121

Mark media with necessary CUI markings and distribution limitations

MP.2.122

Control access to media containing CUI during transport

MP.2.124

Control use of removable media on system components

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment