Data At Rest
Protect the confidentiality of CUI at rest.
What gets scored, the objectives
SC.L2-3.13.16 is met only when every one of these 1 objectives, from NIST SP 800-171A, is satisfied. A single missed objective makes the whole requirement not met.
- a.the confidentiality of CUI at rest is protected
How this is assessed
NIST SP 800-171A defines three assessment methods. For SC.L2-3.13.16, whoever assesses it, including your own team in a self assessment, uses these:
System and communications protection policy; procedures addressing protection of information at rest; system security plan; system design documentation; list of information at rest requiring confidentiality protections; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; other relevant documents or records
System or network administrators; personnel with information security responsibilities; system developer
Mechanisms supporting or implementing confidentiality protections for information at rest
What it means, in context
Information at rest refers to the state of information when it is not in process or in transit and is located on storage devices as specific components of systems. The focus of protection at rest is not on the type of storage device or the frequency of access but rather the state of the information. Organizations can use different mechanisms to achieve confidentiality protections, including the use of cryptographic mechanisms and file share scanning . Organizations may also use other controls including secure off-line storage in lieu of online storage when adequate protection of information at rest cannot otherwise be achieved or continuous monitoring to identify malicious code at rest.
CUI at rest means information that is not moving through the network; typically this means data currently stored on hard drives, media, and mobil e devices. Implement the necessary security controls to protect the confident iality of CUI at rest. Although an approved encryption method protects data stored at rest, there are other technical and physical solutions. The methods chosen should depend on the environment and business needs. Implementing encryption for CUI is one approach to this requirement, but it is not mandatory. Physical security is often employed to restrict access to CUI, particularly when it resides on servers within a company ’s offices. Other approaches for protecting CUI include system-related protections such as configurations and rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content that eliminate attempts at exfiltr ation. You may also employ other security requirements including secure off-line storage. Because the use of cryptography in this requirement is to protect the confidentiality of CUI , the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. This requirement, SC.L2-3.13.16, specifies confidentially be provided for CUI at rest and complements MP.L2-3.8.9, which specifies confidentially of CUI at backup storage locations. This requirement, SC.L2-3.13.16, also leverages SC.L2-3.13.11, which specifies that the algorithms used must be FIPS-validated cryptography. Example 1 Your company has a policy stating CUI must be protected at rest and y ou work to enforce that policy. You research Full Disk Encryption (FDE) products that meet the FIPS encryption requirement. After testing, you deploy the encryption to all computers to protect CUI at rest [a]. Example 2 You have used encryption to protect the CUI on most of the computers at your company, but you have some devices that do not support encryption . You create a policy requiring these devices to be signed out when needed, stay in possession of the signer when checked out, and to be signed back in and locked up in a secured closet when the user is done with the device [a]. At the end of the day each Friday, you audit the sign-out sheet and make sure all devices are returned to the closet.
What passing evidence looks like
CUI at rest protected per storage location, named in one note: BitLocker or FileVault on devices, the platform's storage encryption for cloud data, and a physical or offline protection for anything that cannot be encrypted.
Common ways contractors fail SC.L2-3.13.16
- !Walk every place CUI RESTS from your Scope work: cloud store, laptops, the NAS, backups. Each needs its at rest protection named; the forgotten NAS is the usual gap.
The step by step walkthrough for Microsoft 365 GCC High, Google Workspace, and on premises setups, plus the exact evidence to capture, lives inside the CMMC Level 2 plan.
Prove SC.L2-3.13.16, and the other 109
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
SC.L2-3.13.16 questions, answered
How many points is CMMC requirement SC.L2-3.13.16 worth?+
SC.L2-3.13.16 is worth 1 point in the CMMC Level 2 score under 32 CFR 170.24. If it is not met, you lose 1 from your total of 110.
Can SC.L2-3.13.16 be placed on a POA&M?+
Yes. A gap on SC.L2-3.13.16 can be deferred to a Plan of Action and Milestones, provided your overall score is 88 or better and the item closes within 180 days.
What family does SC.L2-3.13.16 belong to?+
SC.L2-3.13.16 is in the System & Communications Protection (SC) family, one of the 14 families of NIST SP 800-171 that make up CMMC Level 2.
- NIST SP 800-171 Rev. 2 3.13.16