NIST 800-171 Controls · Access Control
AC.2.019 — Encrypt CUI on Mobile Devices
Encrypt CUI on mobile devices and mobile computing platforms.
What AC.2.019 means in plain English
If any government contract information (CUI) is stored on a laptop, tablet, or smartphone, that device's storage must be encrypted. Encryption scrambles the data on the device so that if the device is lost or stolen, the thief cannot read the files without the encryption key. BitLocker on Windows laptops and the built-in encryption on iPhones and modern Androids are common ways to meet this.
The assessment question
“Is the storage on all laptops and mobile devices that contain or access CUI encrypted — for example, is BitLocker enabled on company Windows laptops, and is encryption enabled on company iPhones or Android devices?”
How to implement AC.2.019
- Enable BitLocker on all Windows laptops and mobile workstations: go to Control Panel > System and Security > BitLocker Drive Encryption > Turn on BitLocker. Save the recovery key to your Microsoft account or print it and store it in a secure location (not on the encrypted drive itself).
- Verify BitLocker is enabled on each machine: open a command prompt and run "manage-bde -status" to see the protection status of each drive. Screenshot the output as evidence.
- For iPhones: encryption is enabled automatically when you set a device passcode. Go to Settings > [Your Name] > iPhone Backup to verify. For Android (version 6 and later): go to Settings > Security > Encryption and confirm it's enabled.
- For company-issued laptops running Windows 10/11 Home (which doesn't include BitLocker): upgrade to Windows 10/11 Pro (~$100 upgrade key) to get BitLocker, or use VeraCrypt (free, open-source) as an alternative.
- Maintain a log of which devices have encryption enabled: device name, user, OS, encryption method, and key backup location (not the key itself).
Evidence your assessor will ask for
- BitLocker status output from "manage-bde -status" or BitLocker management console for each laptop
- Intune device compliance report showing encryption status (if using Intune)
- iOS/Android encryption confirmation screenshots for mobile devices
- Written policy requiring encryption on all mobile devices and laptops that access CUI
- Encryption key management record (showing keys are backed up securely)
Does AI prompt monitoring help with this control? Honestly, no.
AC.2.019 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Access Control controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.