SC.2.008 — Encrypt CUI in Transit

What SC.2.008 means in plain English

Anytime CUI moves over a network — whether over the internet or even within your office — it must be encrypted. This means using HTTPS (not HTTP) for web applications, encrypted email (TLS), VPN for remote access, and encrypted file transfers (SFTP, not FTP). If you send CUI in an email, either your email system must enforce TLS encryption or you should use an encrypted email service. Think of encryption as a locked envelope — anyone who intercepts it cannot read the contents.

The assessment question

“Is all CUI encrypted during transmission using approved cryptographic methods such as TLS 1.2+, VPN, or encrypted email, including both external communications and internal network transfers?”

How to implement SC.2.008

1. Enable TLS 1.2 or higher on all web services and disable older protocols (TLS 1.0, 1.1, SSL). In IIS, use IIS Crypto (free tool) to configure this in one click.
2. Configure Microsoft 365 to enforce TLS for all email in transit: Exchange Admin Center > Mail Flow > Connectors, verify opportunistic TLS is enabled (it is by default in M365 GCC).
3. For file transfers, switch from FTP to SFTP or use OneDrive/SharePoint with HTTPS — never transfer CUI over unencrypted protocols.
4. Ensure your VPN uses strong encryption: AES-256 for WireGuard or OpenVPN. Verify this in your VPN server configuration.
5. Test your encryption: use Qualys SSL Labs (free) to test your web server and email TLS configuration at ssllabs.com.

Evidence your assessor will ask for

• TLS configuration showing TLS 1.2 or higher is enforced on web and email services
• VPN configuration showing strong encryption (AES-256 or equivalent)
• Qualys SSL Labs test results showing good TLS configuration grades
• Email transport rules or connector settings showing TLS enforcement
• Written policy requiring encryption of CUI in transit

More System and Communications Protection controls