NIST 800-171 Controls · System and Communications Protection

SC.2.015 — Protect Authenticity of Communication Sessions

CMMC Level 2SPRS if unmet: -1MEDIUM priority~6h to implement

Protect the authenticity of communications sessions.

What SC.2.015 means in plain English

When your systems communicate — your browser to a website, your email client to the server, your VPN client to the VPN server — you need to be sure you are actually talking to the right system, not an impersonator. This is what TLS certificates and VPN authentication do. Make sure your web applications use valid TLS certificates (the padlock in the browser), your VPN verifies the server identity with certificates, and your email server authenticates before accepting connections. This prevents man-in-the-middle attacks.

The assessment question

“Do your systems verify the identity of communication endpoints using mechanisms like TLS certificates, VPN server authentication, and email server authentication to prevent man-in-the-middle attacks?”

How to implement SC.2.015

Ensure all internal and external web services use valid TLS certificates from a trusted certificate authority. Use Let's Encrypt (free) for external sites and verify certificates are not expired.
Configure your VPN to authenticate the server using a certificate, not just a pre-shared key. In OpenVPN, use certificate-based authentication for both server and client.
Enable SPF, DKIM, and DMARC for your email domain to prevent email spoofing: these DNS records verify that emails actually came from your mail servers.
Train employees to verify the padlock icon in browsers when accessing CUI systems and to report certificate warnings immediately.

Evidence your assessor will ask for

TLS certificate inventory showing valid, non-expired certificates on all services
VPN configuration showing certificate-based authentication
DNS records showing SPF, DKIM, and DMARC are configured for email authentication
Qualys SSL Labs test results for external-facing web services

Does AI prompt monitoring help with this control? Honestly, no.

SC.2.015 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →