NIST SP 800-53 Rev 5
SC - System and Communications Protection

NIST SP 800-53 Rev 5 SC-8: Transmission confidentiality and integrity

Requires the confidentiality or integrity, as the organization determines, of transmitted information to be protected, so that data in transit cannot be read or altered by parties along the path.

What else in your programme already covers this

This control maps to 122 controls across 35 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 10 controls

  • 1.2.6 Security features for insecure services defined
  • 10.1.1 Requirement 10 policies and operational procedures documented and maintained
  • 12.3.3 Cryptographic cipher suites and protocols inventory
  • 2.2.7 Non-console administrative access encrypted
  • 3.4.2 Technical controls prevent unauthorized PAN copy
  • 4.2.1 Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks: • Only trusted keys and certificates are accepted. • Certificates used to safeguard PAN during transmission
  • 4.2.1.1 Inventory of trusted keys and certificates
  • 4.2.1.2 Wireless networks transmitting PAN use strong cryptography
  • 4.2.2 PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies
  • 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components

ISO 27701:2019 · 9 controls

  • 6.10 Communications security
  • 6.10.2 Information transfer
  • 6.3.2 Mobile devices and teleworking
  • 6.7 Cryptography
  • 6.7.1 Cryptographic controls
  • 7.4.9 PII transmission controls
  • 8.4.3 PII transmission controls
  • 8.5.1 Basis for PII transfer between jurisdictions
  • 8.5.7 Engagement of a subcontractor to process PII

CMMC 2.0 · 8 controls

HIPAA Security Rule · 7 controls

ISO 27001:2022 · 7 controls

  • 5.14 Information transfer
  • 7.12 Cabling security
  • 7.9 Security of assets off-premises
  • 8.12 Data leakage prevention
  • 8.20 Networks security
  • 8.21 Security of network services
  • 8.24 Use of cryptography

SOC 2 · 7 controls

  • SOC2-C1.1 Confidential information is identified and protected during receipt, processing, storage
  • SOC2-CC6.6 Measures against threats outside system boundaries are implemented
  • SOC2-CC6.7 Transmission of data is restricted to authorized users
  • SOC2-CC6.8 Controls to prevent or detect unauthorized or malicious software
  • SOC2-PI1.2 System inputs are complete, accurate, and processed in a timely manner
  • SOC2-PI1.3 System processing is complete, valid, accurate, timely, and authorized
  • SOC2-PI1.4 System outputs are complete, valid, accurate, timely, and distributed

ISO 27002:2022 · 6 controls

  • 5.14 Information transfer
  • 6.7 Remote working
  • 8.12 Data leakage prevention
  • 8.20 Networks security
  • 8.21 Security of network services
  • 8.24 Use of cryptography

CIS Controls v8 · 5 controls

  • CIS-12.3 Securely Manage Network Infrastructure
  • CIS-12.6 Use of Secure Network Management and Communication Protocols
  • CIS-3.10 Encrypt Sensitive Data in Transit
  • CIS-4.6 Securely Manage Enterprise Assets and Software
  • CIS-9.5 Implement DMARC

FedRAMP High · 4 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-18(1) Authentication and Encryption
  • SC-28(1) Cryptographic Protection
  • SC-7(4) External Telecommunications Services

FedRAMP Moderate · 4 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-18(1) Authentication and Encryption
  • SC-28(1) Cryptographic Protection
  • SC-7(4) External Telecommunications Services

NIST SP 800-187 · 4 controls

NIST SP 800-66 Rev 2 · 4 controls

  • ANSSI-HYG-18 Encrypt Sensitive Data Transmitted Over the Internet
  • ANSSI-HYG-21 Use Secure Protocols Wherever They Exist
  • ANSSI-HYG-32 Secure the Network Connection of Devices Used for Mobile Working
  • ASBv3-NS-9 Connect on-premises or cloud network privately
  • DP-3 Encrypt sensitive data in transit

C5 (Germany) · 2 controls

  • C5-COS-08 Policies for data transmission
  • C5-CRY-02 Encryption of data for transmission (transport encryption)

NIS2 Directive · 2 controls

  • Art.21.2.h Policies and procedures on the use of cryptography and, where appropriate, encryption
  • Art.21.2.j Multi-factor or continuous authentication, secured communications and secured emergency communications
  • NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified
  • NIST-CSF-PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-18(1) Authentication and Encryption
  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-18(1) Authentication and Encryption
  • ASD37-17 TLS encryption between email servers (Limited)
  • ADMF-5.2 Apply technical, procedural and physical safeguards
  • AUCDR-IS-2 Secure the network and systems within the data environment

ETSI EN 303 645 · 1 control

GDPR · 1 control

  • 161R1-SC-8 Transmission Confidentiality and Integrity

NIST SP 800-171 · 1 control

  • 03.13.08 Transmission Confidentiality and Integrity

NIST SP 800-172 · 1 control

  • 3.1.3e Employ Secure Information Transfer Solutions

NIST SP 800-183 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in SC - System and Communications Protection

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 SC-8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 300 NIST SP 800-53 Rev 5 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

Query this from an agent

The graph holds this control, the 122 it maps to, and the evidence behind each claim, over MCP and REST.