NIST SP 800-66 Rev 2
Technical

NIST SP 800-66 Rev 2 164.312(e)(2)(ii): Encryption of Transmissions (Addressable)

Implement a mechanism to encrypt ePHI whenever deemed appropriate. NIST recommends defaulting to encryption for all ePHI transmissions, with documented exception only where infeasible.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 41 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 8 controls

  • 1.4.4 1.4.4 Cardholder data stores not reachable from untrusted networks
  • 10.1.1 10.1.1 Requirement 10 policies and procedures maintained and in use
  • 2.2.6 2.2.6 System security parameters configured against misuse
  • 2.2.7 2.2.7 Non-console administrative access encrypted
  • 2.3.2 2.3.2 Wireless encryption keys changed on triggers
  • 4.2.1 4.2.1 Strong cryptography safeguards PAN over public networks
  • 4.2.1.2 4.2.1.2 Wireless networks use strong cryptography
  • 4.2.2 4.2.2 PAN secured when sent by end-user messaging

FedRAMP High · 3 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • SC-13 Cryptographic Protection
  • SC-8(1) Cryptographic Protection

FedRAMP Moderate · 3 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • SC-13 Cryptographic Protection
  • SC-8(1) Cryptographic Protection

ISO 27701:2019 · 3 controls

  • 6.7.1 Cryptographic controls
  • 7.4.9 PII transmission controls
  • 8.4.3 PII transmission controls

NIST SP 800-171 Rev 3 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

SOC 2 · 3 controls

  • SOC2-C1.1 C1.1 Identifying and maintaining confidential information
  • SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary
  • SOC2-CC6.7 CC6.7 Restricting and protecting information in transmission, movement and removal

AWS Well-Architected Security Pillar · 2 controls

C5 (Germany) · 2 controls

  • C5-COS-08 Policies for data transmission
  • C5-CRY-02 Encryption of data for transmission (transport encryption)

CMMC 2.0 · 2 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-18 Encrypt Sensitive Data Transmitted Over the Internet

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-2 Secure the network and systems within the data environment

Azure Security Benchmark · 1 control

  • DP-3 Encrypt sensitive data in transit

CIS Controls v8 · 1 control

  • CIS-3.10 Encrypt Sensitive Data in Transit

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

ISO 27001:2022 · 1 control

  • 8.24 Use of cryptography

ISO 27002:2022 · 1 control

  • 8.24 Use of cryptography

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technical

Query this from an agent

The graph holds this control, the 41 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-66 Rev 2 controls