SC-8 Transmission Confidentiality and Integrity

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	System	5 (1 in a baseline)

Related controls: AC-17, AC-18, AU-10, IA-3, IA-8, IA-9, MA-4, PE-4, SA-4, SA-8, SC-7, SC-16, SC-20, SC-23, SC-28

Control statement

Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.

NIST discussion

Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques.

Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.

Control enhancements

SC-8(1) Cryptographic Protection

Baselines: Moderate, High

Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.

Discussion and assessment objectives for SC-8(1)

Encryption protects information from unauthorized disclosure and modification during transmission. Cryptographic mechanisms that protect the confidentiality and integrity of information during transmission include TLS and IPSec. Cryptographic mechanisms used to protect information integrity include cryptographic hash functions that have applications in digital signatures, checksums, and message authentication codes.

Determine if cryptographic mechanisms are implemented to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.

Examine: System and communications protection policy; procedures addressing transmission confidentiality and integrity; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity; mechanisms supporting and/or implementing alternative physical safeguards; organizational processes for defining and implementing alternative physical safeguards.

SC-8(2) Pre- and Post-transmission Handling

Baselines: Not in a baseline

Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.

Discussion and assessment objectives for SC-8(2)

Information can be unintentionally or maliciously disclosed or modified during preparation for transmission or during reception, including during aggregation, at protocol transformation points, and during packing and unpacking. Such unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.

Determine if:

SC-08(02)[01] information [Selection (one or more): confidentiality; integrity] is/are maintained during preparation for transmission;
SC-08(02)[02] information [Selection (one or more): confidentiality; integrity] is/are maintained during reception.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Mechanisms supporting and/or implementing transmission confidentiality and/or integrity.

SC-8(3) Cryptographic Protection for Message Externals

Baselines: Not in a baseline

Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].

Discussion and assessment objectives for SC-8(3)

Cryptographic protection for message externals addresses protection from the unauthorized disclosure of information. Message externals include message headers and routing information. Cryptographic protection prevents the exploitation of message externals and applies to internal and external networks or links that may be visible to individuals who are not authorized users. Header and routing information is sometimes transmitted in clear text (i.e., unencrypted) because the information is not identified by organizations as having significant value or because encrypting the information can result in lower network performance or higher costs. Alternative physical controls include protected distribution systems.

Determine if cryptographic mechanisms are implemented to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity for message externals; mechanisms supporting and/or implementing alternative physical safeguards; organizational processes for defining and implementing alternative physical safeguards.

SC-8(4) Conceal or Randomize Communications

Baselines: Not in a baseline

Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].

Discussion and assessment objectives for SC-8(4)

Concealing or randomizing communication patterns addresses protection from unauthorized disclosure of information. Communication patterns include frequency, periods, predictability, and amount. Changes to communications patterns can reveal information with intelligence value, especially when combined with other available information related to the mission and business functions of the organization. Concealing or randomizing communications prevents the derivation of intelligence based on communications patterns and applies to both internal and external networks or links that may be visible to individuals who are not authorized users. Encrypting the links and transmitting in continuous, fixed, or random patterns prevents the derivation of intelligence from the system communications patterns. Alternative physical controls include protected distribution systems.

Determine if cryptographic mechanisms are implemented to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Cryptographic mechanisms supporting and/or implementing concealment or randomization of communication patterns; mechanisms supporting and/or implementing alternative physical safeguards; organizational processes for defining and implementing alternative physical safeguards.

SC-8(5) Protected Distribution System

Baselines: Not in a baseline

Implement [Assignment: organization-defined protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.

Discussion and assessment objectives for SC-8(5)

The purpose of a protected distribution system is to deter, detect, and/or make difficult physical access to the communication lines that carry national security information.

Determine if the [Assignment: organization-defined protected distribution system] is implemented to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Cryptographic mechanisms supporting and/or implementing concealment or randomization of communication patterns; mechanisms supporting and/or implementing protected distribution systems.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-8

Determine if the [Selection (one or more): confidentiality; integrity] of transmitted information is/are protected.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Mechanisms supporting and/or implementing transmission confidentiality and/or integrity.

Policy statement

The System owner shall ensure the system protects the Select one or more: confidentiality; integrity Typical: confidentiality and integrity of transmitted information. (SC-8)

Federal systems

CISA Binding Operational Directive 18-01, Enhance Email and Web Security (October 16, 2017), requires that “All publicly accessible Federal websites and web services provide service through a secure connection (HTTPS-only, with HSTS)”, that internet-facing mail servers offer STARTTLS, and that SSLv2, SSLv3, 3DES and RC4 are disabled on mail servers. CISA’s directive page does not mark it revoked (as of September 2026).

The System owner shall ensure each publicly accessible website and web service of the system provides service only through HTTPS, with HTTP Strict Transport Security. (SC-8)
The System owner shall ensure each internet-facing mail server of the system offers STARTTLS. (SC-8)
The System owner shall ensure SSLv2, SSLv3 and the 3DES and RC4 ciphers are disabled on the system’s mail servers. (SC-8)

SC-8(1) Cryptographic protection

The System owner shall implement cryptographic mechanisms to Select one or more: prevent unauthorized disclosure of information; detect changes to information Typical: prevent unauthorized disclosure of information and detect changes to information during transmission. (SC-8(1))

From the System and Communications Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SC-8 asks you to protect information while it moves, inside the system as well as across its boundary. At Moderate and High, SC-8(1) makes that protection cryptographic, so in practice this is a control about encrypting and integrity-protecting every connection, using the cryptography chosen under SC-13.

Common implementations. TLS 1.2 or later for web, API and database connections, following NIST SP 800-52 Rev. 2 (August 2019; NIST noted in May 2026 that it is under review), which also calls for TLS 1.3 support. SSH for administration, IPsec or TLS virtual private networks for site and remote connections, and encryption on internal service-to-service traffic, often through a service mesh with mutual TLS. Certificates issued and renewed automatically. Older protocols (SSL, TLS 1.0 and 1.1, unencrypted FTP, Telnet) disabled.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
What to protect (SC-8)	Confidentiality and integrity
What cryptography does (SC-8(1))	Prevent unauthorized disclosure of information and detect changes to information

Evidence assessors ask for.

The list of data flows and the protocol protecting each one
TLS configuration scans of external and internal endpoints (for example, allowed protocol versions and cipher suites)
Evidence that cleartext protocols are disabled
Certificate inventory and expiry monitoring

Inheritance. Cloud load balancers, the enterprise virtual private network and the certificate service are often common controls. The system owns encryption between its own components and its application settings.

Common findings.

Encryption at the edge only, with cleartext traffic behind the load balancer.
Old TLS versions or weak cipher suites still enabled for compatibility.
Certificates that are self-signed, expired or not validated by clients.
Database and message queue connections left unencrypted.

Enhancements in the Moderate baseline. SC-8(1) cryptographic protection, also in High.

Artifacts

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.