Control statement
Protect the [Organization-defined: sc-08_odp] of transmitted information.
Discussion
Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques. Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Transmission Confidentiality and Integrity as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to secure architecture, boundary protection, communications protection, cryptography, and system isolation.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- network and trust-boundary diagrams
- firewall and gateway configurations
- cryptographic configuration and key records
- segmentation and isolation test results
Common failure patterns
- diagrams omit cloud and third-party paths
- encryption enabled without key governance
- flat trust zones allow unnecessary lateral movement
- boundary rules accumulate without owner review
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
the [Organization-defined: sc-08_odp] of transmitted information is/are protected.
Examine
- System and communications protection policy
- procedures addressing transmission confidentiality and integrity
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Mechanisms supporting and/or implementing transmission confidentiality and/or integrity
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
SC-8(1) — Cryptographic Protection
Implement cryptographic mechanisms to [Organization-defined: sc-08.01_odp] during transmission.
Official discussion
Encryption protects information from unauthorized disclosure and modification during transmission. Cryptographic mechanisms that protect the confidentiality and integrity of information during transmission include TLS and IPSec. Cryptographic mechanisms used to protect information integrity include cryptographic hash functions that have applications in digital signatures, checksums, and message authentication codes.
Organization-defined parameters (1)
Assessment objectives and methods
cryptographic mechanisms are implemented to [Organization-defined: sc-08.01_odp] during transmission.
Examine
- System and communications protection policy
- procedures addressing transmission confidentiality and integrity
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity
- mechanisms supporting and/or implementing alternative physical safeguards
- organizational processes for defining and implementing alternative physical safeguards
Related controls
SC-8(2) — Pre- and Post-transmission Handling
Maintain the [Organization-defined: sc-08.02_odp] of information during preparation for transmission and during reception.
Official discussion
Information can be unintentionally or maliciously disclosed or modified during preparation for transmission or during reception, including during aggregation, at protocol transformation points, and during packing and unpacking. Such unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.
Organization-defined parameters (1)
Assessment objectives and methods
- SC-08(02)[01]information [Organization-defined: sc-08.02_odp] is/are maintained during preparation for transmission;
- SC-08(02)[02]information [Organization-defined: sc-08.02_odp] is/are maintained during reception.
Examine
- System and communications protection policy
- procedures addressing transmission confidentiality and integrity
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Mechanisms supporting and/or implementing transmission confidentiality and/or integrity
SC-8(3) — Cryptographic Protection for Message Externals
Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Organization-defined: alternative physical controls].
Official discussion
Cryptographic protection for message externals addresses protection from the unauthorized disclosure of information. Message externals include message headers and routing information. Cryptographic protection prevents the exploitation of message externals and applies to internal and external networks or links that may be visible to individuals who are not authorized users. Header and routing information is sometimes transmitted in clear text (i.e., unencrypted) because the information is not identified by organizations as having significant value or because encrypting the information can result in lower network performance or higher costs. Alternative physical controls include protected distribution systems.
Organization-defined parameters (1)
Assessment objectives and methods
cryptographic mechanisms are implemented to protect message externals unless otherwise protected by [Organization-defined: alternative physical controls].
Examine
- System and communications protection policy
- procedures addressing transmission confidentiality and integrity
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity for message externals
- mechanisms supporting and/or implementing alternative physical safeguards
- organizational processes for defining and implementing alternative physical safeguards
Related controls
SC-8(4) — Conceal or Randomize Communications
Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Organization-defined: alternative physical controls].
Official discussion
Concealing or randomizing communication patterns addresses protection from unauthorized disclosure of information. Communication patterns include frequency, periods, predictability, and amount. Changes to communications patterns can reveal information with intelligence value, especially when combined with other available information related to the mission and business functions of the organization. Concealing or randomizing communications prevents the derivation of intelligence based on communications patterns and applies to both internal and external networks or links that may be visible to individuals who are not authorized users. Encrypting the links and transmitting in continuous, fixed, or random patterns prevents the derivation of intelligence from the system communications patterns. Alternative physical controls include protected distribution systems.
Organization-defined parameters (1)
Assessment objectives and methods
cryptographic mechanisms are implemented to conceal or randomize communication patterns unless otherwise protected by [Organization-defined: alternative physical controls].
Examine
- System and communications protection policy
- procedures addressing transmission confidentiality and integrity
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Cryptographic mechanisms supporting and/or implementing concealment or randomization of communication patterns
- mechanisms supporting and/or implementing alternative physical safeguards
- organizational processes for defining and implementing alternative physical safeguards
Related controls
SC-8(5) — Protected Distribution System
Implement [Organization-defined: protected distribution system] to [Organization-defined: sc-08.05_odp.02] during transmission.
Official discussion
The purpose of a protected distribution system is to deter, detect, and/or make difficult physical access to the communication lines that carry national security information.
Organization-defined parameters (2)
Assessment objectives and methods
the [Organization-defined: protected distribution system] is implemented to [Organization-defined: sc-08.05_odp.02] during transmission.
Examine
- System and communications protection policy
- procedures addressing transmission confidentiality and integrity
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Cryptographic mechanisms supporting and/or implementing concealment or randomization of communication patterns
- mechanisms supporting and/or implementing protected distribution systems
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.