CMMC Level 2 Control Guide
Who implements each CMMC Level 2 practice in a tiCrypt deployment, how tiCrypt meets it, and what the university still owns. NIST SP 800-171 Rev 3 guide
tiCrypt72Shared13University2585 of 110 practices met by tiCrypt alone or shared
One row per CMMC Level 2 practice, the 110 NIST SP 800-171 Rev 2 requirements a C3PAO assesses. Select a row to read it in full.
| Practice | Requirement | Responsibility | How tiCrypt addresses it | University action | Rev 3 requirement | Rev 2 → Rev 3 | SSP control card (800-53) | Learn more |
|---|---|---|---|---|---|---|---|---|
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). | tiCrypt | Every user authenticates with a unique RSA-2048 key pair plus password (signed challenge-response); there is no backdoor or shared access path. A user can open a resource only if its AES key has been re-encrypted to that user's public key. The tiCrypt Audit query "Access Attempts by Removed Users" lists each sign-in attempt made after an account was deleted, and whether the server granted or refused it. | Run the account lifecycle: approve new accounts, assign teams and permission profiles, and remove users who no longer need access. | Retained | ||||
Limit system access to the types of transactions and functions that authorized users are permitted to execute. | tiCrypt | Permission profiles limit which actions each user can perform, with per-user overrides by administrators. Access is enforced cryptographically, so the server cannot extend access on an owner's behalf. | Define permission profiles and assign them to users and teams. | Retained | ||||
Control the flow of CUI in accordance with approved authorizations. | tiCrypt | Within tiCrypt, CUI moves only through encrypted, audited channels (Vault transfers in encrypted chunks, managed tunnels). SFTP into the enclave is upload-only, and exports out of a project require explicit, logged authorization. In tiCrypt Audit, "File Sharing Log" lists each time a file was shared with a user or a group, with the project the file was created under, and "External SFTP Access Log" lists each check of a user's access to an external SFTP server. | Designate who may approve exports out of a project. Authorize where storage replication and backup jobs may copy tiCrypt's ciphertext, which is still CUI (CMMC FAQ, July 2026, question B-Q8). | Retained | ||||
Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | tiCrypt | Tiered administrative roles (sub-admin, admin, super admin, infrastructure root) separate duties, and every admin tier is cryptographically excluded from reading user data. | Decide which staff hold each admin tier and document the profile assignments. The tiCrypt Audit query "Privileged Accounts" lists each account whose role is above a regular user, with when the role was set and who set it. | Retained | ||||
Employ the principle of least privilege, including for specific security functions and privileged accounts. | tiCrypt | Profiles grant only the actions a user needs, and data access is limited to resources whose keys were shared with the user. | Define least-privilege profiles and review privilege assignments periodically, for example with the tiCrypt Audit query "Privileged Accounts", which lists each account whose role is above a regular user. | Retained | ||||
Use non-privileged accounts or roles when accessing nonsecurity functions. | tiCrypt | Administrative functions require explicit role elevation. Administrators use separate non-privileged identities for ordinary user work. | Ensure admins use their non-privileged account for day-to-day research work. | Retained | ||||
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | tiCrypt | Privileged functions are restricted to authorized admin tiers, and every privileged operation is recorded with the user's identity in the tamper-evident audit trail. The tiCrypt Audit query "Privileged Actions Audit" lists every administrative action in a period, with who performed it. | None, provided by tiCrypt | Retained | ||||
Limit unsuccessful logon attempts. | tiCrypt | Accounts lock after a configurable number of consecutive failed login attempts (default 5) and stay locked until an administrator releases them. The tiCrypt Audit queries "Failed Login Attempts" and "Failed Login Summary" list refused session requests, failed challenges and lockouts, by event and by user. | Set the lockout threshold (default 5). | Retained | ||||
Provide privacy and security notices consistent with applicable CUI rules. | tiCrypt | A configurable system-use banner with privacy and security notices is displayed before login. | Provide the banner text approved by your institution. | Retained | ||||
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. | tiCrypt | Idle sessions lock after a configurable interval (default 15 minutes), hide the display, and purge keys client-side; the user must re-authenticate. | Set the idle-lock interval (default 15 minutes). | Retained | ||||
Terminate (automatically) a user session after a defined condition. | tiCrypt | Command sessions end automatically after inactivity, graphical sessions lock and require re-authentication, and keys are purged on logout. | Set session-termination thresholds. | Retained | ||||
Monitor and control remote access sessions. | tiCrypt | All remote access goes through the Connect client and the authenticated proxy; there is no direct SSH, RDP, or console access to VMs. Every session is logged. | None, provided by tiCrypt | Retained | ||||
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | tiCrypt | Remote sessions are double-encrypted: TLS plus a per-session Diffie-Hellman layer between client and VM, using FIPS-validated AES-256, RSA-2048, and SHA-256. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Route remote access via managed access control points. | tiCrypt | The Connect client and backend proxy are the single managed entry point. Users reach the system only on port 443 and the proxy's VM tunnel ports (6000-6100 by default). Port 22 is for host administration, and the SFTP host adds port 2020 where SFTP inboxes are offered. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Authorize remote execution of privileged commands and remote access to security-relevant information. | tiCrypt | Remote privileged commands are limited to authorized admins, authenticated through the same proxy, and logged. The tiCrypt Audit query "Privileged Actions Audit" lists every administrative action, with who performed it. | Document which remote privileged commands are authorized. | Withdrawn: incorporated | ||||
Authorize wireless access prior to allowing such connections. | University | University control | Retained | |||||
Protect wireless access using authentication and encryption. | University | University control | Withdrawn: incorporated | |||||
Control connection of mobile devices. | University | University control | Retained | |||||
Encrypt CUI on mobile devices and mobile computing platforms. | University | University control | Withdrawn: incorporated | |||||
Verify and control/limit connections to and use of external systems. | tiCrypt | External systems cannot connect directly. VMs deny all outbound traffic by default, and any external endpoint (e.g., a license server) requires an explicit allowlist rule approved by a SuperAdmin. Vault files can be pushed only to external SFTP servers an administrator has approved, by the users and teams on each server's allowlist, and the tiCrypt Audit query "External SFTP Access Log" records each access check and whether it was allowed. | Define the policy for permitted external connections and exports. | Retained | ||||
Limit use of portable storage devices on external systems. | University | University control | Withdrawn: incorporated | |||||
Control CUI posted or processed on publicly accessible systems. | Shared | The platform exposes no publicly accessible content. | Designate who may post information publicly and review public postings to confirm no CUI is released. | Retained | ||||
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. | University | University control | Retained | |||||
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. | University | University control | Retained | |||||
Provide security awareness training on recognizing and reporting potential indicators of insider threat. | University | University control | Withdrawn: incorporated | |||||
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. | tiCrypt | Audit logging is always on and cannot be disabled or bypassed. 200+ event types are recorded (authentication, files, sharing, VMs, keys, admin actions), and records are kept for the life of the deployment by default on your own audit server. | Confirm the retention period meets your records policy (default: retained indefinitely) and back up the audit server. | Retained: split | ||||
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. | tiCrypt | Every action is tied to an authenticated user, session, and source IP, with millisecond UTC timestamps and a hash-chain position. | None, provided by tiCrypt | Retained | ||||
Review and update logged events. | Shared | tiCrypt supplies the audit data, query tools, and real-time alerting; the logged event set is defined by the product. | Set a review cadence, assign reviewers, investigate alerts, and periodically confirm the logged events still meet your needs. | Merged | ||||
Alert in the event of an audit logging process failure. | tiCrypt | The logging path is fail-closed: capacity alerts fire and key issuance halts at 90% log-storage use. Real-time alerts at five severity levels flag failures such as hash-chain breaks. | Route alerts to the right staff (email, Splunk, or another SIEM). | Retained | ||||
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. | tiCrypt | The separate audit system (ClickHouse) correlates events across users, resources, event types, and time ranges, and can forward alerts to Splunk, email, or other SIEMs. | Use the audit tools in your review process; set review cadence and alert routing. | Retained | ||||
Provide audit record reduction and report generation to support on-demand analysis and reporting. | tiCrypt | A query builder, predefined compliance reports, direct SQL access, and Excel export support reduction and reporting without altering original records. | None, provided by tiCrypt | Retained | ||||
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. | tiCrypt | All components record UTC timestamps with millisecond precision. | Synchronize host clocks to an authoritative NTP source. | Retained | ||||
Protect audit information and audit logging tools from unauthorized access, modification, and deletion. | tiCrypt | Audit records are SHA-512 hash-chained, so any change, insertion, or deletion is detectable. The backend pushes logs one way to a separate audit server with no return path. | None, provided by tiCrypt | Retained | ||||
Limit management of audit logging functionality to a subset of privileged users. | tiCrypt | Only a limited group of authorized infrastructure administrators can access audit logs, and records cannot be modified or deleted through the application. | Limit audit-server access to designated administrators. | Withdrawn: incorporated | ||||
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. | University | University control | Retained: split | |||||
Establish and enforce security configuration settings for information technology products employed in organizational systems. | tiCrypt | Core security settings are architectural rather than optional. Automated configuration management reconciles components against the baseline, and system settings have full change tracking. | Set organization-defined values and approve any deviations. | Retained | ||||
Track, review, approve or disapprove, and log changes to organizational systems. | tiCrypt | Settings history records the previous value, new value, timestamp, and administrator. Platform releases are staged before production. | Run your change-control process (review and approve changes). | Retained | ||||
Analyze the security impact of changes prior to implementation. | tiCrypt | Changes to profiles, quotas, and project access go through audited Management Console controls, and Tera Insights evaluates platform changes before release. | Perform and record security impact analyses for changes in your environment. | Retained | ||||
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. | tiCrypt | Configuration changes are restricted to designated admins and audited. Software and VM images are signed, and boot images reset on every boot to prevent tampering. | Designate who may make changes and run change approval. The tiCrypt Audit query "Privileged Accounts" lists who holds an administrative role. | Retained | ||||
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. | tiCrypt | Services are deny-by-default. Inbound traffic is limited to port 443, the proxy's VM tunnel ports (6000-6100 by default), port 22 for host administration, and port 2020 on the SFTP host where SFTP inboxes are offered. VMs boot from immutable images containing only pre-approved software, with no persistent state. | None, provided by tiCrypt | Retained | ||||
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. | tiCrypt | Images include only the OS and VM installer; extra software must be added by admins in a new image. Software can be blocked per project, and stack execution is disallowed. | Define any per-project software blocklists. | Withdrawn: incorporated | ||||
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. | tiCrypt | Per-project allowlists and blocklists are supported. The VM Controller governs execution, and users cannot modify boot images. | Define per-project allow/deny lists. | Retained | ||||
Control and monitor user-installed software. | tiCrypt | Users can install software only where no admin privilege is needed, and those installs are discarded at shutdown; only admin-approved base-image software persists. | Approve software added to base images. | Withdrawn: incorporated | ||||
Identify system users, processes acting on behalf of users, and devices. | tiCrypt | Each user has a unique RSA-2048 identity; processes and VMs are identified by UUIDs and digital signatures. | None, provided by tiCrypt | Retained | ||||
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. | tiCrypt | Users authenticate by signing a server challenge with their private key, no password is sent. Endpoints and VMs are authenticated by key material before any connection is established. | None, provided by tiCrypt | Retained: split | ||||
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. | tiCrypt | Tera Insights requires MFA for every production deployment. It runs through a provider such as Duo or Shibboleth and is layered on top of the private-key signature. The MFA assertion is signed and verified independently, and its identity must match the key holder or the session is denied. The tiCrypt Audit query "MFA Coverage by User" counts, for each user, the sign-ins completed with a multifactor token and those completed without one. | Choose and configure the MFA provider (for example Duo or Shibboleth) and keep MFA enabled. Provide MFA for host-level admin access outside tiCrypt. | Retained | ||||
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. | tiCrypt | Each login challenge uses a random single-use nonce, so a captured response cannot be replayed. | None, provided by tiCrypt | Retained | ||||
Prevent reuse of identifiers for a defined period. | tiCrypt | User identifiers and UUIDs are unique and never reused, even after deletion. | Document the period during which identifiers may not be reused. tiCrypt never reuses an identifier, so any defined period is met. | Retained | ||||
Disable identifiers after a defined period of inactivity. | tiCrypt | The account locker deactivates accounts with no sign-in for a configurable period (90 days by default). Super-admin accounts are exempt. | Set the account-inactivity period, and review Super-admin accounts, which the account locker does not deactivate. | Withdrawn: aligned with 800-53 | ||||
Enforce a minimum password complexity and change of characters when new passwords are created. | tiCrypt | Configurable password-strength rules apply at registration and on change, and passwords are screened against weak or compromised lists. The password only protects the user's local private key. | Define password composition rules. | Retained | ||||
Prohibit password reuse for a specified number of generations. | Shared | The password protects the private key on the user's device and is never sent to the server, so tiCrypt cannot compare a new password with earlier ones. Tera Insights requires MFA and split credentials for every production deployment. With them enabled, a password change regenerates the server-held salt and IV, so an earlier key file and the password that went with it stop working. | Set the rule against reusing earlier passwords in your password policy and enforce it. | Withdrawn: aligned with 800-53 | ||||
Allow temporary password use for system logons with an immediate change to a permanent password. | tiCrypt | One-time registration requires the user to create a password and generate their key file immediately. | Activate each new account through the account activation workflow after verifying the person's identity. tiCrypt issues no temporary passwords. | Withdrawn: aligned with 800-53 | ||||
Store and transmit only cryptographically-protected passwords. | tiCrypt | Passwords are never sent to or stored on the server. The private key is AES-256 encrypted client-side. Tera Insights requires MFA and split credentials for every production deployment. With them enabled, the server holds the key's salt and IV and returns them only after MFA succeeds, so neither side can recover the key alone. | Keep MFA and split credentials enabled, and choose the MFA provider. | Withdrawn: incorporated | ||||
Obscure feedback of authentication information. | tiCrypt | Password entry is obscured, and login errors are generic, they do not reveal whether a username exists or which credential failed. | None, provided by tiCrypt | Retained | ||||
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. | University | University control | Retained | |||||
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. | Shared | Audit logs and real-time, severity-tiered alerts provide detection data and forensic evidence for investigations. | Track, document, and report incidents to designated officials and authorities, including DoD's 72-hour reporting window. | Retained | ||||
Test the organizational incident response capability. | University | University control | Retained | |||||
Perform maintenance on organizational systems. | University | University control | Withdrawn: not CUI-specific | |||||
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. | tiCrypt | Platform maintenance runs through the management interface and SSH sessions, and all of it runs over authenticated, encrypted, audited channels. The tiCrypt Audit query "Privileged Actions Audit" lists administrative actions, service restarts included, with who performed each. | Approve and inspect any maintenance tools used on host infrastructure. | Withdrawn: incorporated | ||||
Ensure equipment removed for off-site maintenance is sanitized of any CUI. | University | University control | Withdrawn: incorporated | |||||
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. | University | University control | Retained | |||||
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. | tiCrypt | Remote maintenance uses the same RSA challenge-response authentication plus MFA, which Tera Insights requires for every production deployment. Sessions are encrypted and closed when finished. | Pre-approve and supervise vendor remote access, and provide MFA for host-level remote access outside tiCrypt. | Retained | ||||
Supervise the maintenance activities of maintenance personnel without required access authorization. | University | University control | Retained | |||||
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. | Shared | File and drive contents are AES-256 encrypted before they reach any media, and decryption keys are never stored on the infrastructure. The media hold that ciphertext plus the unencrypted metadata database (file and directory names). | Physically control and securely store the media (disks, backups) that hold the ciphertext. | Retained | ||||
Limit access to CUI on system media to authorized users. | Shared | Reading CUI requires tiCrypt authentication and the owner's key, regardless of who can touch the media. | Control physical access to the media. | Retained | ||||
Sanitize or destroy system media containing CUI before disposal or release for reuse. | Shared | Cryptographic erasure: destroying a resource's per-file or per-drive key makes the remaining ciphertext unrecoverable. The tiCrypt Audit query "File Deletions by User" counts, for each user, the files deleted directly, emptied from the trash or collected by the system, and the files whose keys and chunks the garbage collector purged. | Sanitize physical media and the unencrypted metadata database per NIST SP 800-88 before disposal or reuse, and make sure escrowed and backup key copies are destroyed. | Retained | ||||
Mark media with necessary CUI markings and distribution limitations. | Shared | tiCrypt's interfaces support configurable CUI markings and labels. | Apply physical markings, distribution limits, and handling caveats to media. | Retained | ||||
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. | Shared | All transfers are logged, and data in transit is encrypted end to end. | Keep custody, accountability, and handling records for physical media transported outside controlled areas. | Retained | ||||
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. | tiCrypt | Data is ciphertext from the moment it is created (AES-256), so media, replicas, and backups are protected in transport without the owner's key; network transport adds TLS plus Diffie-Hellman. | Keep encrypted media, replicas, and backups under your media-handling procedures in transport, and send them only to systems inside your assessment scope. Encrypted CUI is still CUI (CMMC FAQ, July 2026, question B-Q8). | Withdrawn: incorporated | ||||
Control the use of removable media on system components. | tiCrypt | VMs have no USB passthrough by default. Removable-media access is limited to privileged users and requires admin hardware configuration and approval. | Set the removable-media approval policy. | Retained | ||||
Prohibit the use of portable storage devices when such devices have no identifiable owner. | tiCrypt | Every drive, file, and VM in tiCrypt has an explicit owner, and ownership transfers require an authenticated action. | Enforce the owner rule for portable devices outside the platform. | Withdrawn: incorporated | ||||
Protect the confidentiality of backup CUI at storage locations. | tiCrypt | Backups of file and drive contents contain only ciphertext because no decryption keys are stored on the infrastructure. A backup of the platform database also holds unencrypted file and directory names. | Keep backup and replica targets inside your assessment scope: encrypted CUI is still CUI (CMMC FAQ, July 2026, question B-Q8). A cloud target must meet FedRAMP Moderate or its equivalent (CMMC FAQ, July 2026, question E-Q2). | Retained | ||||
Screen individuals prior to authorizing access to organizational systems containing CUI. | University | University control | Retained | |||||
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. | University | University control | Retained | |||||
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. | University | University control | Retained: split | |||||
Protect and monitor the physical facility and support infrastructure for organizational systems. | University | University control | Retained | |||||
Escort visitors and monitor visitor activity. | University | University control | Withdrawn: incorporated | |||||
Maintain audit logs of physical access. | University | University control | Withdrawn: incorporated | |||||
Control and manage physical access devices. | University | University control | Withdrawn: incorporated | |||||
Enforce safeguarding measures for CUI at alternate work sites. | University | University control | Retained | |||||
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. | University | University control | Retained | |||||
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. | Shared | Tera Insights scans tiCrypt's own components, issues advisories, and coordinates authenticated access for your scans. | Scan host operating systems, network infrastructure, and non-tiCrypt software in the CUI boundary, and remediate findings. | Retained | ||||
Remediate vulnerabilities in accordance with risk assessments. | tiCrypt | Tera Insights identifies, patches, and releases fixes for platform components on a regular cadence, with critical fixes released out of band. | Schedule and apply platform updates; remediate host-level findings. | Withdrawn: incorporated | ||||
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. | Shared | Tera Insights supplies SSP templates, assessment evidence packages, and direct support during C3PAO assessments. | Coordinate the C3PAO engagement, provide evidence for university controls, and make sure the assessment covers the full CUI boundary. | Retained | ||||
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | Shared | Tera Insights helps draft POA&M items for platform controls, provides templated workflows, and handles platform-side remediation. | Own and track the POA&M and report milestones to the C3PAO. | Retained | ||||
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. | tiCrypt | The audit system continuously records user actions and security events and raises real-time alerts, providing telemetry for ongoing monitoring. | Run your continuous-monitoring program using tiCrypt telemetry, including server health (CPU, memory, disk), which tiCrypt does not monitor. | Retained | ||||
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. | University | University control | Withdrawn: incorporated | |||||
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. | tiCrypt | The backend is the single enforcement point. Inbound traffic is denied by default except port 443, the proxy's VM tunnel ports (6000-6100 by default), port 22 for host administration, and port 2020 on the SFTP host where SFTP inboxes are offered. VMs run on isolated networks with deny-all outbound. | Operate the external firewall and the VLAN and switch configuration around the tiCrypt hosts and the storage that holds its ciphertext. Encryption alone does not create logical separation (CMMC FAQ, July 2026, question F-Q3). | Retained | ||||
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. | tiCrypt | Zero-knowledge design: client-side encryption, user-held keys, microservice isolation, and least privilege mean the server operates on data it cannot read. | None, provided by tiCrypt | Withdrawn: not CUI-specific | ||||
Separate user functionality from system management functionality. | tiCrypt | User work runs in Secure VMs, separate from the security layer and management services; administrators never see plaintext user data. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Prevent unauthorized and unintended information transfer via shared system resources. | tiCrypt | VMs reset to immutable images on every boot, and each service has its own database. SFTP into VMs is write-only, and transfers go through the audited Vault. | None, provided by tiCrypt | Retained | ||||
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | tiCrypt | The public-facing frontend is separated from CUI processing in isolated VM networks, and ingress services sit in a DMZ-like zone with only a one-way path to the backend. | Provision the VLANs and firewall rules that separate the public-facing services from the internal tiCrypt networks. | Withdrawn: incorporated | ||||
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). | tiCrypt | Inbound and outbound traffic is denied by default. Every outbound exception requires a firewall/allowlist rule created with SuperAdmin privilege. | Approve any outbound exceptions (e.g., license servers). | Retained | ||||
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). | Shared | Remote devices get only authenticated, per-port application tunnels through the proxy, not a network-level connection. There is no direct external network path to VMs. | Enforce on your endpoints whether a device connected to tiCrypt may hold other network connections. That is an endpoint setting, not a tiCrypt setting. | Withdrawn: incorporated | ||||
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. | tiCrypt | Data in transit is double-encrypted (TLS 1.2+ plus Diffie-Hellman session keys) with FIPS-validated algorithms, and SHA-256 verifies integrity. | None, provided by tiCrypt | Retained | ||||
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. | tiCrypt | Tunnels close at session end and idle sessions disconnect; client keys are purged on termination. | Set the idle-disconnect interval. | Retained | ||||
Establish and manage cryptographic keys for cryptography employed in organizational systems. | tiCrypt | Keys are generated client-side: a random 256-bit key per file and drive, wrapped with the user's RSA-2048 public key, and an RSA-2048 key pair per user. No key is stored unwrapped on the server. Key recovery uses escrow split across independent escrow groups, three by default. | Define escrow groups (three by default) and their membership. | Retained | ||||
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | tiCrypt | Every cryptographic operation that protects CUI runs through the OpenSSL 3.1.2 FIPS provider (CMVP #4985, FIPS 140-3) in approved mode: the key operations on the user's client and everything the VM controller does. tiCrypt implements no cryptography of its own. The backend encrypts no CUI; it verifies signatures and computes hashes with the Java runtime's libraries. Drive encryption inside VMs is performed by LUKS or BitLocker on the operating system's own validated modules, with the operating system's FIPS mode enabled. | None, provided by tiCrypt | Retained | ||||
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. | tiCrypt | Not applicable by design: collaborative computing devices (cameras, microphones) are not supported in the environment, so remote activation cannot occur. | None, provided by tiCrypt | Retained | ||||
Control and monitor the use of mobile code. | tiCrypt | The frontend bundles all its dependencies and references no external code; it runs in the controlled Connect app, and software is signed. VMs have no browser-based code paths to external networks. | None, provided by tiCrypt | Retained | ||||
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. | tiCrypt | Not applicable by design: VoIP is not supported; all communication uses authenticated, encrypted channels. | None, provided by tiCrypt | Withdrawn: aligned with 800-53 | ||||
Protect the authenticity of communications sessions. | tiCrypt | Sessions are authenticated by RSA challenge-response over mutually authenticated channels (TLS plus Diffie-Hellman), preventing hijacking and replay. | None, provided by tiCrypt | Retained | ||||
Protect the confidentiality of CUI at rest. | tiCrypt | CUI is AES-256 encrypted at rest: Vault files in 8 MB chunks with per-file keys, and VM drives with LUKS or BitLocker. Metadata such as file names is not encrypted at rest. | Keep the storage that holds the ciphertext, and the unencrypted metadata database, inside your assessment scope: encrypted CUI is still CUI (CMMC FAQ, July 2026, question B-Q8). Do not put CUI in file or directory names. | Withdrawn: incorporated | ||||
Identify, report, and correct system flaws in a timely manner. | tiCrypt | Tera Insights maintains the software lifecycle, identifies flaws, and releases signed updates; VM images are rebuilt with current patches. | Apply updates on your schedule. | Retained | ||||
Provide protection from malicious code at designated locations within organizational systems. | tiCrypt | Malicious-code protection is configured in the VM image. On Linux images with ClamAV installed and clamAVEnabled = true, the VM Controller starts ClamAV at startup and runs a recursive clamscan of each drive when it is attached, writing any infected files to the controller log, which the VM's managers can read. On Windows images the anti-virus product in the image notifies the user. VM images reset at boot, which removes persistent malware, and outbound traffic is denied by default. | Build an anti-virus product into your VM images and enable it (for example ClamAV on Linux, Microsoft Defender on Windows). Keep its signatures current and schedule periodic scans. | Retained | ||||
Monitor system security alerts and advisories and take action in response. | tiCrypt | Real-time alerts at five severity levels cover authentication failures, access attempts, and anomalies, and Tera Insights relays relevant security advisories. | Act on advisories and alerts. | Retained | ||||
Update malicious code protection mechanisms when new releases are available. | tiCrypt | The anti-virus product and its signatures are part of the VM image. The controller server delivers the latest VM images and VM Controller at every boot, with current patches, so an updated image reaches each VM at its next start. | Keep the anti-virus product in your VM images and its signatures current. | Withdrawn: incorporated | ||||
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. | tiCrypt | On Linux images with ClamAV enabled, the VM Controller scans each drive when it is attached and starts ClamAV's on-access client, whose coverage is set by the ClamAV configuration in the image. Boot resets restore a known-good state each session, and chunk-level encryption blocks file injection. | Configure on-access scanning in the anti-virus product in your images and schedule periodic scans. | Withdrawn: incorporated | ||||
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. | tiCrypt | All VM traffic passes through the logged backend proxy; unauthorized attempts are blocked and recorded. The audit system provides alerting (e.g., impossible-travel logins, lockouts) and forensic queries. | Run the monitoring program and route tiCrypt Audit alerts to your SOC or SIEM. Deploy your own monitoring tools on the host servers and inside VM images for the host, network and operating-system events tiCrypt does not see. | Retained | ||||
Identify unauthorized use of organizational systems. | tiCrypt | The audit system detects and alerts on unauthorized access, failed authentication, and privilege escalation. The tiCrypt Audit queries "Failed Login Attempts" and "Access Attempts by Removed Users" list failed sign-ins and sign-in attempts on deleted accounts. | Investigate alerts as part of your monitoring program. | Withdrawn: incorporated | ||||
This guide summarizes Tera Insights' published shared-responsibility model for tiCrypt. Each institution's System Security Plan defines its own boundary and implementation, and the final determination of compliance rests with the institution and its C3PAO. Release baseline (ticrypt.com/releases, November 13, 2026): Frontend 2.19.0 · Backend 3.16.3 · Host Controller 1.3.2 · Audit 1.11.0 · SFTP 1.5.1