CMMC Practice AC.3.022
Encrypt CUI on mobile devices and mobile computing platforms.
Bold Coast Security Guidance
This practice is a part of mobile device security, but more clearly applies to both mobile devices (phones) AND laptops. Always encrypt data on mobile devices!
In order to validate and measure the effectiveness of this control, you need verify that all mobile devices are encrypted as expected. There are hardware updates that occur that require Bitlocker, or other encryption technologies, to be disabled, and they are not always turned back off after the updates. Its also good practice to validate your ability to verify encryption status in case the device is lost or stolen. If that happens, you should immediately generate a report showing the device status at its last known check-in date, and save (or screenshot) that status as evidence.
DRAFT NIST SP 800-171 R2
Organizations can employ full -device encryption or container -based encryption to protect the confidentiality of CUI on mobile devices and computing platforms. Container-based encryption provides a more fine-grained approach to the encryption of data and information including encrypting selected data structures such as files, records, or fields. Protecting cryptographic keys is an essential element of any encryption solution.