What is Encryption and how is Encryption used in the CMMC (Cybersecurity Maturity Model Certification)?

Encryption is the process of converting plaintext to ciphertext. It is a way of mixing data so that only people that know how to decrypt the data can understand the information.

Evidence suggests that encryption was first used in Egypt around 1900 BC in the main chamber of Khnumhotep II’s tomb. The form of encryption used in the tomb of Khnumhotep II is known as symbol replacement, many of the hieroglyphic symbols used were unusual symbols in place of ordinary ones.

Encryption was used by the Roman military to transmit secret information. One of the most popular encryption methods was known as the Caesar Cipher. In this method each letter in the plaintext is replaced by a letter some fixed number of positions away in the alphabet. For example, with a left shift of 3, D would be replaced by A.

Like ancient times, modern militaries use encryption to securely transmit messages to prevent the enemy from being able to intercept and read the messages. Even if the enemy were to intercept the messages, it would need to be decrypted in order to be legible.

Military grade encryption is simply marketing jargon, however common encryption standards used in the military are 128-bit, 256-bit, SHA-256, and SHA-512.

Decryption is the process in which encrypted text/ciphertext is converted into a plaintext/understandable format.

CMMC practices related to encryption appear in most of the CMMC security domains. All CMMC levels have encryption related requirements. Some CMMC related encryption requirements include encrypting communication sessions, encrypting storage devices containing FCI or CUI such as laptops, thumbdrives, and smartphones. To meet cybersecurity maturity model certification (CMMC) encryption requirements we recommend that the encryption algorithms you choose to use are all FIPS 140-2 validated. If you would like more information on CMMC encryption related requirements feel free to reach out to us at info@lakeridge.io.