Protecting CUI on Rugged and Tactical Systems Outside the Data Center

Every CMMC control was written with a building in mind: a server room with a badge reader, a workstation on a desk, a network with a perimeter. A rugged server bolted into a vehicle rack, a transit case flown to a forward site, or a shipboard mission system has to satisfy the same 110 requirements with none of those assumptions — while carrying Controlled Unclassified Information (CUI): the drawings, specifications, technical data and mission information a contract obliges you to protect.

This page covers the requirements that behave differently once a system leaves the facility, and the hardware choices that make them tractable.

The physical perimeter is now the chassis

In a data center, Physical Protection (PE.L2-3.10.x) is handled by walls, doors and access logs. In the field, the equivalent controls are implemented in the enclosure and the storage media:

• Removable, lockable drive canisters let the CUI leave with the operator while the chassis stays in place or ships for service. The drive becomes the thing you protect, not the rack.
• Tamper-evident seals and chassis intrusion detection provide the field equivalent of an access log — evidence of whether the system was opened between inspections.
• Encryption at rest with a hardware root of trust (TPM-bound keys, self-encrypting drives) means physical loss of the system does not automatically mean loss of CUI, which is precisely the risk the Media Protection family (MP.L2-3.8.x) is written to address.

On NCS rugged servers all three are available as options: keyed, lockable removable drive bays; tamper-evident seals and chassis intrusion detection; and port blockers or BIOS-level disabling of unused USB and serial ports. Specify them in the order for any system that will be deployed or serviced outside a controlled facility.

Scoping tactical systems: Specialized Assets

The DoD’s Level 2 scoping guidance recognizes that some systems cannot reasonably be assessed like an office PC. Specialized Assets include government-furnished equipment, IoT and OT devices, restricted information systems and test equipment. They must be listed in the asset inventory and described in the System Security Plan, including how risk is managed, but they are not assessed against the other Level 2 requirements.

Whether a particular mission system qualifies is a judgement for your compliance team and assessor, and it depends heavily on whether the system handles CUI and how it is connected. The practical guidance is: decide the category deliberately, document it, and make sure the hardware configuration matches the story. A system described in the SSP as isolated should not turn out to have an enabled Wi-Fi adapter.

Media protection when there is no help desk

Requirement 3.8.3 (sanitize or destroy media before disposal or reuse) and 3.8.6 (encrypt CUI on media in transport) are straightforward in a facility. Deployed, they raise operational questions:

• What happens to the drive when the server fails in the field and has to be shipped back?
• How are drives transported between a forward site and the home facility?
• Who sanitizes drives at end of deployment, with what tooling, and who keeps the record?

Hardware choices answer most of these. Removable drives mean the chassis can be RMA’d without the data. Self-encrypting drives with FIPS 140-validated modules mean a drive in transit is cryptographically protected even before it is physically protected. A crypto-erase — destroying the encryption key rather than overwriting the drive — is recognized by NIST SP 800-88 as a purge method for self-encrypting drives, and it takes seconds rather than hours, which matters when the system is being pulled from a platform under time pressure. NCS rugged storage supports several zeroization methods: crypto-erase on self-encrypting drives, block erase compliant with NIST SP 800-88, and trigger-activated zeroization by hardware trigger, software or remote trigger, or removal trigger. The step-by-step procedures are not published; they are provided to customers directly.

FIPS-validated cryptography still applies

Nothing in the scoping guidance relaxes SC.L2-3.13.11 for deployed systems: if cryptography is used to protect CUI confidentiality, it must be FIPS-validated. The hardware consequence is the same as in the data center — drives, OS crypto modules and any radios or network devices carrying CUI need validated modules — but the supply side is harder, because rugged and embedded components are more likely to ship with unvalidated or “FIPS-inside” (never-certified) crypto. Specify the CMVP certificate number in the procurement.

Environmental resilience is a security control too

MIL-STD-810H (environmental), MIL-STD-461G (electromagnetic interference) and MIL-S-901D (shipboard shock) are usually discussed as reliability requirements. They are also, indirectly, availability and integrity controls: a system that survives shock, vibration and thermal extremes does not fail in ways that corrupt logs, force emergency swaps of un-sanitized drives, or push operators into workarounds that bypass the security baseline. NCS tests its rugged servers to these standards, including Grade A heavyweight barge shock, and the Rugged Mission Systems page has the details.

Building the system so the SSP writes itself

The systems that pass assessment cleanly are the ones where the security architecture was decided at design time and the hardware simply implements it. That is the argument for an integrator rather than a parts list: a rugged server delivered with the TPM enabled, unused interfaces disabled in firmware, removable encrypted storage, an as-built configuration record and a documented sanitization path is a CUI Asset that an assessor can walk through in an afternoon. The same server assembled from components and configured in the field is a semester of remediation.

NCS designs and integrates rugged servers and storage for exactly these environments, and holds its own CMMC Level 2 C3PAO certification. Talk to our engineering team about a configuration for your platform.

---

More in this series: What CMMC Level 2 requires of your hardware · What to require from your hardware supplier · NCS and CMMC Level 2