Remote Access Confidentiality

Name the mechanism for every remote path, then show it running.

Objective [a] is the specific cryptography protecting each type of remote access you permitted under AC.L2-3.1.12: TLS on the VPN, TLS to each cloud service, SSH for administrative sessions. Objective [b] is the configuration evidence. Map each permitted type to its mechanism so no path is left uncovered, and the two objectives fall out of one table.

Sessions that carry CUI need a FIPS-validated module, not just an approved algorithm.

CUI is the controlled unclassified information your contract requires you to protect. The assessment guide is explicit that an approved algorithm alone is not sufficient. The module implementing it must be validated under FIPS 140, the federal standard for cryptographic modules. The validation requirement itself is SC.L2-3.13.11 territory. What belongs here is the mapping: which validated module protects each remote path over which CUI travels.

One validated layer is enough when encryption stacks.

A FIPS-mode TLS session riding inside a VPN whose own encryption is not validated still protects the session, because one layer end to end is validated. Decide which layer is your validated layer for each CUI-bearing path and write it down, rather than trying to make every layer validated at once.

A FedRAMP-authorized service can be the validated layer.

FedRAMP is the federal cloud authorization program. When every CUI flow ends in GCC High, the government cloud version of Microsoft 365, or another service that provides FIPS-validated TLS, that service carries the cryptographic burden for those flows. Your VPN does not need to be FIPS for them. Confirm the coverage against your data flow work from AC.L2-3.1.3 before relying on it, because one overlooked CUI path to a file server changes the answer.

A policy forbidding remote CUI access does not remove this requirement.

The requirement protects remote access sessions, and sessions used for administration expose credentials and security-relevant configuration even when no CUI crosses them. Encrypt every remote session. Reserve the FIPS-validation question for the sessions that carry CUI.