CMMCpedia
Work with me

Requirements / System and Communications Protection (SC)

SC.L2-3.13.15

Communications Authenticity

Official Source Material

SPRS score value
5 points.
POA&M eligibility
Not eligible. It is worth more than 1 point.
Level 1
Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Protect the authenticity of communications sessions.

Determine if:

  1. [a] the authenticity of communications sessions is protected.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Session authenticity is confidence that each end is who it claims, for the whole session.

The threats are interception in the middle, session hijacking, and injected traffic. A current version of TLS, the standard encryption protocol for internet connections, with valid certificates provides the protection. The handshake authenticates the endpoint, and the session keys defend the exchange against takeover.

Enforce current TLS and keep certificates from expiring.

Configure servers, the VPN, and management interfaces to current TLS with weak protocol versions disabled, and renew certificates before expiry so the trust chain never lapses. This is largely the same configuration work as SC.L2-3.13.8, evidenced from the authenticity side.

Sweep for the sessions that are not browser traffic.

VPN tunnels, SFTP transfers, and application integrations each ride a protocol with its own authentication story. List the session types in your environment, and confirm each uses a protocol that authenticates the endpoints. Keep a policy naming the approved protocols, so a new one does not arrive unexamined.

Over-engineering

  • Mutual TLS deployed between internal services. Objective [a] is met by current TLS and certificates that do not expire on the paths you run.
  • A certificate authority of your own for a handful of services. Public certificates you renew on time protect the authenticity the objective names.