Encrypt CUI on mobile devices and mobile computing platforms.
Monarch ISC Guidance
This practice is a part of mobile device security, but more clearly applies to both mobile devices (phones) and laptops. Always encrypt data on mobile devices! It is important that only FIPS validated encryption modules are used for encryption.
In order to validate and measure the effectiveness of this control, you need verify that all mobile devices are encrypted as expected. There are hardware updates that occur that require BitLocker, or other encryption technologies, to be disabled, and they are not always turned back on after the updates. It's also good practice to validate your ability to verify encryption status in case the device is lost or stolen. If that happens, you should immediately generate a report showing the device status at its last known check-in date and save (or screenshot) that status as evidence.
DRAFT NIST SP 800-171 R2
Organizations can employ full -device encryption or container -based encryption to protect the confidentiality of CUI on mobile devices and computing platforms. Container-based encryption provides a more fine-grained approach to the encryption of data and information including encrypting selected data structures such as files, records, or fields. Protecting cryptographic keys is an essential element of any encryption solution.