Question

A US federal contractor must connect its on-premises data center to workloads in AWS and Azure. The security team requires alignment with NIST SP 800-53 controls, specifically continuous data-in-transit protection (SC-8/SC-13) across all cloud links, even over dedicated private circuits. The network team notes that both AWS Direct Connect and Azure ExpressRoute are being deployed via a colocation provider. Which connectivity design recommendation best satisfies the NIST data-in-transit requirement?

Accepted Answer

Deploy IPsec VPN tunnels (or MACsec where supported) over the Direct Connect and ExpressRoute circuits to provide cryptographic protection of data in transit

Answer

Rely on the physical isolation of Direct Connect and ExpressRoute private circuits, since dedicated Layer 2/3 paths inherently satisfy SC-8 encryption controls

Answer

Use the internet as a backup path only and enable TLS on application endpoints, leaving the private circuits unencrypted for performance

Answer

Terminate all traffic through a cloud provider NAT gateway, which encrypts egress traffic to meet NIST requirements