# Organizations Encrypt CUI Building Links

A discussion about carrying controlled unclassified information (CUI) over aerial fiber between buildings separated by a public right-of-way and utility-owned poles favors encryption over armored cable or conduit as the safeguard. It identifies switch-based MACsec and firewall-to-firewall IPsec as options, while describing a Protected Distribution System as a more involved alternative. For procurement teams specifying or assessing these links, the selected cryptographic implementation should be checked for applicable FIPS validation, including its CMVP certificate, and the design confirmed with the assessor.

- Include encryption options and applicable FIPS validation evidence in technical evaluations; the discussion identifies MACsec and IPsec as alternatives.
- Compare the implementation trade-offs: MACsec can operate at line rate, while IPsec tunnels between firewalls are another option; a Protected Distribution System is described as more involved.
- Confirm the proposed design with the assessor rather than relying on cable armor or conduit alone as the physical safeguard for links routed over utility-owned poles.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 04, 2026

### Vendors
- Meraki ()

### Key Quotes
> Armored cable or even metal conduit on utility poles won’t count as an alternative physical safeguard, since that would basically mean a protected distribution system, and that’s not realistic on poles you don’t control. MACsec on the switches at each end is usually the simplest fix because it runs at line rate and you don’t have to treat every building as a branch office, though IPsec tunnels between firewalls work too.
> — Community commenter

### Sources
- [Multiple Building Infrastructure](https://www.reddit.com/r/CMMC/comments/1xncnp8/multiple_building_infrastructure) - reddit-cmmc