u/Strong-Giraffe5930

I am looking for guidance on how people bring photography cameras into CMMC L2. I can't really find any information on it online.

The purpose of the camera is that it will take pictures that contains CUI.

I have a service that provides us an enclave so we try to steer users to use that. Of course there are fringe cases that would need an on-prem device and our service can provide us a device for that. We can't really handle an in-scope smartphone right now and our service doesn't provide that.

Would the camera be considered Enduring Exception? As far as I know, there isn't any camera that have FIPs validated encryptions.

Are these just 3 things we need to write down for the SSP?

1. Categorize it as specialized asset.
2. Justification for exception
3. Compensating Safeguards