Implement cryptographic mechanisms to protect message externals unless otherwise protected by organization-defined alternative physical controls.