Unencrypted sensitive app data can be intercepted in transit and extricated or modified. Thus, the SRG asserts that all data transmission must employ cryptographic mechanisms preventing the unauthorized disclosure of information. It is recognized that the OS would generally provide the encryption function; however, the SRG allows the app to provide this functionality in the event the OS cannot provide a VPN that complies with DoD requirements.