[Practice] Services or applications running on systems manipulating Category-I data should implement secure (that is, encrypted) communications as required by confidentiality and integrity needs. [Category I] Required [Category II & III] 
Recommended