Defines assets, threats, trust boundaries, required controls, secure defaults, and implementation guidance for encryption in transit. It fixes adoption boundaries and observable failure evidence while keeping environment-specific limits configurable.