FIPS-Validated Encryption for CUI

Most organizations that handle Controlled Unclassified Information already encrypt laptops and use TLS for web traffic. Many are surprised during a CMMC assessment to learn that encryption alone does not satisfy the requirement. NIST SP 800-171 calls for FIPS-validated cryptography when encryption is used to protect the confidentiality of CUI, and the difference between "encrypted" and "encrypted with a validated module" is where findings often appear.

What "FIPS-validated" means

Federal Information Processing Standard 140 defines security requirements for cryptographic modules. The current version is FIPS 140-3. The Cryptographic Module Validation Program (CMVP), run by NIST together with the Canadian Centre for Cyber Security, tests modules through accredited laboratories and issues certificates for those that pass.

A module is FIPS-validated when it holds an active CMVP certificate. The certificate lists the specific module, version and tested operating environments, along with the approved algorithms and the conditions under which the module operates in an approved mode.

Validated versus "compliant"

Vendors sometimes describe products as "FIPS-compliant", "FIPS-ready" or "uses FIPS-approved algorithms". Those phrases are not the same as validation:

• Approved algorithms are not enough. A product can use AES without its cryptographic module having been tested and certified.
• Validation is version-specific. A certificate for one version of a library does not automatically cover a newer build.
• Configuration matters. Many products include a validated module but only use it when FIPS mode or an approved configuration is enabled.
• Certificates change status. Certificates can move to historical status, and older FIPS 140-2 validations are being phased out as the program transitions to FIPS 140-3. Check the current status in the CMVP database rather than relying on a datasheet.

When you document encryption for an assessment, record the product, the module name, the certificate number and how you confirmed the module is operating in its approved mode.

Data at rest

Full-disk encryption on laptops and workstations is the most visible control, but CUI lives in many other places:

• Servers and file shares, including virtual machine storage and database files.
• Mobile devices that sync email or documents containing CUI.
• Cloud storage, where you need to understand which modules the provider uses and whether they are validated for the service and region you use.
• Removable media, such as USB drives and external disks, which are easy to lose and often overlooked.
• Backups, whether on tape, disk appliances or cloud storage, including offline and offsite copies.

Data in transit

CUI moving across networks you do not fully control needs protection too. Review:

• Remote access VPNs and whether the VPN client and gateway are running in a validated mode.
• Web applications and portals that handle CUI, including the TLS configuration on load balancers and reverse proxies.
• Email, which typically requires an approach beyond opportunistic TLS when CUI is sent outside the organization.
• File transfer tools, scripts and integrations, which are often set up quickly and never reviewed.
• Links between sites and to cloud environments, such as site-to-site VPNs.

Common gaps

The issues that come up most often are rarely exotic. They include personal or unmanaged USB drives, backup software with encryption switched off or using a non-validated library, file transfer services chosen for convenience, network appliances running without FIPS mode enabled, and documentation that names an algorithm but not a certificate. Each is straightforward to fix once identified, which is why an inventory of where CUI is stored and how it moves is the best first step.

Plan for change

Cryptographic requirements keep evolving. Module certificates expire or become historical, products are updated, and NIST has published post-quantum cryptography standards that organizations will need to adopt over time. Keeping a cryptographic inventory, noting which module protects which data, makes each of these transitions far easier. Our overview of post-quantum readiness explains how that inventory supports longer-term planning.

Frequently asked questions

Does BitLocker or FileVault count? Both platforms have had cryptographic modules validated, but validation applies to specific versions and configurations. Confirm the certificate that covers your operating system builds.

Does a cloud provider's encryption satisfy the requirement? It can, if the provider uses validated modules for the service you use. Check the provider's documentation for the specific environment.

How CDT can help

CDT's CMMC specialists help organizations trace where CUI is stored and transmitted and confirm that the cryptography protecting it is validated and documented, and our control assessments test those controls before an assessor does.