FIPS-validated encryption: where small defense contractors slip

If your architecture, engineering or construction firm holds controlled unclassified information (CUI) on a defense project, turning on encryption does not satisfy NIST SP 800-171. The rule calls for FIPS-validated encryption: cryptography NIST has validated, running the way it was validated. That distinction costs points on your SPRS score, can hold up a CMMC certification, and is easy to get wrong on equipment that already says "encrypted" on the box.

What does NIST SP 800-171 require for encryption?

Requirement 3.13.11 says it in one line: "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI." It sits in NIST SP 800-171 Rev 2, the version DoD still assesses against, because the CMMC rule incorporates Rev 2 by reference in 32 CFR 170.2. Contractors with DFARS 252.204-7012 in their contracts have been required to implement SP 800-171 since the end of 2017.

Several other requirements decide where encryption has to be in place, and 3.13.11 then decides what kind:

• 3.1.13: cryptographic protection for remote access sessions.
• 3.1.19: encryption of CUI on mobile devices and mobile computing platforms.
• 3.8.6: cryptographic protection of CUI on digital media during transport, unless other physical safeguards protect it.
• 3.13.8: cryptographic protection of CUI during transmission, unless other physical safeguards protect it.
• 3.13.16: protection of the confidentiality of CUI at rest.

The working question for an AEC firm is whether every one of those paths uses a validated module. Laptops, phones, USB drives used for drawing transfers, VPN or remote access tools, file shares and email all count.

What makes encryption FIPS-validated?

Encryption is FIPS-validated when the cryptographic module doing the work holds a current certificate from the Cryptographic Module Validation Program (CMVP), run jointly by NIST and the Canadian Centre for Cyber Security, and is operated in the configuration that certificate covers. Using an approved algorithm such as AES is not enough on its own.

The CMVP's validated modules page is direct about this. A product "does not meet the FIPS 140-2 or FIPS 140-3 requirements by simply implementing an approved security function." Certificates are issued to specific modules at specific versions, and for software, to the operating environments that were tested. Vendor descriptions on the list "may not necessarily reflect the capabilities of the modules when operated in the FIPS-approved mode." The CMVP suggests asking the vendor for a signed letter stating the product is a validated module, and warns that if the details do not match the CMVP entry, "the vendor is not offering a validated solution."

Marketing phrases such as "FIPS compliant," "FIPS ready" or "uses FIPS-approved algorithms" describe something short of that. They may be true and still leave 3.13.11 unmet.

Is FIPS 140-2 still valid after September 2026?

Under NIST's guidance, only for systems already in place. On September 21, 2026, the CMVP moved the remaining FIPS 140-2 validations to its historical list, according to its FIPS 140-3 transition page. The CMVP's program page says FIPS 140-2 active modules could be used for new systems until that date, and that after it, agencies may keep using them for existing systems only. The validated modules page adds that historical modules should not go into new systems but "can be procured for legacy systems."

Those statements are written for federal agencies, and DoD has not published contractor-specific guidance on historical certificates that we could find. What a contractor can take from them: anything you buy or deploy for CUI from here on should be checked against an active certificate, which in practice means FIPS 140-3. Existing equipment on a FIPS 140-2 historical certificate is a documentation question to raise with your assessor before you decide whether to replace it. The DoD CMMC FAQs (C-Q12) describe replacing a FIPS 140-2 firewall with a FIPS 140-3 firewall as a routine change that does not count as significant.

Where do small defense contractors slip on FIPS-validated encryption?

Most gaps come from the space between "encryption is on" and "a validated module is doing the work." The ones the rules make easiest to miss:

• FIPS mode is never turned on. Many products include a validated module but only use it in an approved mode that has to be enabled. The certificate's security policy describes that mode.
• The version drifted. The certificate covers a specific module version. After an update, the version running may not be the one on the certificate.
• One path was missed. Laptops get disk encryption, but CUI also moves through phones, removable drives sent to subcontractors, remote access tools and file transfer services.
• A vendor's claim was accepted without the certificate number. If the system security plan says "FIPS-validated" with no certificate cited, an assessor has nothing to test.
• New purchases were checked against FIPS 140-2. Since September 21, 2026, a FIPS 140-2 certificate is historical. New systems should cite an active certificate.
• Encryption was treated as a scoping tool. See the next two questions.

How does a FIPS gap affect your SPRS score and CMMC status?

It costs three points instead of five, and it is one of the few gaps you can carry on a plan of action. Under the CMMC scoring rule in 32 CFR 170.24, 3.13.11 is one of only two requirements that earn partial credit. If encryption is employed but not FIPS-validated, three points come off the maximum score. If encryption is not employed, five points come off.

For Conditional status, 32 CFR 170.21 normally bars any requirement worth more than one point from a POA&M. It makes an exception for 3.13.11 when encryption is employed but not FIPS-validated. Every POA&M item must then be closed and confirmed by a closeout assessment within 180 days, or the Conditional status expires. Our piece on closing a CMMC POA&M in 180 days covers that clock. If no encryption is in place at all, the exception does not apply.

CMMC Phase 2 was suspended on July 13, 2026. The suspension did not change 3.13.11. The DFARS 7012 obligation and SPRS reporting continue, as covered in what still applies during the pause.

Does encrypting CUI take it out of CMMC scope?

No. In its CMMC FAQs, DoD says that "encrypted CUI data retains the control designation given to the plain text counterpart" (B-Q8). It also says encryption alone cannot create the logical separation that keeps a network out of the assessment scope (F-Q3), and that a cloud service without FedRAMP Moderate or an equivalent baseline cannot store encrypted CUI either (E-Q2).

Encryption protects CUI where it lives. It does not make an unapproved cloud service, a personal device or a flat office network acceptable places for that CUI to be. The same test applies to AI tools, as covered in how to keep CUI out of AI tools on defense projects.

What should you fix this quarter?

Start with an inventory of where CUI travels, then tie every path to a specific CMVP certificate you can show an assessor.

• List every path CUI takes: endpoints, mobile devices, removable media, remote access, file sharing, email and backups.
• For each path, record the product, the cryptographic module inside it, the module version running today and its CMVP certificate number and status.
• Confirm the approved or FIPS mode described in each certificate's security policy is enabled, and keep a screenshot or configuration export as evidence.
• Add a purchasing rule: new equipment or software that will touch CUI must cite an active CMVP certificate, in practice FIPS 140-3.
• Update your system security plan so 3.13.11 names the modules and certificates. Our guide to a system security plan an assessor can follow shows the level of detail that helps.
• If a gap remains, score it honestly in SPRS (minus three if encryption is in place but not validated) and put a dated fix on your plan of action. Our piece on which SPRS gaps to close first can help with priorities.

How can s90 help?

s90 manages IT for architecture, engineering and construction firms in Los Angeles and Orange County, including firms that carry DFARS 7012 on defense work. We inventory where CUI flows, check each module against the CMVP list, turn on and document approved modes, and keep the certificate evidence current in your system security plan. If you would like a second look at 3.13.11 before your next SPRS update, we are glad to help.