One of the quietest ways a CMMC assessment goes sideways is encryption. A contractor says, correctly, that their laptops and traffic are encrypted — and still comes up short, because the requirement is not ‘encrypted.’ It is FIPS-validated cryptography.
What the requirement actually says
NIST SP 800-171 requirement 3.13.11 (SC.L2-3.13.11) calls for cryptography that is FIPS-validated when used to protect the confidentiality of CUI. FIPS 140 validation means the specific cryptographic module has been tested and certified through the NIST program — not merely that a product claims to use a strong algorithm.
Why 'encrypted' is not enough
Plenty of software encrypts data with strong algorithms but was never submitted for FIPS validation, or ships with a FIPS mode that is switched off by default. From the outside it looks encrypted; against 3.13.11 it does not count. Assessors ask for the module’s validation certificate, not a screenshot of a lock icon.
What to check
Inventory where CUI is encrypted — at rest on disks and in storage, and in transit — and for each, confirm the underlying module carries an active FIPS 140-2 or 140-3 validation and that FIPS mode is actually enabled. Operating systems and many tools support this; it often has to be turned on deliberately.
Getting this right early avoids a nasty surprise late. See how we make CUI protection assessment-ready.