CMMC Level 2 Controls

CMMC Encryption Requirements: Every Control, Its Point Value, and What “FIPS-Validated” Actually Means

By The Defense Compliance Report Editorial Team · Last reviewed: July 2026· Last verified: July 3, 2026

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency.

Which category fits — and which doesn’t

Encryption is where “which vendor do I call?” gets confusing, because the answer depends on what you’re actually trying to fix:

• You need to implement encryption: turn on FIPS mode, configure BitLocker/VPN/TLS, stand up an enclave → a readiness partner: an RPO/RP (Registered Provider Organization / Registered Practitioner), a CMMC-focused MSSP (Managed Security Service Provider), or a Microsoft Government cloud implementer.
• You need to document and prove it: SSP entries, CMVP certificate numbers, POA&M tracking → a GRC platform as a supporting layer — not as your whole solution.
• You need to shrink what's in scope: so fewer systems touch CUI → a CUI enclave / secure collaboration environment.
• You're assessment-ready and need the formal check: → a C3PAO (Certified Third-Party Assessment Organization). They assess; they don't implement the same environment they later grade.
• You're not sure which of these you are: → start with the tool below, not a sales demo.

The 60-second verdict

What are the CMMC encryption requirements, in plain English?

CMMC doesn’t say “encrypt your company.” It asks a narrower question: wherever CUI is, or wherever it travels, is its confidentiality protected — and if you’re using cryptography to do that, is the cryptography actually validated?

A quick note on how these control numbers work. A practice ID like SC.L2-3.13.11 breaks down as: the domain (SC = System and Communications Protection), the level (L2 = Level 2), and the underlying NIST SP 800-171 requirement number (3.13.11). Once you see the pattern, the whole list gets readable fast.

CMMC Level 2 pulls in all 110 security requirements from NIST SP 800-171 Rev. 2, organized into 14 control families. About ten of those touch cryptography. We mapped every one below — with the exact points at stake and whether you can defer them — because no single official page hands a contractor that in one place.

Which CMMC level actually has encryption requirements?

This matters more than it looks. We regularly see small suppliers over-scope themselves — buying Level 2 encryption tooling before confirming they even handle CUI. Per 32 CFR Part 170, Level 1’s baseline is FAR 52.204-21 (FCI only), Level 2’s baseline is identical to NIST SP 800-171 Rev. 2 (CUI), and Level 3 adds a subset of NIST SP 800-172 on top. Our full breakdown lives in the CMMC levels guide.

One correction worth making early: you’ll see some pages say Level 1 has “17 controls.” Under the current CMMC rule, Level 1 is 15 requirements— the “17” is a holdover from the retired CMMC 1.0 model. If a source is still using CMMC 1.0 numbers, treat everything else on that page with caution too.

One more thing you should not have to relearn later: CMMC Level 2 is still assessed against NIST SP 800-171 Revision 2, not Revision 3. The DoD’s own CMMC FAQ confirms it plans to incorporate Rev. 3 through future rulemaking and issued a class deviation to keep Rev. 2 as the standard you’re assessed againstuntil Rev. 3 is folded into the rule. You can start modernizing toward Rev. 3, but the bar you’re graded on today is Rev. 2.

The complete CMMC Level 2 cryptography footprint (with point values and POA&M rules)

Before the table, two definitions: SPRS (Supplier Performance Risk System) is the DoD system where your score and CMMC status are posted, and a POA&Mlets you defer certain eligible gaps and still earn a Conditional status — but only within strict limits. Under 32 CFR 170.24, every Level 2 requirement is worth 1, 3, or 5 points if not met (you start at 110 and subtract). Under 32 CFR 170.21, only 1-point requirements can go on a POA&M— with one narrow encryption exception. To earn even a Conditional CMMC status you must score at least 88 of 110, have your SSP in place, and close all POA&M items within 180 days.

Those ten controls carry up to 30 points combined (scored independently). A related control, SC.L2-3.13.15(protect the authenticity of communications sessions), is worth 5 more points if not met and is not POA&M-eligible — but its Rev. 2 text is about session authenticity, not encrypting CUI, so we list it separately. *Sources: control text from NIST SP 800-171 Rev. 2; point values from 32 CFR 170.24; POA&M eligibility from 32 CFR 170.21. The four 1-point crypto controls are POA&M-eligible because they’re worth 1 point and not on the excluded-requirements list in 32 CFR 170.21(a)(2)(iii); confirm that list before relying on it.

What “FIPS-validated” actually means (and why AES-256 isn’t enough)

Here’s the distinction in plain terms:

• FIPS-approved algorithm — a math standard (AES is defined in FIPS 197). Necessary, but not sufficient.
• FIPS-validated module — the actual implementation of that algorithm, tested by an accredited lab and listed by the CMVP with a certificate. This is what the rule requires.
• "FIPS compliant" / "FIPS capable" — marketing language. It often means "could be configured to use approved algorithms," which is not the same as validated. It is not evidence.

Why does NIST care so much about the module and not just the algorithm? Because NIST’s CMVP treats non-validated cryptography as providing no protection at all — in effect, the data is considered unprotected plaintext. That single sentence is why an assessor won’t accept “we use AES-256.” From the government’s point of view, un-validated AES is the same as no encryption.

Two concrete examples we see constantly:

How to verify a module — and what to record

Go to the NIST CMVP Validated Modules Search, find the module (not just the product), and match it to a certificate. If you can’t match your deployed module, version, operating environment, and configuration to a validation certificate, treat that as a remediation or evidence gap until your vendor, RP/RPO, or assessor resolves it. What to capture from CMVP for each encryption product that touches CUI:

• Certificate number
• Module name and vendor
• Version
• Operational environment
• Validation standard (FIPS 140-2 or 140-3)
• Status (Active / Historical / Revoked)
• Date you checked
• Where it's used in your environment

That eight-line record turns a vague “we’re FIPS” into the exact evidence an assessor asks for.

FIPS 140-2 vs FIPS 140-3 — and the September 21, 2026 sunset

NIST CMVP states that FIPS 140-2 validations move to the Historical list on September 21, 2026. Modules on the Historical list may continue to be used for existing systems; FIPS 140-2 active modules can be used for newsystems only through that date. They are not revoked — but that date lands about seven weeks before CMMC Phase 2 begins.

Two dates worth putting on the same calendar line: the FIPS 140-2 sunset (September 21, 2026) and the start of CMMC Phase 2 (November 10, 2026), when the DoD begins including Level 2 (C3PAO) certification requirements in applicable solicitations. The practical read: inventory your modules now and plan your move to FIPS 140-3 before the two deadlines collide.

Before you rip out a platform over FIPS, map your actual exposure — you may need to reconfigure and document far more than you need to replace. If it’s beyond your team, get matched with readiness or enclave provider categories via Find My CMMC Path.

Which CUI must be encrypted in transit?

“In transit” is broader than most people assume. It covers CUI moving across the public internet, partner portals, secure file transfer (SFTP), VPN tunnels, APIs, and email. And it does not automatically stop at your office walls. A common and expensive assumption is “our network is internal, so we’re fine.” The control is about where CUI travels, not who owns the wire.

Common implementations include FIPS-validated TLS, VPN, and secure file-transfer paths (TLS 1.2 or 1.3 with approved cipher suites is typical) — but 3.13.8 itself doesn’t prescribe a specific protocol. What matters at assessment is that your evidence ties the deployedcryptographic module, its configuration, and your CUI data flow back to 3.13.8 and 3.13.11. The rare exception — “alternative physical safeguards” — is real but narrow (think a protected distribution system). For the vast majority of contractors, the answer is yes.

What must be protected at rest — and does that always mean encryption?

“At rest” is everywhere CUI sits: file shares, laptops and desktops, servers, databases, email archives, backups, and engineering systems like CAD/CAM. For most of those, encryption through a FIPS-validated module is the answer that’s easiest to prove. The point isn’t to find a loophole — it’s to map where CUI actually rests and choose the right protection for each location, then document it in your system security plan.

The scenario-to-evidence-to-provider map

Notice the pattern: almost every row’s “common mistake” is a proof failure or a scopemisread, not a missing feature. That’s the real shape of CMMC encryption work.

What evidence will assessors actually ask for?

Two habits save the most pain here. First, capture the module versionalongside the certificate — CMVP validations are tied to specific versions, and a routine update can push you past the validated build. Second, write your SSP to what you can prove, not to what you hope. Overclaiming in the SSP is how a design gap becomes a credibility gap.

Does encrypting CUI take it out of scope?

This is the single most expensive myth in CMMC scoping, and the DoD has shut the door on it in writing. Per the DoD CMMC FAQ (v5):

• Encrypted CUI is still CUI (B-Q8).Encryption does not “decontrol” data. If a file contains CUI, it stays in scope even when encrypted — a point the DoD added and reinforced across its late-2025 and 2026 FAQ revisions.
• Encryption alone is not logical separation.You cannot encrypt a file and declare it out of scope. Real separation comes from segmentation, firewall and routing policy, VLANs, VPN architecture, access controls, and key management — not from ciphertext by itself.
• But encrypted CUI can traverse otherwise out-of-scope systems.If your CUI enclave relies on enterprise networking components outside the enclave, and all CUI is properly encrypted before it leaves, you don’t automatically have to pull those enterprise components into scope — provided the enclave is genuinely, logically separated. Encryption plus a defensible boundary; not encryption instead of one.

There’s a related nuance most contractors miss. A VDI (Virtual Desktop Infrastructure)endpoint can stay out of scope only if CUI never lands on it — the session is limited to keyboard, video, and mouse, with no local copy, save, print, or screenshot, and separate multifactor authentication to reach the desktop. It’s a real path to avoid turning every laptop into a CUI asset, but only if the configuration actually enforces “no local CUI.”

The CMMC FAQ has been revised several times and the DoD renumbers its questions between versions; we’ve cited the question number where it’s stable and described the rest by substance so this stays accurate as the FAQ is updated.

Can encrypted CUI live in commercial cloud, email, or file-sharing tools?

Verify vendors before you procure — questions that matter

Because email is the single most confused encryption workflow — it hits transit, at rest, endpoint caching, and key custody all at once — we keep the deep, provider-by-provider analysis on our dedicated CUI email encryption for CMMC page. The one-line version: TLS email is not the same as CMMC-compliant CUI email.

Can you put FIPS encryption (SC.L2-3.13.11) on a POA&M?

Per 32 CFR 170.21, a Level 2 POA&M is limited to 1-point requirements, except SC.L2-3.13.11 may be included onlywhen encryption is present but not yet FIPS-validated. “We plan to encrypt later” is not that exception — that’s the 5-point, non-deferrable version.

• A POA&M is not a comfort blanket. To even qualify for Conditional status you need at least 88 of 110, and every open item must close within 180 days, confirmed by a closeout assessment. Miss the window and the conditional status lapses.
• This should never be your plan. The narrow FIPS exception exists for genuine, temporary situations — not as a strategy for deferring the control. There's also a separate concept in the rule for a temporary deficiency (32 CFR 170.4(b)) — for example, when a patch invalidates a module that was validated — which can be documented in an operational plan of action. That's a real safety valve, but it's for after implementation, not instead of it.
• The 88 floor is a floor, not a goal. Primes increasingly screen subcontractors on their actual score, and an 88 with encryption gaps invites follow-up questions. Aim higher than the minimum.

The most common CMMC encryption mistakes

1. 1"AES-256 means we're good." Fix: Match your deployed module to a CMVP certificate and record certificate/version/config.
2. 2"FIPS mode is enabled, so we're validated." Fix: FIPS mode restricts algorithms; still confirm the module carries a current CMVP validation.
3. 3"Encrypted CUI isn't CUI anymore." Fix: It stays CUI until formally decontrolled — CMMC FAQ B-Q8.
4. 4"It's encrypted, so commercial cloud is fine." Fix: DFARS 252.204-7012 requires FedRAMP Moderate (or equivalent) for any cloud handling CUI.
5. 5"TLS email covers our email CUI." Fix: Protect the message and attachments end to end, not just the transport channel.
6. 6"Mobile devices are out of scope because we use MDM." Fix: Document validated encryption of CUI on the device (AC.L2-3.1.19), not just MDM enrollment.
7. 7"The vendor has a compliance page, so we're compliant." Fix: Their capability isn't your implementation or your evidence — map it to your assessed system.
8. 8"We'll POA&M FIPS later." Fix: Only the "employed but not validated" case is deferrable; "no encryption" is a hard blocker.

What should you do first — and who should help?

1. 1Confirm FCI vs CUI. Read the contract and the clauses. The clause sets your level — not a checklist, and not an assumption.
2. 2Map every CUI flow — in transit, at rest, mobile, removable media, remote access, wireless, and cloud.
3. 3Match each flow to its control, and decide where encryption is the mechanism versus where other safeguards carry the load.
4. 4Verify FIPS modules on the CMVP list before you procure anything.
5. 5Choose the right category for the gaps you actually have.

This last step is what we call The CMMC Path Framework— the logic that maps your required level, FCI vs CUI handling, assessment type, IT and cloud environment, and contract timeline to the category of provider you need. It routes you to a category, not a named vendor, and it is not a score, a ranking, or compliance advice. See our full provider-category comparison and cost ranges so you can budget before you call anyone.

What we actually verified for this guide

We built this page from primary sources and dated the check so you can re-verify anything yourself.

• 32 CFR Part 170 (CMMC Program Rule), including §170.14 (levels), §170.21 (POA&M), and §170.24 (scoring) — checked July 3, 2026.
• NIST SP 800-171 Rev. 2 encryption-related controls (3.1.13, 3.1.17, 3.1.19, 3.5.10, 3.8.6, 3.8.9, 3.13.8, 3.13.10, 3.13.11, 3.13.16) — checked July 3, 2026.
• NIST SP 800-171A assessment procedures and evidence expectations — checked July 3, 2026.
• DFARS 252.204-7012 and 252.204-7021 on Acquisition.gov — checked July 3, 2026.
• NIST CMVP and FIPS 140-3 transition including the September 21, 2026 sunset — checked July 3, 2026.
• DoD CMMC FAQ (v5) including B-Q8 (encrypted CUI remains CUI) and E-Q1/E-Q2 (cloud FedRAMP Moderate), plus scoping, VDI, and enclave guidance — checked July 3, 2026.
• CMMC Code of Professional Conduct / Cyber AB impartiality rules for the readiness-vs-assessment separation — checked July 3, 2026.
• No named provider rankings are used on this page. Provider categories only.

See our editorial standards and corrections policy. Next scheduled review: October 2026, or sooner if the DoD, DFARS, NIST, CMVP, FedRAMP, the Cyber AB, or the CMMC FAQ issue changes.

Frequently asked questions

The next step, without the guesswork

You came for “what does CMMC require for encryption,” and you now have the map: the ten controls, what FIPS-validated really means, the points at stake, what you can and can’t defer, what evidence to collect, and what encryption does not solve. The last mile is turning that into a plan for your environment.