CMMC Level 2 Controls

CMMC FIPS 140-2 Requirements: What Actually Counts for Level 2

By The Defense Compliance Report Editorial Team · Last reviewed: July 2026· Last verified: July 3, 2026

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency.

The CMMC FIPS answer in five rows

What are the CMMC FIPS 140-2 requirements?

Where does this actually come from? It’s worth seeing the chain, because “CMMC FIPS 140-2 requirements” is really six documents pointing at one sentence:

Does “FIPS compliant” count, or does CMMC require FIPS-validated cryptography?

People use “FIPS” to mean five different things. Only one of them reliably passes:

This isn’t a theoretical distinction — it has a track record. In one multi-year practitioner review, 83% of assessed contractors failed control 3.13.11, and the report pointed to reliance on “FIPS compliant” cryptography instead of FIPS-validated cryptography. Treat that as historical practitioner data rather than a current DoD-wide failure rate — but the pattern hasn’t changed.

A weak claim vs. a usable evidence packet

Same laptop. One is a finding; the other is a pass. The difference is entirely proof.

The trap inside the trap: product ≠ module ≠ version ≠ configuration

A productcan contain a validated module without the product itself being “the certificate.” Take BitLocker: Windows ships with cryptographic modules that appear on NIST’s CMVP list, and BitLocker can use them — but the product name is never your evidence. The encryption only counts when FIPS mode is enabled, the version you’re running matches the validated module, and you can produce the certificate. If your installed build has drifted past the validated version, or you’re running it in a mode the certificate doesn’t cover, you have a validated module on paper and an evidence gap in reality.

So the real question is never “is this product FIPS?” It’s four questions stacked:

1. 1Is there a CMVP certificate for the module inside this product?
2. 2Does the certificate cover the version we're actually running?
3. 3Are we running it in the approved mode/configuration the security policy requires?
4. 4Can we map the product to the module clearly enough for an assessor to follow?

Miss any one of those and “we’re FIPS” becomes “we thought we were.”

How do I verify my cryptography is actually FIPS-validated?

This is a workflow you can run yourself in an afternoon:

1. 1Identify the module, not just the product. For each tool protecting CUI (disk encryption, VPN, TLS termination, email/file platform, backup, MDM), find the cryptographic module name and version. This is usually in the vendor's compliance or security documentation, not the marketing page.
2. 2Search the CMVP list. Look the module up in NIST’s CMVP validated-modules search. CMVP is the joint NIST / Canadian Centre for Cyber Security program that tests and publishes validated modules — it is the authoritative source. The listing gives you the certificate number, vendor, standard (140-2 or 140-3), status, and a link to the security policy.
3. 3Confirm the version and mode match. Check that the version you're running is the version on the certificate, and that your configuration matches the approved mode in the security policy. This is the step most people skip.
4. 4Record it as evidence. Capture, for each protection point: certificate number, module name and version, standard (140-2/140-3), status (Active/Historical), the operational environment, and where it sits in your CUI flow. Note the product-to-module mapping if the module is embedded in a larger product.
5. 5Write it into your System Security Plan (SSP). The SSP is where this becomes assessable. An assessor should be able to read your 3.13.11 narrative and trace each place CUI is encrypted to a certificate you can produce.

What to highlight when you pull a CMVP certificate: the certificate number, the module name, the standard (FIPS 140-2 or 140-3), the status (Active or Historical), the version/build it covers, and the security policy(which spells out the approved operating mode). Those six items are the spine of your evidence — an annotated screenshot of that certificate entry is exactly the kind of proof object assessors like.

One caution NIST states plainly: for federal purposes, if cryptography is required to protect information and the cryptography is not validated, it’s treated as providing no protection at all— as if the data were plaintext. “Encrypted but not validated” doesn’t earn partial trust from the standard; it’s the validation that counts.

Your FIPS evidence self-check (copy this)

Run every place CUI lives through these columns. If any cell is blank or “unknown,” that’s your gap list — and your to-do list before an assessment.

Where does FIPS-validated cryptography actually apply in a CMMC Level 2 environment?

The CMMC FIPS Obligation & Evidence Matrix

Source basis: CMMC Level 2 maps to NIST SP 800-171 Rev. 2 (32 CFR Part 170); NIST SP 800-171A defines the 3.13.11 assessment objective; the DoD assessment guidance explains the module-validation requirement and the adjacent controls; NIST CMVP governs the 140-2/140-3 transition; 32 CFR §§170.21 and 170.24 set the POA&M and scoring consequences.

The scope lever most contractors miss

Here’s the move that separates a six-figure project from a manageable one. Because 3.13.11 protects CUI specifically, if you isolate CUI into a dedicated enclave— a bounded environment where CUI lives and nowhere else — you can confine the FIPS-validated requirement to that boundaryinstead of hardening your entire company. The DoD’s own assessment guidance supports this thinking. Scope is not a loophole — it’s the legitimate lever. And whether a given system, switch, or cloud component is inside or outside your CUI boundary is exactly the determination to confirm with a Registered Practitioner before you spend.

For the cloud specifically, the rule is about the service provider’s baseline, not a brand name. Under DFARS 252.204-7012, an external cloud service provider used for covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline. Standard commercial Microsoft 365 does not meet DFARS 7012 for CUI. Microsoft’s government cloud carries a FedRAMP High authorization; AWS GovCloud (US) is FedRAMP High authorized as well. Do not rely on the brand name alone — verify the specific service, boundary, FedRAMP package or equivalency documentation, shared-responsibility matrix, and any CMVP evidence tied to your CUI use case. We go deeper on environment selection in our GCC High and AWS GovCloud breakdowns.

What evidence will an assessor or readiness reviewer ask for?

Assemble this once and it serves both a self-assessment and a C3PAO certification. Here’s the packet:

How is FIPS-validated cryptography (3.13.11) scored in SPRS — and can you POA&M it?

Your SPRS score starts at 110 and you subtract points for gaps. Here’s the 3.13.11 truth table, straight from the regulation:

The carve-out that makes 3.13.11 unusual

Under 32 CFR §170.21, POA&M items generally have to be worth 1 point or less— which means your 3-point and 5-point gaps must be closed before the assessment. There is exactly one exception in the entire Level 2 rule: SC.L2-3.13.11 may go on a POA&M when encryption is employed but not yet FIPS-validated— the −3 condition. If you’re in the no-encryptionstate (−5), that carve-out does not apply, it’s over the point limit, and it can stop your certification cold.

• If you already encrypt CUI with something— even a non-validated tool — you can potentially reach Conditional Level 2, put 3.13.11 on a POA&M, and have 180 days to get to a validated module.
• If you’re not encrypting CUI at all, that one gap is a −5 that can’t be deferred. This page should make you slower to schedule an assessment, not faster.

Two more rules bound this. To earn a Conditional status at all, your score divided by 110 must be at least 0.8 — an 88 — and your SSP (control 3.12.4) must be in place at the time of assessment. The POA&M closeout window is 180 days from your Conditional Status Date; miss it and the conditional status expires.

“Temporary deficiency” is not a free pass

The regulation and the DoD’s assessment methodology use 3.13.11 as their textbook example of a temporary deficiency: you had FIPS-validated cryptography implemented, then a patch changed the module so the running version was no longer the validated one. With a documented plan of action, that’s scored as implemented — because it’s a break after implementation, not a failure to implement. That is a genuine, government-recognized safety valve. It is not cover for never having stood the control up in the first place.

Why does the point math matter beyond the assessment? Because your SPRS submission and CMMC affirmations are compliance representations the Government relies on. Overstating them can create False Claims Act (FCA) risk — illustrated by the Department of Justice’s 2022 $9 millionAerojet Rocketdyne settlement over alleged cybersecurity misrepresentations. That case wasn’t about FIPS specifically, but the lesson generalizes: score honestly, document what’s real, and don’t let a validated-vs-compliant gap turn into a representation you can’t defend. More on how the whole score works in our CMMC Final Rule coverage.

What changes when FIPS 140-2 sunsets in September 2026?

The transition itself is settled fact, verified against NIST’s FIPS 140-3 transition materials on July 3, 2026: FIPS 140-3 was approved in March 2019 and became effective in September 2019; CMVP began issuing 140-3 validations in September 2020; it stopped accepting new 140-2 submissions after April 1, 2022; and 140-2 validations are accepted for CUI protection through September 21, 2026, after which they move to the Historical list. Even then, NIST allows those modules to keep serving existing systems — agencies simply should not build new systems on them.

Questions to ask any vendor before you sign

• Is the module FIPS 140-2 or 140-3 validated?
• What's the CMVP certificate number?
• Is the certificate Active, Historical, or Revoked?
• Which product versions use that module?
• What configuration is required for approved mode?
• What's the FIPS 140-3 roadmap, and what happens after the 2026 transition?
• Can you provide evidence suitable for an SSP and assessment?

Does CMMC Level 1 require FIPS 140-2?

The trap here is drift. A company starts as FCI-only, wins work that involves CUI, and doesn’t re-scope. The contract clause and the data you actually handle set your level — not last year’s assessment. If there’s any chance CUI has entered your systems, treat FIPS as in play and re-check your scope. See our CMMC scoping guide if you’re not certain which you handle.

Which provider category helps with CMMC FIPS 140-2 requirements?

Two cautions worth keeping. First, software alone does not make you CMMC compliant — a GRC platform or an enclave is a powerful layer, not the whole solution, and any vendor implying otherwise is overselling. Second, on assessment independence: Cyber AB’s authorization requirements call for C3PAOs to manage impartiality and conflict-of-interest risks. In practice, treat implementation/remediation and formal assessment as separate lanes.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.

Still deciding? Our CMMC provider-category guide breaks down what each type does.

The most common CMMC FIPS 140-2 mistakes

What we actually verified

• 32 CFR Part 170 — CMMC Level 2 is the 110 requirements of NIST SP 800-171 Rev. 2 across 14 families; Level 1 uses FAR 52.204-21.
• NIST SP 800-171 Rev. 2, §3.13.11 — the FIPS-validated cryptography requirement text.
• NIST SP 800-171A — the assessment objective for 3.13.11.
• DoD Assessment Methodology — an approved algorithm alone is not sufficient; the module must be separately validated; evidence objects; adjacent controls.
• NIST CMVP / FIPS 140-3 Transition — 140-2 accepted through Sept. 21, 2026, then Historical; Historical ≠ revoked; new 140-2 submissions closed after April 1, 2022.
• 32 CFR §170.24 — scoring: −3 (non-validated) / −5 (no encryption); evidence must be final, not draft.
• 32 CFR §170.21 — the SC.L2-3.13.11 POA&M carve-out; the 0.8 (88-point) threshold; the 180-day closeout.
• DFARS 252.204-7012 — "adequate security" via NIST SP 800-171, and the FedRAMP Moderate-equivalent requirement for cloud providers handling covered defense information.
• DFARS 252.204-7021 and 252.204-7025 — the CMMC contract clause (have/maintain status + affirmations) and the solicitation notice.

What we did not independently re-test: any single vendor’s current CMVP certificate for your specific module and version. Certificate status is tied to your exact build and configuration, so verify your own against the CMVP list before you rely on it.

Regulation-stated vs. operationally-verified

The rule tells you what is required. Your evidence proves whether you meet it. Keep the two separate:

Frequently asked questions about CMMC FIPS 140-2 requirements

Choose the right CMMC path before you hire

Need help deciding what type of CMMC provider you need? Tell us your level, scope, and timeline, and we’ll match you with source-checked CMMC provider options.

Do not submit CUI, drawings, export-controlled technical data, or sensitive contract details through this form.