Encryption protecting CUI must be FIPS 140-validated — not just 'on'.
What it actually means
The single most commonly failed control in real government assessments. The trap: it's not enough that CUI is encrypted — the cryptographic module doing the encrypting has to be FIPS 140-validated (listed on NIST's Cryptographic Module Validation Program). BitLocker, FileVault, and your VPN can all encrypt without running in a validated mode. A 2026 wrinkle: all FIPS 140-2 module certificates move to NIST's Historical List on Sept 21, 2026 — see FIPS 140-2 → 140-3 for what that means, especially for new deployments.
Pass or fail — an assessor needs a "yes" to each
- Data at rest: full-disk encryption (BitLocker/FileVault) in FIPS mode on devices holding CUI.
- Data in transit: TLS 1.2+ everywhere CUI moves.
- Cloud (e.g., GCC High) confirmed to use FIPS-validated modules.
- Modules can be matched to a CMVP validation certificate when asked.
What to have ready
- FIPS-mode configuration screenshots
- CMVP certificate numbers for the modules in use
- Cloud provider's FIPS/validated-module documentation
Where teams trip up
- 'We encrypt everything' — without verifying the module is validated
- BitLocker on but not in FIPS mode
- Assuming a cloud platform is FIPS without confirming
Scoring & POA&M note: On the SPRS scale, 3.13.11 deducts the full 5 points if CUI isn't encrypted at all, but only 3 points if you do encrypt with a module that isn't FIPS-validated yet. That 3-point partial is the one higher-weight gap the CMMC program lets you place on a POA&M (most 3- and 5-point controls cannot be deferred). Full validation is still the goal — a POA&M is a clock, not a finish line.
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →Connected requirements
3.1.13 — Remote-access encryption falls under this3.5.10 — Password protection relies on validated crypto3.13.16 — Protect CUI at rest
More in System & Communications Protection (3.13)
3.13.1 — Protect your boundaries3.13.2 — Build security in by design3.13.3 — Separate user and admin functions3.13.4 — Stop data leaking through shared resources3.13.5 — Wall off your public-facing systems3.13.6 — Deny all, permit by exception3.13.7 — Block split tunneling on VPNs3.13.8 — Encrypt CUI in transit3.13.9 — Drop idle network sessions3.13.10 — Manage your encryption keys3.13.12 — Control cameras and microphones3.13.13 — Control mobile code3.13.14 — Control and monitor VoIP3.13.15 — Protect session authenticity3.13.16 — Encrypt CUI at rest