NIST SP 800-171 & CMMC 2.0 3.13.11 Requirement:
Employ FIPS-validated cryptography when used to protect the confidentiality of “Controlled Unclassified Information” (CUI).
NIST SP 800-171 & CMMC 2.0 3.13.11 Requirement Explanation:
It is not adequate to use a NIST-recommended algorithm, such as AES, unless the developer’s implementation of the algorithm has also been validated. FIPS-validated cryptography is not required for all information, only the protection of CUI.
Example NIST SP 800-171 & CMMC 2.0 3.13.11 Implementation:
When encrypting computers, servers, backup drives, and removable storage devices that contain CUI, ensure that FIPS validated cryptography is used. Microsoft Bitlocker and Mac FileVault are examples of FIPS validated cryptographic solutions. Ensure that your VPN appliance and WiFi access points used FIPS validated cryptography. Check with the device manufacturers to verify.
NIST SP 800-171 & CMMC 2.0 3.13.11 Scenario(s):
- Scenario 1:
The employees in your company all handle “Controlled Unclassified Information” (CUI) on their laptops. To protect the confidentiality of the “Controlled Unclassified Information” (CUI) on the laptops you use bit locker disk encryption software to encrypt their hard drives. Bit locker uses FIPs validated encryption.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.