NIST SP 800-171 & CMMC 2.0 Control 3.13.11 Requirement:
Employ FIPS-validated cryptography when used to protect the confidentiality of “Controlled Unclassified Information” (CUI).
NIST SP 800-171 & CMMC 2.0 3.13.11 Requirement Explanation:
It is not adequate to use a NIST-recommended algorithm, such as AES, unless the developer’s implementation of the algorithm has also been validated. FIPS-validated cryptography is not required for all information, only the protection of CUI.
Example NIST SP 800-171 & CMMC 2.0 3.13.11 Implementation:
When encrypting computers, servers, backup drives, and removable storage devices that contain CUI, ensure that FIPS validated cryptography is used. Microsoft Bitlocker and Mac FileVault are examples of FIPS validated cryptographic solutions. Ensure that your VPN appliance and WiFi access points used FIPS validated cryptography. Check with the device manufacturers to verify.
NIST SP 800-171 & CMMC 2.0 3.13.11 Scenario(s):
- Scenario 1:
The employees in your company all handle “Controlled Unclassified Information” (CUI) on their laptops. To protect the confidentiality of the “Controlled Unclassified Information” (CUI) on the laptops you use bit locker disk encryption software to encrypt their hard drives. Bit locker uses FIPs validated encryption.
Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:
Compliance Accelerator
Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.
Quantum Assessor
Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.
Supply Chain Verifier
Trust is everything. Verify, monitor, and support subcontactor compliance.