The CMMC is vast in coverage and can easily become overwhelming. It includes 110 security controls for each level, excluding level 1, which has only 15, with many encryption controls required throughout.
This guide breaks down exactly what the four core encryption controls demand, how they apply across certification levels, and where assessors consistently find gaps that could have been caught months earlier.
Whilst most of these controls are straightforward, one stands out on the Defense Industrial Base Cybersecurity Assessment Center’s list of most commonly failed controls: SC.L2-3.13.11, which mandates FIPS-validated cryptography for protecting Controlled Unclassified Information (CUI).
This is not because it is technically complex. It is because most contractors misunderstand what it truly requires.
The mistake is almost always the same: assuming that using AES-256 is enough. It is not. CMMC encryption requirements are about validated modules, not algorithms, and that distinction is what fails organisations that believed they were ready.
What Are the CMMC Encryption Requirements?
CMMC 2.0 is the Department of Defense’s framework for verifying that contractors protect sensitive defense information. It operates on three certification levels:
- Level 1, Basic protection of Federal Contract Information (FCI)
- Level 2, Protection of CUI in alignment with NIST SP 800-171
- Level 3, Protection of the most sensitive CUI against advanced persistent threats
Encryption requirements live primarily at Level 2 and above. With CMMC, the requirement for FIPS 140 validation now applies to every member of the Defense Industrial Base (DIB), an estimated 215,000 companies, that handles CUI. Every system that performs encryption and touches CUI must use FIPS-validated cryptography. That is a significant shift: previously, FIPS validation was largely reserved for vendors selling directly to federal agencies.
The timeline is active. The CMMC Acquisition Rule became effective November 10, 2025, with Phase 2, mandatory C3PAO assessments for Level 2 contracts, beginning November 10, 2026.
The 4 Core CMMC Encryption Controls Explained
Three controls form the backbone of CMMC’s encryption requirements. Understanding each one separately matters, because failing any of them has direct consequences on your assessment score.
| Control | Name | What It Requires | Applies To |
|---|---|---|---|
| SC.L2-3.13.11 | FIPS-Validated Cryptography | Cryptographic modules must hold a valid NIST CMVP certificate | Any system that handles CUI |
| SC.L2-3.13.8 | CUI in Transit | Cryptographic mechanisms must protect CUI across all transmission channels | Networks, email, file transfers, APIs |
| SC.L2-3.13.16 | CUI at Rest | CUI stored on any system must be encrypted | Servers, workstations, databases, backups |
| SC.L2-3.13.10 | Cryptographic Key Management | Keys must be generated, stored, and revoked in a controlled, documented process | All systems using encryption to protect CUI |
| MP.L2-3.8.7. | CUI on Media | Encryption must extend to physical and removable media | USB drives, external disks, backup tapes, laptops |
SC.L2-3.13.11: Employ FIPS-Validated Cryptography to Protect CUI
This is the headline control and the most misunderstood. A common mistake is confusing cryptographic algorithms with cryptographic modules. The CMMC requirement is about the module, not just the algorithm.
You can run AES-256 across your entire environment. If the module implementing it has not been validated through NIST’s Cryptographic Module Validation Program (CMVP), you are not compliant. The algorithm is not the certificate.
Pro Tip
During an assessment, you will be asked to provide the FIPS certificate number for each product that handles CUI, not a vendor’s claim that they “support AES-256.” Have those certificate numbers documented before the assessment starts.
SC.L2-3.13.8 and SC.L2-3.13.16: CUI in Transit and at Rest
SC.L2-3.13.8 requires cryptographic mechanisms to protect CUI during transmission, covering all communication channels: network connections, email, file transfers, and API communications. SC.L2-3.13.16 requires protection of CUI at rest. Neither control names a specific algorithm, but the FIPS validation requirement from 3.13.11 applies across both.
SC.L2-3.13.10: Establish and Manage Cryptographic Keys
Encryption without key management is security theatre. This control requires that keys be generated, stored, and revoked in a controlled, documented way. A compromised key renders all your encryption irrelevant regardless of algorithm strength.
MP.L2-3.8.7: Control Access to CUI on Media
This control extends encryption requirements to physical and removable media. CUI stored on a USB drive, an external hard disk, or a backup tape must be protected. Contractors who focus on network-level encryption and forget about the laptop bag sitting in a car park consistently fail this one.
CMMC Encryption Requirements by Certification Level
Level 1 covers organisations handling only FCI. The controls are foundational and do not explicitly mandate encryption, though it remains a recommended practice. This changes sharply at Level 2.
Under the CMMC scoring methodology:
- 5 points deducted if no cryptography is employed
- 3 points deducted if cryptography is present but not FIPS-validated
- Maximum score: 110 | Minimum passing threshold: 88
Getting SC.L2-3.13.11 wrong costs points you cannot afford to lose.
Level 3 introduces additional requirements aligned with NIST SP 800-172, including enhanced key management controls, stricter access controls on cryptographic infrastructure, and greater scrutiny of the supply chain around cryptographic tools.
Pro Tip
According to research by Merrill Research and CyberSheath, only 4% of defense contractors are fully prepared for CMMC certification based on third-party assessment criteria, while 75% believe they are compliant based on self-assessment. The gap is widest in technical controls, with encryption and key management among the most common failure points.
What Is FIPS-Validated Cryptography and Why Does It Matter?
FIPS stands for Federal Information Processing Standards. FIPS 140, developed by NIST, sets the benchmark for cryptographic modules intended to protect sensitive information. It requires that cryptographic modules be tested by accredited third-party laboratories and certified by NIST, a process managed through the Cryptographic Module Validation Program (CMVP).
FIPS 140-2 vs. FIPS 140-3
FIPS 140-3 is the newer standard, published March 22, 2019, and aligns with the international ISO/IEC 19790:2012(E) standard. Both remain acceptable under current CMMC requirements. FIPS 140-3 introduces stricter requirements around physical security, key management, and testing methodologies, and will likely become the primary standard as the framework evolves.
If your vendor holds a current FIPS 140-2 certificate and that module remains on NIST’s active modules list, you are covered for now, but plan your migration path.
Acceptable Encryption Standards Under CMMC
AES-256 is the most widely deployed algorithm in CMMC-compliant environments, and it satisfies cryptographic strength requirements when implemented through a FIPS-validated module. For data in transit, TLS 1.2 and TLS 1.3 support AES-256 cipher suites that meet the requirement. TLS 1.3 is the current best practice and should be your target configuration.
Pro Tip
Before your assessment, pull the FIPS certificate numbers for every product in your environment that touches CUI, your email platform, endpoint encryption, VPN, and cloud storage. Your assessor will ask for them. Having a documented inventory with certificate numbers and their active or historical status saves hours during evidence review.
Encrypting CUI at Rest for CMMC Compliance
Endpoints, Laptops, and Local Storage
Every device that stores CUI must have full-disk or file-level encryption enabled through a FIPS-validated module. In Windows environments, BitLocker is commonly used, but BitLocker in default mode is not FIPS-compliant. You must enable FIPS mode explicitly through Group Policy, and you must verify it is active, not just configured. Assessors will check both.
Removable Media and Hardware-Encrypted Devices
Removable media is one of the most consistent failure points across the DIB. A contractor can have bulletproof endpoint encryption and still fail this control because an employee transferred a CUI document to a personal USB drive. Hardware-encrypted USB devices with FIPS 140-2 Level 3 validation exist for this purpose. Controlling their use through both policy and technical enforcement is as important as choosing the right device.
Cloud Storage and FedRAMP-Authorised Infrastructure
FedRAMP Moderate and High authorisations include FIPS-validated cryptography by design. Microsoft 365 GCC High, AWS GovCloud, and Azure Government are the most commonly used platforms that meet this bar. Standard commercial tiers of the same platforms do not.
Note: Many contractors use a FedRAMP-authorised cloud platform and assume the encryption requirement is fully satisfied. It covers the provider’s infrastructure, not how users access it, what they download from it, or how they share files outside of it. The environment is FedRAMP-covered; the behaviour around it often isn’t.
Encrypting CUI in Transit for CMMC Compliance
Email Transmission of CUI
Standard email is not encrypted end-to-end. Your email might travel over a TLS-encrypted connection between mail servers, but that protects the transport pipe, not the message content. Secure email solutions that apply encryption to message content provide the protection CMMC requires for email containing CUI. Microsoft 365 GCC High with S/MIME or Office Message Encryption configured for CUI use cases addresses this. Standard Office 365 does not.
File Transfers and Collaboration Tools
SFTP and FTPS both support encrypted transmission, but implementations must use FIPS-validated cryptographic modules. Consumer file-sharing tools, even those marketed with encryption enabled, are almost never FIPS-validated. Dropbox, standard-tier Google Drive, and similar services are not acceptable for CUI transmission regardless of their encryption claims.
Remote Access and VPN Encryption
All remote access sessions that could expose CUI must use FIPS-validated encryption. Configure your VPN to enforce TLS 1.2 at minimum, disable older protocol versions, and document the configuration explicitly. When CUI leaves your physically controlled environment, cryptography is the primary protection mechanism, and that is precisely when FIPS validation becomes non-negotiable.
Encryption Key Management Under CMMC
Key Generation and Storage Requirements
Keys must be generated using approved random number generators within FIPS-validated modules and stored in a way that prevents unauthorised access. Hardware Security Modules (HSMs) are the gold standard. Software-based key stores within FIPS-validated environments are acceptable at Level 2, but your documentation must demonstrate the approach clearly.
Key Rotation and Revocation Best Practices
Define rotation intervals in your key management policy, and actually follow them. Rotate encryption keys when staff with key access leave the organisation. Have a tested revocation process. A policy that says “we rotate annually” but has never been executed will not survive an assessor interview.
Pro Tip
Document your key management lifecycle in your System Security Plan (SSP). Assessors are not just looking for functioning encryption, they are looking for documented, repeatable processes. A gap between what your SSP says and what you actually do is a finding, even if the technical controls are otherwise correct.
Common CMMC Encryption Deficiencies Found During Assessments
The Subcontractor Flow-Down Gap
Prime contractors invest heavily in their own encrypted environments, then allow subcontractors to access CUI through portals that lack proper encryption controls. Per 32 CFR Part 170, CMMC requirements flow down to subcontractors based on the type of data they process, store, or transmit. If your subcontractor downloads CUI to an unencrypted device, that exposure is your problem as much as theirs.
The Affirmation Window Vulnerability
Certified organisations must complete annual affirmations confirming ongoing compliance. Encryption configurations drift between assessments. A patch can disable FIPS mode. A new device can be deployed without the correct policy applied. Without continuous monitoring, the gap between your affirmed posture and your actual posture grows quietly, until the next assessor walks in.
Sensitive Bid Preparation Risks
CUI often flows early in a contract cycle, during proposal preparation and technical review, before formal compliance processes kick in. Contractors receive technical documents marked CUI, open them on standard workstations, email sections to colleagues, and store drafts on unencrypted shared drives. This is one of the most common real-world exposure scenarios, and it almost never appears in System Security Plans.
What a CMMC Assessor Will Look for on Assessment Day
Assessors examine documentation, configuration evidence, and staff interviews. For encryption specifically, expect requests for:
- FIPS certificate numbers for each product handling CUI
- Live demonstration that FIPS mode is active
- Data flow diagrams showing how CUI moves through your environment and what encrypts it at each step
- Key management logs showing actual rotation history, not just policy documents
Important: If minor gaps are identified during an assessment, organisations may address deficiencies within 180 days through a Plan of Action and Milestones (POA&M). Major issues require full reassessment. Encryption deficiencies attract close scrutiny and will affect your SPRS score for the duration of any POA&M period.
How to Remediate CMMC Encryption Gaps
Conducting an Encryption Gap Analysis
Map every location where CUI is stored, processed, or transmitted. For each data flow, identify the encryption method in use and verify whether the underlying module appears on the NIST CMVP active modules list. Document what is compliant, what requires remediation, and what requires a structural decision, some legacy systems need compensating controls or architectural changes rather than a direct fix.
A structured Encryption Gap Analysis is the most reliable way to surface these issues before an assessor does.
Implementing Per-File Encryption to Close Compliance Gaps
When full-disk encryption is not feasible, legacy embedded systems, manufacturing equipment, isolated lab environments, per-file encryption applied at the point of CUI creation or receipt can serve as a compensating control. The file travels encrypted regardless of where it is stored or how it is transmitted. This approach requires clear staff training and disciplined execution to be effective.
What CMMC Encryption Does Not Require
FIPS-validated modules are required when cryptography serves as your primary method of protecting CUI confidentiality, mainly when CUI leaves your physical control. When CUI stays within a physically secured boundary and physical controls provide the confidentiality protection, FIPS validation for internal network infrastructure is not mandated.
You do not need FIPS-validated switches, routers, or internal firewalls just because they carry traffic on a network that also carries CUI. This is a common and expensive misconception that sends contractors chasing requirements that do not apply to them.
Final Thoughts
Ready to find out where your encryption posture stands before an assessor does? Axipro works with defense contractors across the DIB to conduct pre-assessment gap analyses, identify FIPS compliance deficiencies, and build a remediation plan that holds up on assessment day. Get in touch to start the conversation.
What encryption algorithm is required for CMMC compliance?
CMMC does not mandate a specific algorithm by name. It requires FIPS-validated cryptography, and AES-256 is the most widely implemented algorithm that satisfies this requirement. The critical point: the cryptographic module implementing the algorithm must hold a current FIPS certificate.
Does CMMC require encryption at rest and in transit?
Yes. Controls SC.L2-3.13.16 and SC.L2-3.13.8 address at-rest and in-transit CUI respectively, and both apply at Level 2.
Is AES-256 sufficient to meet CMMC Level 2 encryption requirements?
AES-256 through a FIPS-validated module is sufficient. AES-256 through a non-validated implementation is not. The distinction matters enormously on assessment day.
What is the difference between FIPS 140-2 and FIPS 140-3 for CMMC?
FIPS 140-3, published in 2019, introduces updated testing methodologies aligned with ISO/IEC 19790. Both are currently acceptable under CMMC. FIPS 140-3 will likely become the primary standard as the framework evolves.
Do subcontractors need to meet the same CMMC encryption requirements?
Yes. CMMC requirements flow down through the supply chain. If a subcontractor processes, stores, or transmits CUI, they must meet the same encryption requirements as the prime contractor for that data.
Does using a FedRAMP-authorised cloud provider satisfy CMMC encryption requirements?
It satisfies encryption requirements for data within that provider’s authorised boundary. It does not address how users access, download, or share that data outside the boundary.
What happens if encryption requirements are not met during a CMMC assessment?
Unmet encryption controls result in score deductions and a finding in your assessment report. Minor gaps can be addressed through a POA&M within 180 days. Significant gaps may prevent certification until remediated, blocking contract eligibility during that period.
