3.13.11

Requirement

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

Discussion

Cryptography can be employed to support many security solutions including the protection of controlled unclassified information, the provision of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances for such information but lack the necessary formal access approvals. Cryptography can also be used to support random number generation and hash generation. Cryptographic standards include FIPS-validated cryptography and/or NSA-approved cryptography. See [NIST CRYPTO]; [NIST CAVP]; and [NIST CMVP].

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing cryptographic protection; security plan; system design documentation; system configuration settings and associated documentation; cryptographic module validation certificates; list of FIPS-validated cryptographic modules; system audit logs and records; other relevant documents or records].
Interview

[SELECT FROM: System or network administrators; personnel with information security responsibilities; system developer; personnel with responsibilities for cryptographic protection].
Test

[SELECT FROM: Mechanisms supporting or implementing cryptographic protection].

ID	Assessment Objectives
3.13.11[a]	Fips-validated cryptography is employed to protect the confidentiality of CUI.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!