SC.L2-3.13.11
CUI Encryption
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.11 in the reference catalog with its NIST cross-references
Official requirement
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
Assessment objectives
a. FIPS-validated cryptography is employed to protect the confidentiality of CUI.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Use FIPS-validated cryptography when cryptography protects controlled-information confidentiality.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator responsible for deploying encryption on all devices that contain CUI. You must ensure that the encryption you use on the devices is FIPS -validated cryptography [a]. An employee informs you of a need to carry a large volume of CUI offsite and asks for guidance on how to do so. You provide the user with disk encryption software that you have verified via the NIST website that uses a CMV P-validated encryption module [a]. Once the encryption software is active, the user copies the CUI data onto the drive for transport.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing cryptographic protection; system security plan; system design documentation; system configuration settings and associated documentation; cryptographic module validation certificates; list of FIPS-validated cryptographic modules; system audit logs and records; any other relevant documents or records
Common mistakes
Treating an algorithm name or product marketing claim as proof of module validation.