NIST 800-171 Controls · System and Communications Protection

SC.2.011 — Employ FIPS-Validated Cryptography

CMMC Level 2SPRS if unmet: -5CRITICAL priority~8h to implement

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

What SC.2.011 means in plain English

The encryption you use to protect CUI must be FIPS 140-2 validated — this is a government certification that the encryption algorithm and implementation have been tested and approved. The good news is Windows has a FIPS mode built in, and BitLocker uses FIPS-validated encryption when FIPS mode is enabled. You do not need to buy special software — just enable the FIPS compliance setting in Windows and make sure your VPN and TLS configurations use FIPS-approved algorithms like AES-256.

The assessment question

“Is FIPS 140-2 validated cryptography enabled and used for all encryption protecting CUI, including full-disk encryption, VPN tunnels, and data in transit?”

How to implement SC.2.011

Enable FIPS compliance mode in Windows via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" set to Enabled.
Verify BitLocker is using AES-256 (FIPS-validated) by running "manage-bde -status" in an admin command prompt. If using AES-128, re-encrypt with AES-256.
Check your VPN configuration to ensure it uses FIPS-approved ciphers: AES-256-GCM for OpenVPN, or ChaCha20-Poly1305 for WireGuard (check FIPS validation status of your specific implementation).
For TLS, ensure your web servers and email services use TLS 1.2+ with FIPS-approved cipher suites. Use IIS Crypto to configure this on Windows servers.
Document all cryptographic modules in use and their FIPS 140-2 validation certificate numbers. Check the NIST CMVP database at csrc.nist.gov.

Evidence your assessor will ask for

Group Policy setting showing FIPS compliance mode is enabled
BitLocker status showing AES-256 encryption on all CUI workstations
VPN configuration showing FIPS-approved encryption algorithms
TLS configuration showing FIPS-compliant cipher suites
List of cryptographic modules in use with FIPS 140-2 certificate numbers

Does AI prompt monitoring help with this control? Honestly, no.

SC.2.011 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →