NIST 800-171 Controls · System and Communications Protection

SC.2.011 — Employ FIPS-Validated Cryptography

CMMC Level 2SPRS if unmet: -5CRITICAL priority~8h to implement

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

What SC.2.011 means in plain English

The encryption you use to protect CUI must be FIPS 140-2 validated — this is a government certification that the encryption algorithm and implementation have been tested and approved. The good news is Windows has a FIPS mode built in, and BitLocker uses FIPS-validated encryption when FIPS mode is enabled. You do not need to buy special software — just enable the FIPS compliance setting in Windows and make sure your VPN and TLS configurations use FIPS-approved algorithms like AES-256.

The assessment question

“Is FIPS 140-2 validated cryptography enabled and used for all encryption protecting CUI, including full-disk encryption, VPN tunnels, and data in transit?”

How to implement SC.2.011

Enable FIPS compliance mode in Windows via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" set to Enabled.
Verify BitLocker is using AES-256 (FIPS-validated) by running "manage-bde -status" in an admin command prompt. If using AES-128, re-encrypt with AES-256.
Check your VPN configuration to ensure it uses FIPS-approved ciphers: AES-256-GCM for OpenVPN, or ChaCha20-Poly1305 for WireGuard (check FIPS validation status of your specific implementation).
For TLS, ensure your web servers and email services use TLS 1.2+ with FIPS-approved cipher suites. Use IIS Crypto to configure this on Windows servers.
Document all cryptographic modules in use and their FIPS 140-2 validation certificate numbers. Check the NIST CMVP database at csrc.nist.gov.

Evidence your assessor will ask for

Group Policy setting showing FIPS compliance mode is enabled
BitLocker status showing AES-256 encryption on all CUI workstations
VPN configuration showing FIPS-approved encryption algorithms
TLS configuration showing FIPS-compliant cipher suites
List of cryptographic modules in use with FIPS 140-2 certificate numbers

Does AI prompt monitoring help with this control? Honestly, no.

SC.2.011 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Communications Protection controls

SC.1.001

Monitor and Protect Communications at Boundaries

SC.1.005

Implement Subnetworks for Public Components

SC.2.002

Employ Effective Security Architecture

SC.2.003

Separate User and System Management Functionality

SC.2.004

Prevent Unauthorized Info Transfer via Shared Resources

SC.2.006

Deny Network Traffic by Default

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment