FIPS 140 Control 3.13.11 // 5 MIN READ

FIPS 140 "Validated" vs "Compliant" for CMMC

The Proof Gap That Fails Assessments

Control 3.13.11 is the number one reason companies fail CMMC assessments. Here's what the distinction between "validated" and "compliant" actually means — and how to get it right.

If you've spent any time preparing for a CMMC assessment, you've come across the phrase "FIPS compliant" on a vendor's datasheet. It sounds official. It might even appear next to a padlock icon and some copy about military-grade encryption.

Here's the problem: "FIPS compliant" is not a thing. Not officially. And when your assessor asks you to prove your cryptography meets NIST SP 800-171 control 3.13.11, that datasheet won't save you.

Control 3.13.11 is the number one reason companies fail CMMC assessments, according to audits by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Here's what the distinction actually means — and how to get it right.

What "FIPS-Validated" Actually Means

A FIPS-validated cryptographic module has been tested and certified by a NIST-approved laboratory under the Federal Information Processing Standard — FIPS 140-2 or 140-3. The operative word is module — not algorithm, not product. The module is the specific hardware or software implementation that executes the encryption.

Here's something most contractors get wrong: it is the manufacturer's job — Cisco, Microsoft, whoever — to submit their product to a NIST-approved testing facility and put it through a battery of tests. The government doesn't test your network. The vendor earns the certificate; you verify it.

Every validated module gets a CMVP certificate number — a public record at csrc.nist.gov. No certificate number means no validation.

Step 01

Manufacturer

Cisco, Microsoft, etc.
Submits module to NIST-approved testing lab

Step 02

CMVP / NIST

Runs battery of tests.
Issues certificate with unique number

Step 03

DoD Contractor

Verifies public list.
Buys exact model/firmware.
Configures securely.

Contractors don't submit their network for testing. They check the public list, purchase the exact matching hardware and firmware, and configure it correctly. The testing burden is the manufacturer's. The verification burden is yours.

Why "FIPS Compliant" Fails Every Time

"FIPS compliant" means a product relies on FIPS-validated components for cryptographic functionality — but the product itself has never been tested. There is no official definition of "FIPS compliant" anywhere in the FIPS 140 standard. The industry coined the phrase on its own.

A CMMC instructor explained it this way: the manufacturer built the router using FIPS rules, but never sent it to the FIPS organization for testing — because testing costs too much money. It lacks the official seal of approval. That seal is the only thing a C3PAO assessor will accept.

"FIPS compliant" = the manufacturer followed the rules.
"FIPS validated" = a government-approved lab confirmed it and issued a certificate.

Only one satisfies NIST SP 800-171 control 3.13.11.

The Scoring Impact: What This Costs You

Control 3.13.11 carries real weight in the CMMC assessment methodology. Getting it wrong isn't a footnote — it's a scored failure:

Scenario Assessment Impact
No encryption at all −5 points (critical failure)
"FIPS compliant" encryption only — not validated −3 points
FIPS-validated module, configured and documented Full credit — control satisfied

With CMMC now applying to all ~250,000 Defense Industrial Base companies that handle Controlled Unclassified Information (CUI), this requirement has never been more broadly enforced. Either you have a CMVP certificate number proving your validated module, or you don't.

How to Prove It: The Three-Part Evidence Test

Assessors don't want to fish through a 200-page binder. They need to see three specific things that connect precisely:

Evidence 01 Active Config Screen
Screenshot showing FIPS mode is enabled (e.g., "FIPS Mode: ON" in OS settings or router admin panel)
Evidence 02 System Info Screen
Screenshot showing the exact firmware version currently running — must match what appears on the NIST certificate exactly
Evidence 03 NIST CMVP Certificate
The official certificate from csrc.nist.gov showing the matching manufacturer, module name, and firmware version
Most common failure: firmware version mismatch. A contractor checks their router against the NIST CMVP list — but the firmware was updated last quarter and no longer matches the certificate on file. From an assessor's standpoint, the module is now unvalidated. Always re-verify after any firmware update.

Beyond the three-part test, also prepare:

  • A Crypto Module Reporting Table (CMRT) mapping every validated module to its data flow — both in transit (DIT) and at rest (DAR)
  • Confirmation that your cloud provider's FedRAMP authorization covers FIPS validation
  • A check that no certificates on your list have moved to "Historical" status

What to Watch For Going Forward

Two patterns catch contractors off guard late in the process:

Common Mistake

The Algorithm Assumption

Saying "we use AES-256" satisfies nothing. The algorithm and the validated module are not the same thing. The implementation must be separately tested and certified.

Upcoming Deadline

FIPS 140-3 Transition

September 21, 2026 is the cutoff to move from FIPS 140-2 to FIPS 140-3 validated modules. If your environment isn't already on 140-3, build a remediation plan now.

The Bottom Line

"FIPS compliant" is marketing language. "FIPS validated" is a contractual requirement with a government certificate number behind it. Your assessor will ask for one of those things. Make sure you have it.

Most major platforms — Windows, Azure, AWS GovCloud — have FIPS-validated cryptographic modules available. The work is knowing exactly which module, which firmware version, and how to document it. That's the difference between passing your assessment and topping DIBCAC's failure list.