CMMC SC.3.177 - Employ FIPS-Validated Cryptography to Protect CUI

CMMC SC.3.177 - Employ FIPS-Validated Cryptography to Protect CUI

Requirement text: SC.3.177: Employ FIPS-validated cryptography when used to protect the
confidentiality of CUI.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Cryptography can be employed to support many security solutions including the protection
of controlled unclassified information, the provision of digital signatures, and the
enforcement of information separation when authorized individuals have the necessary
clearances for such information but lack the necessary formal access approvals.
Cryptography can also be used to support random number generation and hash generation.
Generally applicable cryptographic standards include FIPS-validated cryptography and/or
NSA-approved cryptography.

CMMC CLARIFICATION
Only use FIPS-validated cryptography to protect the confidentiality of CUI since it has been
tested and validated to meet FIPS 140-3 requirements. Any other cryptography cannot be
used since it has not been tested and validated to protect CUI. FIPS validated cryptography
is not a requirement for all information, FIPS-validation is only used for the protection of
CUI.

Example
You are an IT administrator responsible for deploying encryption on all devices that contain
CUI for your organization. You must ensure that the encryption you use on the devices is
FIPS validated cryptography. An employee informs you that they must carry a large volume
of CUI offsite and asks for guidance on how to do so.

You provide the user with Whole Disk Encryption software that you have verified via the
NIST website uses a FIPS 140-3 validated encryption module. You instruct the user on the
use of the software. Once the encryption software is active, the user copies their CUI data
onto the drive to transport the data.

References
• NIST SP 800-171 Rev 1 3.13.11
• CIS Controls v7.1 14.4, 14.8
• NIST CSF v1.1 PR.DS-1, PR.DS-2
• CERT RMM v1.2 KIM:SG4.SP1
• NIST SP 800-53 Rev 4 SC-13

    • Related Articles

    • CMMC SC.3.185 - Implement Cryptography Mechanisms to Protect CUI unless Physical Safeguards

      Requirement text: SC.3.185: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 This ...

    • CMMC SC.3.191 - Protect CUI at Rest

      Requirement text: SC.3.191: Protect the confidentiality of CUI at rest. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-17 R2 Information at rest refers to the state of information when it is not in process or in transit and is located on storage devices ...

    • CMMC SC.4.197 - Employ Isolation Techniques in System and Security Architecture

      Requirement text: SC.4.197: Employ physical and logical isolation techniques in the system and security architecture and/or where deemed appropriate by the organization. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171B Physical and logical isolation ...

    • CMMC SC.5.208 - Employ Advances Boundary Protections

      Requirement text: SC.5.208: Employ organizationally defined and tailored boundary protections in addition to commercially available solutions.  DISCUSSION FROM SOURCE: CMMC Advanced adversaries study and analyze standard commercial security solutions ...

    • CMMC RE.2.138 - Protect CUI at Storage Locations

      Requirement text: RE.2.138: Protect the confidentiality of backup CUI at storage locations. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Organizations can employ cryptographic mechanisms or alternative physical controls to protect the ...