Quick answer: FIPS validated encryption means a cryptographic module has been tested and certified by the federal government, not just that your data is encrypted. CMMC Level 2 requires it for protecting CUI confidentiality (control SC.L2-3.13.11), FedRAMP and CJIS expect it as standard practice, and HIPAA requires “reasonable and appropriate” protection without mandating FIPS specifically. Knowing which rule applies to your business prevents overspending or failing an audit.
Think you’re covered because your software uses AES encryption or runs over TLS? That’s a common assumption, and it trips up a lot of businesses working toward compliance. Strong encryption algorithms are a great start, but they don’t automatically satisfy a FIPS requirement.
If you’re preparing for CMMC compliance or navigating overlapping federal frameworks, understanding FIPS validated encryption is essential. Let’s break down what it actually means, where it applies, and how to avoid the mistakes that trip up even well-prepared IT teams.
What Does FIPS Validated Encryption Actually Mean?
FIPS stands for the Federal Information Processing Standard, created by the National Institute of Standards and Technology (NIST). It’s used to validate cryptographic modules, the specific components responsible for encrypting your data.
Here’s the key distinction: FIPS doesn’t ask “are you using encryption?” It asks “has this exact cryptographic component been officially tested and certified by the federal government?”
That’s a meaningfully different question. Your business might use excellent encryption technology that still doesn’t meet a FIPS requirement, simply because the module itself was never submitted for validation.
Why Is FIPS Validated Cryptography Different From Standard Encryption?
Picture two businesses, each using AES encryption to protect customer files. One purchased software built on a FIPS validated module. The other built something similar using the same algorithm, but through a non-validated implementation.
Both are technically “encrypted.” Only one meets a FIPS requirement.
This is the gap that catches people off guard. Good cryptography and validated cryptography aren’t the same thing. Validation means the module has gone through NIST’s formal testing process, and that process is reflected in the price. FIPS compliant equipment and software typically cost more than their non-validated counterparts, which is worth factoring into your compliance budget early.
When Does CMMC Require FIPS Validated Cryptography?
If your business handles Controlled Unclassified Information (CUI), CMMC 2.0 Level 2 is where FIPS validated encryption becomes a concrete requirement. Specifically, control SC.L2-3.13.11, derived from NIST SP 800-171A, states that you need FIPS validated cryptography when protecting the confidentiality of CUI, whether that data is at rest or in transit.
This applies to common, everyday scenarios defense contractors deal with regularly: emailing a spec sheet that contains CUI, backing up project files to the cloud, or storing contract documentation on a server. If that data qualifies as CUI and you’re protecting its confidentiality with encryption, the cryptographic module behind that encryption needs to be FIPS validated.
This is also where many businesses preparing for a Level 2 audit get caught. They’ve invested in solid cybersecurity tools, but never confirmed whether the underlying cryptographic components carry FIPS validation.
How Do FedRAMP, CJIS, and IRS Publication 1075 Handle Validated Encryption?
CMMC isn’t the only framework built around this standard. A few others treat FIPS validation as a baseline expectation:
FedRAMP, which governs federal cloud systems, treats FIPS validation as essentially mandatory. It’s baked into the authorization process for any cloud service provider looking to work with federal agencies.
CJIS, the standard covering law enforcement data, holds the same expectation. Auditors reviewing CJIS compliance will actively look for FIPS validated cryptography protecting sensitive criminal justice information.
IRS Publication 1075, which applies to federal tax information, follows a similar pattern. If your business handles this type of data, validated cryptography isn’t a nice-to-have. It’s something examiners expect to see documented.
Across all three frameworks, the common thread is clear: validated cryptography isn’t a suggestion; it’s an active checklist item during review.
Does HIPAA Require FIPS Validated Encryption?
Here’s where things diverge. HIPAA absolutely requires you to protect patient data, but it doesn’t flat-out mandate FIPS validated cryptography across the board. Instead, HIPAA focuses on whether your encryption approach is reasonable, appropriate, and properly documented for the risk involved.
This distinction trips up a lot of healthcare-adjacent businesses. Being regulated doesn’t automatically mean every system needs FIPS validation. A healthcare practice encrypting patient records may meet HIPAA’s standard without FIPS validated modules, depending on their specific risk assessment and documentation.
The lesson here applies broadly: don’t assume one compliance framework’s encryption rules carry over to another. Each has its own standard, and conflating them leads to either wasted spending or genuine compliance gaps.
What Are the Most Common Mistakes Businesses Make With FIPS?
A few misunderstandings show up again and again when businesses start working through FIPS requirements:
Assuming AES or TLS automatically means compliance. These are strong, legitimate algorithms, but FIPS validation is about whether the specific implementation of that algorithm has been tested and certified. The algorithm being secure doesn’t mean the module is validated.
Assuming FIPS is required everywhere. In reality, the requirement depends on where and how the data is being protected, and what your specific contract or framework calls for. Not every system in your environment needs validated cryptography just because your business handles CUI somewhere.
Assuming “FIPS mode” solves everything. Many products include a toggle labeled “FIPS mode.” Turning it on sometimes helps, but what actually matters is whether that exact version of the product has been validated under the FIPS program. A mislabeled or outdated FIPS mode won’t satisfy an auditor.
Where Should You Start Looking for FIPS Validated Encryption?
The real question isn’t “Should I turn on FIPS?” It’s “Does my compliance requirement specifically call for validated cryptography, and where does that apply in my environment?”
Start by identifying where CUI or other regulated data lives in your business, whether that’s email, file storage, backups, or specific applications. From there, check with your software vendors and hardware manufacturers to confirm which products carry current FIPS validation. This information is typically available from the vendor directly, and it’s worth confirming before you build your compliance plan around an assumption.
Getting this wrong in either direction carries real cost. Over-apply FIPS requirements and you’ll spend more than necessary on validated equipment you didn’t need. Under-apply them and you risk a failed audit down the line.
If you’re working toward CMMC Level 2 and want a clear picture of where FIPS validated encryption actually applies in your environment, HRCT can help you sort out what’s required, what’s optional, and where your current setup stands. Request a free assessment to get started.
Frequently Asked Questions
What is FIPS validated encryption?
FIPS validated encryption refers to cryptographic modules that have been formally tested and certified by NIST under the Federal Information Processing Standard. It’s a certification of the specific implementation, not just the strength of the algorithm being used.
Does using AES encryption mean I’m FIPS compliant?
No. AES is a strong encryption algorithm, but FIPS compliance depends on whether the specific cryptographic module implementing that algorithm has been validated by NIST. Using AES alone doesn’t guarantee that validation.
Does CMMC always require FIPS validated cryptography?
CMMC Level 2 requires FIPS validated cryptography specifically when protecting the confidentiality of CUI, under control SC.L2-3.13.11. Businesses pursuing Level 1 generally won’t face this requirement, since Level 1 doesn’t involve CUI.
Does HIPAA require FIPS validated cryptography?
Not automatically. HIPAA requires encryption that is reasonable and appropriate for the risk involved, but it doesn’t universally mandate FIPS validation the way CMMC Level 2 does for CUI.
How do I know if my current software is FIPS validated?
Check with your software vendor or hardware manufacturer directly. FIPS validated products are typically documented as such, and this information should be confirmed before assuming compliance.