For years, a weak spot in your cryptography was an internal finding. Under CMMC 2.0, it can end a bid before it is ever considered. Cybersecurity Maturity Model Certification status is now a condition of eligibility for award, and a contracting officer can require your current status before evaluating a proposal at all.
That shift lands hard on software and SaaS vendors. Controlled Unclassified Information (CUI) does not stay in infrastructure. It moves through application layers, sits in your data stores, and travels across your APIs. That pulls cryptographic controls into the scope of the software itself, not just the servers underneath it.
This piece breaks down what CMMC 2.0 requires, why cryptography is the part most vendors struggle with, and how to walk into an assessment ready to prove it.
Status as of August 2026: Phase 1 self-assessment requirements, DFARS 252.204-7012, SPRS scoring, and annual affirmations remain in force. The Phase 2 transition to mandatory C3PAO certification, scheduled for November 10, 2026, was suspended on July 13, 2026, along with later phases, pending a CMMC Reform Task Force review. The 32 CFR Part 170 program rule and the DFARS clauses were not repealed.
What CMMC 2.0 is, and why it changed the rules
CMMC 2.0 is the Department of Defense tiered verification program layered on NIST SP 800-171 Revision 2. Revision 3 was published in 2024, but the program rule incorporates Revision 2 by reference, so Revision 2 is what gets assessed. It converts security requirements that were a matter of self-attestation into a verified condition of doing business. A verified implementation is now a prerequisite for award, not a promise you make on paper.
The rule has teeth and a timeline. The DFARS final rule (clause 252.204-7021) took effect on November 10, 2025, opening Phase 1 of a four-phase, three-year rollout that was to conclude with full implementation in November 2028. That schedule is now paused past Phase 1. The phased approach is meant to give the defense industrial base time to certify, but the direction is fixed.
Three levels define what you must prove:
- Level 1: Protects Federal Contract Information (FCI) through a self-assessment against 15 practices.
- Level 2: Protects CUI against all 110 NIST SP 800-171 controls. Two paths exist: self-assessment, Level 2 (Self), and C3PAO certification, Level 2 (C3PAO); each on a three-year cycle with annual affirmation. Certification was to become the default at Phase 2; with Phase 2 suspended, self-assessment is the operative path for now.”
- Level 3: Adds 24 enhanced requirements drawn from NIST SP 800-172.
The scale is significant. The DoD estimates that well over 80,000 contractors and subcontractors will need Level 2 or Level 3 certification. If you sell software into the defense supply chain, the odds that this applies to you are high.
Why cryptography is the hardest part of §3.13
The System and Communications Protection family (§3.13) is consistently one of the hardest for software vendors to pass. The reason is a distinction that sounds like semantics but decides the outcome.
Assessors separate an algorithm that is merely FIPS compliant from a cryptographic module that is formally FIPS validated under the Cryptographic Module Validation Program (CMVP). Compliant means you used an approved algorithm. Validated means an accredited lab tested the specific module, and CMVP issued a certificate for it.
Here is the trap. A vendor that built its own encryption using approved algorithms, without validating the module itself, fails the control. Implementation strength does not rescue it. “We use AES-256” is not evidence of compliance. A certificate number is the start of the answer. Four things have to line up: the certificate is active, not Historical (see below in the article); the validated version matches the version you deployed; your platform is inside the tested operational environment on the certificate; and the module is actually running in its FIPS-approved mode. FIPS-capable shipped in default configuration is the most common way a vendor with a real certificate still fails.
How CMMC 2.0 maps to cryptographic controls
This is the core reference section. The controls below are where software and cloud vendors most often find gaps, so treat each as a line item you need evidence for.
FIPS validated cryptography (§3.13.11)
Issue and manage certificates backed by FIPS 140-2 or 140-3 validated cryptographic modules wherever you protect CUI confidentiality. Validation attaches to a specific module version running in its approved mode, not to the algorithm. So “supports AES-256” proves nothing on its own. A CMVP certificate number does.
Cryptographic key establishment and management (§3.13.10)
Document how keys are generated, distributed, stored, and destroyed across your CUI boundary. This includes the application-layer keys living inside your software, not only the keys your infrastructure team manages.
Transmission and at-rest confidentiality (§3.13.8, §3.13.16)
Protect CUI in transit with certificate-backed TLS encryption. Protect CUI at rest with PKI-issued keys wherever your software persists it, including databases, caches, and object storage.
Device and user authentication (§3.5.1 to §3.5.4)
Replace shared passwords with certificate-based authentication for access to CUI-handling applications and services. Use replay-resistant authentication for network access to both privileged and non-privileged accounts.
Remote access session confidentiality (§3.1.13)
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. The position of NIST on this requirement points directly at FIPS-validated or NSA-approved cryptography, which means 3.13.11 rides along with it. In practice, mutually authenticated, certificate-backed VPN or equivalent for administrative access to your cloud-hosted software. Cryptographic asset inventory for assessment evidence
Maintain an inventory of the cryptographic algorithms and libraries embedded in your software. That inventory feeds your System Security Plan (SSP) and Plan of Action and Milestones (POA&M) evidence for C3PAO review.
Getting assessment ready: what a C3PAO will actually probe
A Level 2 assessment is an evidence exercise. The questions below mirror what an assessor works through, framed answer-first so you can score yourself quickly.
- FIPS validation evidence: Can you show that the modules protecting CUI, including those inside your own software, are formally validated?
- Key management documentation: Are generation, distribution, storage, and destruction procedures documented and followed per §3.13.10?
- CUI boundary encryption: Is CUI encrypted at rest and in transit across every boundary, including your software’s data stores and cloud environments?
- Device and user authentication evidence: Are unique, certificate-based credentials in place of shared passwords for systems that process CUI?
- SSP and POA&M accuracy: Does the SSP reflect implemented controls, with gaps tracked in a current Plan of Action and Milestones?
- Assessment-ready evidence package: Is your evidence current enough to withstand a full Level 2 assessment across all 110 controls?
If any answer is “not yet,” that gap belongs in your POA&M today, not in the room during the assessment.
The FIPS 140-2 sunset every vendor should be watching
One deadline deserves your attention now. On September 21, 2026, remaining active FIPS 140-2 certificates move to the CMVP Historical List, a status federal agencies should not include in new procurements. CMVP stopped accepting new FIPS 140-2 submissions in 2022, so this transition has been building for years.
The practical impact is timing. Validating a replacement FIPS 140-3 module takes between 18 and 30 months. A vendor without a current certificate risks being locked out of new federal business while validation is in progress. You cannot start this the quarter before an assessment.
Tie it directly to CMMC readiness. Identify which deployed modules sit on 140-2 versus 140-3, then document a migration plan now.
How Keyfactor can help
Keyfactor maps directly to the CMMC cryptographic controls above, so you can produce evidence instead of scrambling for it.
- Cryptographic asset inventory (AgileSec): Discover and inventory the algorithms and libraries embedded in your software for SSP and POA&M evidence.
- FIPS validated PKI (EJBCA): Issue certificates and manage keys through certificate authorities and HSMs backed by FIPS 140-3 validated modules, addressing §3.13.11.
- Signed build and release artifacts (SignServer and Signum): Sign container images, build artifacts, and patches deployed into the authorization boundary.
- Bouncy Castle: A FIPS 140-3 validated cryptographic module for application-layer cryptography.
- Key lifecycle management (Keyfactor Command): Centralize documented key generation, distribution, and destruction tied to a validated module, supporting §3.13.10.
The executive takeaway is simple. Consolidating certificates, keys, and signing operations into one system of record makes CMMC evidence faster to produce and consistent in front of an assessor.
Where to begin
Start with visibility, then move to control. The practical first steps are the same ones that make every later assessment easier:
- Gain visibility into cryptographic assets across your codebase and shipped products.
- Assess those assets against NIST SP 800-171 Revision 2 and FIPS requirements.
- Automate certificate and key lifecycles so evidence stays current on its own.
- Plan for post-quantum readiness while you are already modernizing your cryptography.
CMMC is not a one-time hurdle. It rewards vendors who treat cryptography as managed infrastructure, and it punishes those who treat it as an afterthought. Request a Demo
Got CMMC 2.0 questions? We’ve got answers.
Is CMMC 2.0 certification really required to win DoD contracts?
Under the DFARS final rule that took effect on November 10, 2025, CMMC status is a condition of eligibility for award. A contracting officer can require your current status before considering a bid. However, since Phase 2 is currently suspended, third party certification is currently paused pending review.
What is the difference between FIPS compliant and FIPS validated?
FIPS compliant means you used an approved algorithm. FIPS validated means an accredited lab tested a specific cryptographic module and CMVP issued a certificate. CMMC assessors require validation, not just compliance.
Which CMMC level applies to software and cloud vendors handling CUI?
Vendors that handle CUI typically need Level 2, which requires all 110 NIST SP 800-171 controls and is usually verified by a C3PAO every three years. Level 1 covers Federal Contract Information only.
Why is cryptography (§3.13) so hard to pass?
The System and Communications Protection family requires formally validated modules, not homegrown encryption built on approved algorithms. A vendor that validated the algorithm but not the module fails the control regardless of implementation strength.
What happens on September 21, 2026?
Remaining active FIPS 140-2 certificates move to the CMVP Historical List. Because validating a replacement FIPS 140-3 module takes between 18 and 30 months, vendors should identify affected modules and plan migration now.
Does CMMC apply to keys inside my application, not just my infrastructure?
Yes. CUI moves through application layers, so §3.13.10 covers key generation, distribution, storage, and destruction for application-layer keys inside the software itself, not only infrastructure keys.
What evidence will a C3PAO ask for?
Expect requests for FIPS validation certificates, documented key management procedures, proof of encryption at rest and in transit, certificate-based authentication records, and a current SSP with a matching POA&M.
How can Keyfactor help with CMMC readiness?
Keyfactor provides FIPS 140-3 validated PKI, centralized key lifecycle management, cryptographic asset inventory, and signing for build artifacts. Together they let you produce assessment evidence from a single system of record.
