CMMC 2.0 / NIST SP 800-171:
Cryptography for Software and Cloud Vendors in the Defense Supply Chain
| Region | United States (applies to any organization in the Defense Industrial Base handling DoD information, regardless of company size or whether the vendor is a prime contractor or a downstream subcontractor) |
| Applicability | Software and SaaS Providers to the DoD: any vendor that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on DoD contracts Cloud and Managed Service Providers: providers hosting CUI on behalf of DIB contractors, expected to meet FedRAMP Moderate equivalent protections C3PAOs and Assessors: third-party organizations accredited to conduct CMMC Level 2 certification assessments on behalf of the Cyber AB |
| Relevant sections | NIST SP 800-171 Rev. 2, §3.13: System and Communications Protection, covering cryptographic protection and key management NIST SP 800-171 Rev. 2, §3.5: Identification and Authentication DFARS 252.204-7021: CMMC certification requirements clause, effective November 10, 2025 |
Overview
CMMC 2.0 is the Department of Defense’s tiered verification program layered on top of NIST SP 800-171 Revision 2, replacing contractor self-attestation with independently assessed evidence that Controlled Unclassified Information is actually protected. The DFARS final rule implementing the program took effect on November 10, 2025, and rolls out in four phases through November 2028.
Level 1 (FCI only) remains a self-assessment against 15 basic safeguarding practices; Level 2 (CUI) requires implementation of all 110 NIST SP 800-171 controls, most commonly verified by a Certified Third-Party Assessment Organization (C3PAO) every three years; and Level 3 adds 24 enhanced requirements from NIST SP 800-172, assessed directly by DoD’s Defense Industrial Base Cybersecurity Assessment Center for the most sensitive programs. For software and SaaS vendors, CUI regularly passes through application layers, not just infrastructure, which pulls cryptographic controls into the scope of the software itself.
Why it matters
DoD estimates well over 80,000 contractors and subcontractors will need Level 2 or Level 3 certification, and CMMC status is now a condition of contract award: contracting officers can require a current CMMC status and a Supplier Performance Risk System score before a bid is even considered.
The System and Communications Protection family, §3.13, is consistently one of the hardest for software vendors to pass, because assessors distinguish sharply between an encryption algorithm that is merely FIPS-compliant and a cryptographic module that is formally FIPS-validated under CMVP. A vendor that built its own encryption using approved algorithms, without validating the module itself, fails this control regardless of how strong the implementation is.
How this maps to cryptography
CMMC 2.0 / NIST SP 800-171 addresses cryptography through several interlocking control areas. The key areas with direct cryptographic implications are:
| Section | Function | What it says | Supporting Products |
| §3.13.11 | FIPS-Validated Cryptography | Issuance and management of certificates backed by FIPS 140-2 or 140-3 validated cryptographic modules, not merely FIPS-compliant algorithms. | EJBCA |
| §3.13.10 | Cryptographic Key Establishment and Management | Documented key generation, distribution, storage, and destruction procedures across the full CUI environment, including application-layer keys inside the software itself. | Keyfactor Command |
| §3.13.8, §3.13.16 | Transmission and At-Rest Confidentiality | Certificate-backed TLS encryption for CUI in transit, with PKI-issued keys protecting stored CUI wherever the software persists it. | EJBCA |
| §3.5.1–3.5.3 | Device and User Authentication | Certificate-based authentication replacing shared passwords for access to CUI-handling applications and services. | Keyfactor Command |
| §3.13.7, §3.1.12 | Remote Access Session Protection | Mutually authenticated, certificate-backed VPN and remote session connections into CUI environments, including administrative access to cloud-hosted software. | EJBCA |
| Supports assessment objectives across §3.13 | Cryptographic Asset Inventory for Assessment Evidence | Inventory of cryptographic algorithms and libraries embedded in the software, supporting System Security Plan and POA&M evidence for C3PAO review. | AgileSec |
Audit readiness
Assessments and examinations, whether self-conducted, performed by a regulator, or reviewed by an independent assessor, focus on demonstrated evidence rather than policy statements alone. Key areas that examiners and assessors commonly probe:
- FIPS Validation Evidence: Can the vendor demonstrate that cryptographic modules protecting CUI confidentiality, including those embedded inside its own software, are formally FIPS 140-2 or 140-3 validated, not merely built on approved algorithms?
- Key Management Documentation: Are cryptographic key generation, distribution, storage, and destruction procedures documented and consistently followed per §3.13.10?
- CUI Boundary Encryption: Is CUI encrypted at rest and in transit across all system boundaries, including the software’s own data stores and any cloud environments it runs in?
- Device and User Authentication Evidence: Can the organization show unique, certificate-based credentials in place of shared passwords for systems and applications that process CUI?
- System Security Plan and POA&M Accuracy: Does the SSP accurately reflect implemented cryptographic controls, with any gaps tracked in a current Plan of Action and Milestones?
- Assessment-Ready Evidence Package: Is evidence organized and current enough to withstand a full Level 2 third-party assessment covering all 110 controls?
TAKE THIS TO MANAGEMENT
CMMC 2.0 ended the decade in which we could self-attest to NIST SP 800-171 compliance. Since November 10, 2025, Level 2 requires an independent C3PAO to verify all 110 controls, including FIPS-validated cryptography and documented key management, before we can sell CUI-touching software into DoD contracts. Losing that certification means losing contract eligibility outright.
The gap that most often fails a software vendor’s assessment is the same one: cryptography that is compliant with approved algorithms but was never run through CMVP validation. If our application encrypts CUI using a library we built or bundled ourselves, without a validated module behind it, we do not pass §3.13.11, no matter how sound the implementation is. That is a solvable gap if we close it now, and an expensive one if we discover it mid-assessment.
Related Compliances
Federal Risk and Authorization Management Program (FedRAMP)
