# NIST 800-171 3.13.11 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

- Source: https://support.icompaas.com/support/solutions/articles/62000229252-nist-800-171-3-13-11-employ-fips-validated-cryptography-when-used-to-protect-the-confidentiality-of-c
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

Cryptography can be employed to support many security solutions including the protection of controlled unclassified information, the provision of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances for such information but lack the necessary formal access approvals. Cryptography can also be used to support random number generation and hash generation. Cryptographic standards include FIPS-validated cryptography and/or NSA-approved cryptography. See \[NIST CRYPTO\]; \[NIST CAVP\]; and \[NIST CMVP\].

  

**Priority**: Medium

  

**Category**: Network Security 

  

**Services Associated with AWS:**

1.  AWS Key Management Service (KMS)
2.  AWS CloudHSM
3.  Amazon S3

  

**Objective Evidence:**  

-   Administrative: documented policies, standards & procedures  
    
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations  
    
-   Technical: screen shot of configuration settings  
    
-   Technical: screen shot of cryptography in use 

  

Possible Technology Considerations : 

-    Secure Baseline Configurations (SBC)
-   Cryptographic Solution (data in transit)

  

**What needs to be answered?**

Is FIPS-validated cryptography used to protect CUI? Do communication cryptographic mechanisms comply with applicable policies, standards, and guidance?  

-   FIPS-Validated Cryptography Check
    
    Description: This check ensures that Federal Information Processing Standards (FIPS)-validated cryptography is employed when used to protect the confidentiality of Controlled Unclassified Information (CUI). The check verifies that the cryptographic solutions employed meet FIPS standards and are used appropriately for data encryption, digital signatures, information separation enforcement, random number generation, and hash generation.
    
-   NSA-Approved Cryptography Check  
    Description: This check ensures that National Security Agency (NSA)-approved cryptography is utilized as per organizational requirements. The check verifies that cryptographic methods used are approved by the NSA and are properly implemented for the relevant security solutions, including data encryption, digital signatures, and information separation enforcement."  
      
    

**More Details:**

FIPS validated cryptography used for all systems containing CUI.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.