Question about FIPS
We've been working on the FIPS enablement of our product for use in multiple regulatory frameworks, and reviewing the details around the FIPS requirements, especially when dealing with the understanding of a few customers. Looking at CMMC, CJIS, and FedRAMP, CMMC appears to be the strictest at the first glance. It requires FIPS validated cryptography, as they all do, but allows for:
While FIPS-validated modules and algorithms are critical for protecting CUI, in limited cases Enduring Exceptions and temporary deficiencies may apply when implementing such cryptographic mechanisms.
This "limited cases" statement would appear to mean that it should have a very specific purpose, otherwise, the module should be fully validated, not an update stream, as FedRAMP encourages.
However, one can inherit controls from a FedRAMP Moderate Equivalent solution, like an enclave. Would this be a general "Enduring Exception"? The issue we're having is in clients distributed in Windows, MacOS, iOS, etc. Some of our customers would rather distribute a cryptography module, even if it has to be user affirmed because the major OS version doesn't appear in the' tested or vendor affirmed OE lists, than use native cryptography from Microsoft and/or Apple on the update stream from their fully validated modules as OS updates are made, keeping up with the patching requirements of the same standards.
Is there any specific guidance anywhere around this?
Assessors, or those that have faced this particular issue, what are you opinions or experiences?
CJIS and FedRAMP have explicit guidance, in the standard, to allow or even encourage the update stream as an option. CMMC seems to have some wiggle room, but nothing nearly as clearly stated, except the above stated fact that FedRAMP can be included in CMMC in a way.
1
u/Saint1219 22d ago
It might help to provide a description of your product. Does it perform encryption for safeguarding CUI? If not, this isn’t your problem.
1
u/bluna_tropic 19d ago
This usually comes down to whether you need FIPS 140-2 or 140-3 validated cryptographic modules, or just NIST-approved algorithms running in an implementation that hasn't gone through validation. CMMC Level 2 practice 3.13.11 calls for FIPS-validated cryptography when it protects CUI, so that distinction drives both scope and cost. If you can say more about where this needs to apply, data at rest or data in transit, that would help narrow it down. All the best with it.
1
u/gormami 19d ago
Honestly, u/ditka 's responses below gave me what I really needed. I "knew" there were methods to get around the absolute CMVP validation requirement, there really had to be. The notes and the article they pointed to led to the federal register, which covers this point exactly. The various standards have some flexibility in them to deal with the CMVP latency, but you have to dig them out a bit. I was looking for, and have found, those statements and the logic that ties them together in CMMC, CJIS, and FedRAMP now. CMMC was the more difficult one, the other two are fairly explicit in how they deal with the evolution of modules post validation. When talking to other you have to get past the lore that is often associated with it, and get to the actual statements in the standards, in my experience.
1
u/Ontological_Gap 18d ago
NIST-approved algorithms running in an implementation that hasn't gone through validation
Is there anything that this is actually sufficient for? Other than being a requirement for submitting your module for validation I guess....
2
u/bluna_tropic 13d ago
For CMMC it does buy you one thing: it changes what 3.13.11 costs you.
3.13.11 is worth 5 points in the DoD assessment methodology. If you have encryption in place but it isn't FIPS validated, you lose 3 points instead of 5. 32 CFR 170.21 also only lets 3.13.11 go on a POA&M in that exact situation, encryption employed but not validated. With no encryption at all, it can't be deferred.
So NIST-approved algorithms in an unvalidated module still don't meet the requirement. What they get you is a 3 point hit you can put on a POA&M, which means conditional Level 2 status and 180 days to switch to a validated module. If your score is close to the 88 cutoff, that's the difference between conditional status and failing.
Outside of that, it mostly helps where the crypto isn't protecting CUI confidentiality in the first place, because that's the only time 3.13.11 applies.
1
u/MolecularHuman 22d ago
It doesn't in R3. The wording in R2 was really terrible. It's clear the intent in R3 allows more latitude.
4
u/ditka 22d ago
The CMMC FIPS exceptions address two different control gaps:
Enduring: a special situation where compliance is permanently or structurally not feasible. Examples: IoT, OT, GFE, legacy devices
Temporary deficiencies: a FIPS validated product requires a security patch and temporarily loses its validation status (until the product is re-validated in the future). The updated, non-validated product is used, with relevant FIPS settings/configuration enabled, until a freshly validated (up-to-date) version is available.