Do you know how to document a FIPS-based Temporary Deficiency for your CMMC & NIST SP 800-171 compliance efforts?
At the end of April, we completed our Defense Industrial Base Cybersecurity Assurance Center (DIBCAC) Assessment as a C3PAO, which included claiming a Temporary Deficiency for 3.13.11, “Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.” We are using Apple iOS/iPadOS & MacOS plus Windows 11 devices that are technically not FIPS validated.
According to our DIBCAC assessors, we were the first C3PAO to present a Temporary Deficiency for FIPS related issues and they liked our method for meeting the intent of 32 CFR Part 170.
This “As the CMMC Churns” episode walks through the why we did what we did and how we documented our Temporary Deficiency. Bottom-line, we were MET on 3.13.11 and scored a 110 on our assessment.
.
Key CMMC Organizations
- National Archives & Records Administration Controlled Unclassified Information (CUI) Homepage
- DoD CIO’s Cybersecurity Maturity Model Certification (CMMC) Home Page
- Cyber Accreditation Body (Cyber-AB)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) Contractor Resource Page
- Defense Industrial Base (DIB) Cybersecurity Portal
Key Regulations
Key Acquisition References
- 48 CFR § 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems
- DFARS Clause 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls.
- DFARS Clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.
- DFARS Clause 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements
- DFARS Clause 252.204-7020 NIST SP 800-171 DoD Assessment Requirements.
- DFARS Clause 252.204-7021 Compliance with the Cybersecurity Maturity Model Certification Level Requirements.
