How is Athena different from Secureframe, Strike Graph, Paramify, Risk Cognizance, SMPL-C, or Kiteworks?

Those platforms optimize the contractor's readiness workflow — live SPRS tracking, AI controls dashboards, fast SSP/POA&M drafting, continuous control monitoring, LLM document analysis, or CUI data movement. Athena adds the assessor-facing submission layer that almost none of them ship: SAR narrative drafting, eMASS-ready JSON packaging, OSCAL output, and cryptographic provenance (SHA-256 + chain-of-custody) for every artifact a C3PAO or DIBCAC assessor opens on engagement day.

Does Athena replace Secureframe, Strike Graph, or Paramify?

No — Athena is the assessor-side submission layer that sits on top of whatever readiness GRC you already use. Bring evidence from any tool; Athena drafts the SAR, generates the POA&M with prioritized remediation, scores SPRS, and exports eMASS / OSCAL packages with provenance.

What does Athena export for a CMMC Level 2 assessment?

SAR draft with citations, POA&M with milestone estimates, SPRS scoring package, eMASS-ready JSON, OSCAL package, evidence binder with SHA-256 hashes, and a chain-of-custody manifest signed for the assessor.

What does CMMC 3.13.11 require?

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. "FIPS-validated" means the cryptographic module carries a CMVP certificate (FIPS 140-2 or 140-3) and is operated in its FIPS-approved mode.

Is 'FIPS-compliant' the same as 'FIPS-validated'?

No. 'Compliant' is a vendor marketing claim. 'Validated' means the module appears on the NIST Cryptographic Module Validation Program (CMVP) list with a certificate number. Only validated modules satisfy 3.13.11.

Does TLS 1.2/1.3 on its own satisfy 3.13.11?

Not by itself. The TLS implementation must use a FIPS-validated cryptographic module in FIPS mode. Both endpoints handling CUI must use validated crypto, and the configuration must restrict to FIPS-approved cipher suites.

CMMC 3.13.11 (FIPS-Validated Cryptography): Evidence & What Assessors Actually Check

Control: NIST SP 800-171 Rev. 2 §3.13.11 · CMMC Practice: SC.L2-3.13.11 · Updated June 2026

Plain-English answer

3.13.11 says: when you use cryptography to protect the confidentiality of CUI, the crypto module must be FIPS-validated — and operated in its FIPS-approved mode. Not "FIPS-compliant," not "uses AES-256." Validated, with a CMVP certificate number you can cite.

The "validated vs. compliant" trap

This is the #1 way 3.13.11 fails. Vendors say "FIPS-compliant" to mean "uses FIPS-approved algorithms" — but the module itself was never validated by an accredited lab. DIBCAC will ask for the CMVP certificate number. If you can't produce one, you fail the objective, regardless of which algorithm is in use.

Control lineage

CMMC Practice: SC.L2-3.13.11
NIST 800-171 Rev. 2: §3.13.11 — employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
NIST 800-171A objectives: [a] FIPS-validated cryptography is identified; [b] FIPS-validated cryptography is employed to protect the confidentiality of CUI.
Standard: NIST CMVP — FIPS 140-2 (legacy) and FIPS 140-3 (current).

Where 3.13.11 applies (CUI confidentiality paths)

Data at rest on endpoints and servers holding CUI (full-disk encryption, database/file encryption).
Data in transit over untrusted networks (TLS to mail, file shares, web apps; SSH; VPN/IPsec).
Removable media containing CUI.
Backups of CUI systems.

What the assessor will EXAMINE

An inventory of every place CUI is encrypted, with the cryptographic module and CMVP certificate number for each.
Configuration evidence that the module is operated in FIPS mode (registry/policy/sysctl as applicable).
TLS configuration showing only FIPS-approved cipher suites are negotiated.
SSP narrative for 3.13.11 listing each crypto use and the validated module behind it.

What the assessor will INTERVIEW

"Show me the CMVP certificate for the module encrypting CUI at rest." — produce the cert number and link to NIST's CMVP listing.
"How do you know FIPS mode is on?" — point to the policy/registry/build configuration that enforces it.
"What happens if a non-FIPS cipher is requested?" — demonstrate it's rejected.

What the assessor will TEST

Negotiate TLS against a CUI-handling endpoint and verify only FIPS-approved suites are offered.
Inspect a sample endpoint to confirm FIPS mode is enabled (e.g., fips_enabled = 1 on Linux, FIPS policy enabled on Windows).
Spot-check a sample backup or removable-media artifact for validated encryption.

Evidence examples (produce these)

Crypto-module inventory table: location → module name → CMVP cert number → FIPS-mode evidence.
Screenshots/configuration of FIPS mode enabled on endpoints, servers, and network devices touching CUI.
TLS cipher-suite scan output (e.g., sslscan, testssl.sh) showing only FIPS-approved suites.
Backup configuration showing validated encryption.
SSP §3.13.11 referencing each row of the inventory.

Platform-specific

Microsoft GCC High: Windows in FIPS-mode policy, BitLocker with FIPS-validated module, Azure services with FedRAMP High + CMVP-listed modules.
Google Workspace: Workspace uses FIPS 140-2 validated BoringCrypto — cite Google's published CMVP certificates and Assured Workloads / CJIS-aligned controls. For CUI on personal devices accessing Workspace, the endpoint module must also be validated.
Linux endpoints / servers: RHEL/UBI in FIPS mode using the validated OpenSSL/Kernel Crypto module — cite the matching CMVP certificate for the OS version in use.

Common failure patterns

"FIPS-compliant" in a vendor data sheet — no CMVP certificate to back it.
FIPS mode is supported but not enabled in production.
TLS endpoint negotiates non-FIPS cipher suites alongside the approved ones.
Module is validated for one OS version but you've upgraded past it — the certificate no longer applies.
Backups encrypted with a non-validated tool.

SPRS impact & POA&M

SPRS: not meeting 3.13.11 is a 5-point deduction. POA&M: a frequently-cited example of a requirement that cannot be POA&M'd — encryption of CUI is foundational. Confirm against current CMMC rules, but plan to be fully met by assessment day.

Assessor-ready summary

You're good on 3.13.11 when every CUI-touching crypto use maps to a named module with a CMVP certificate number, FIPS mode is provably enabled, TLS negotiates only approved suites, and the SSP lines up with the inventory.

Map your 3.13.11 cryptographic evidence the way an assessor reads it. Get a FIPS evidence map →

Athena prepares organizations for CMMC Level 2; certification rests with C3PAOs/DIBCAC. Verify all control facts against NIST SP 800-171 Rev. 2, NIST SP 800-171A, the NIST CMVP listing, and current CMMC rules.