What a Cryptographic Inventory for CMMC Control 3.13.11 Actually Costs

Summary

CMMC control SC.L2-3.13.11 requires FIPS-validated cryptography wherever cryptography protects the confidentiality of CUI. The only evidence that proves it is an item-by-item list of the cryptographic modules in the CUI boundary, each matched to a CMVP certificate, a version, an operational environment and an approved-mode configuration. No consultancy we could find publishes a price for building that list, and the cryptography share of a standard gap assessment (about 3 to 9 percent of the work, derived below) is enough to mark the control "not met" but not enough to build the inventory behind it.

This advisory sets out the tasks, the hours per unit and the arithmetic. For a contractor under 50 employees the initial inventory and mapping is about 80 hours, or $12,000 to $32,000 at market consulting rates; for 50 to 250 employees, about 180 hours, or $27,000 to $72,000. A yearly refresh runs about 37 percent of the initial effort. Every figure is cited or derived from arithmetic shown here. The model is a planning estimate, not a quote.

1. The rule and the score

• 32 CFR 170.24(c): "FIPS-validated encryption (CMMC Level 2 security requirement SC.L2-3.13.11) is required to protect the confidentiality of CUI. If encryption is employed, but is not FIPS-validated, three (3) points are subtracted from the maximum score; if encryption is not employed; five (5) points are subtracted from the maximum score." [1]
• 32 CFR 170.21 governs POA&Ms. The rule states that 3.13.11 "may be included on a POA&M if encryption is employed and is not FIPS-validated," and that POA&M items "must be remedied within 180 days." DoD adds that "FIPS module validation can exceed the 180-day CMMC assessment POA&M threshold" and that vendor limitations "could be considered enduring exceptions or temporary deficiencies." [1]
• The DoD Assessment Methodology sets the evidentiary standard: "Simply using an approved algorithm (e.g., FIPS 197 for AES) is not sufficient - the module (software and/or hardware) used to implement the algorithm must be separately validated under FIPS 140." [2]
• Since 21 September 2026 every FIPS 140-2 certificate is on the CMVP Historical List, including Microsoft's Kernel Mode Cryptographic Primitives Library (#4766). NIST supports continued use in existing systems; the evidence file still has to record the new status (see HARDAC-ADV-2026-01). [3][4][5]

The control cannot be proven from a policy or a screenshot of "FIPS mode enabled." It is proven module by module.

2. Why gap assessments undercount cryptography

No published source breaks out the cryptography share of a CMMC engagement. It can be derived from the scoring weights [Derived, from source 2]:

The 313 total is the sum of point values across the 110 requirements in the DoD methodology, whose scores run from 110 down to -203 [2]. The range is about 3 to 9 percent. Applied to what the market sells [Derived]:

• DoD's cost model for a small entity's Level 2 self-assessment budgets 88 external service provider hours at $260.28 (32 planning, 48 conducting, 8 reporting), assuming the controls are already implemented [1]. A 3.4 to 9.3 percent share is 3.0 to 8.2 hours, or $790 to $2,120.
• Market gap assessments run from about $3,500 to $20,000 (vendor claim) [6]; one RPO publishes a Level 2 gap assessment at $21,200 [7]. The cryptography share is about $120 to $1,970.

Three to eight hours is enough to ask whether FIPS mode is on and record "not met," not to enumerate every module and look each one up. That is consistent with DIBCAC's report at the September 2022 CyberAB town hall that 3.13.11 was the most common "other than satisfied" practice, failed by half of the companies with any top-ten finding (secondary source) [8].

3. The task list and the arithmetic

An inventory for 3.13.11 is a sequence of manual tasks. Tools shorten the first two; they do not shorten the rest. OMB describes the federal manual inventory as "researching each piece of hardware and software to discover the type of cryptography used," and notes that automated tools "may not identify all instances." [9]

Hours per unit [Derived; our estimates, calibrated in Section 5]

Scope assumptions by band [Derived]

Worked example, under 50 employees. Typical uses the scope midpoint and the per-unit midpoint: scoping 6 + discovery 6 + builds 4.5 × 1.0 = 4.5 + appliances 5.5 × 1.25 = 6.9 + services 25 × 0.1 = 2.5 + certificates 30 × 0.05 = 1.5 + applications 14 × 1.0 = 14 + cloud 2 × 3 = 6 + CMVP 18.5 × 0.875 = 16.2 + deliverables 13 = 76.6 hours; plus 10 percent = 84.3, rounded to 80. The low case (every count and rate at its low end) is 42.5 × 1.1 = 47 hours; the high case is 118.5 × 1.1 = 130.

Certificate hours in the larger bands use the stepped rate (1,150 certificates = 300 × 0.05 + 850 × 0.02 = 32). The two largest lines in every band are application review and CMVP mapping, the two that tooling does not remove.

4. The cost by size band

Rate tiers [Derived from sources 1, 6, 7, 10, 11]

Initial inventory and CMVP mapping [Derived: Section 3 hours × rate]

For scale, DoD's model prices an entire small-entity Level 2 self-assessment with its initial affirmation at $34,277 [1], and SBA puts total compliance cost per certification for self-assessing small firms at $388,600, with no breakdown [12]. A real 3.13.11 inventory for an under-50 contractor is close to DoD's whole assessment budget, which is why it is seldom built in full.

5. Cross-checks against published prices

Published offerings are post-quantum readiness assessments, not 3.13.11 packages, and none includes per-module CMVP mapping or SSP evidence. Converted to hours at the central and low rates [Derived]:

6. The yearly refresh

Certificate status changes without notice to the contractor: CMVP keeps modules Active for five years (two for interim validations) [3], OS patches move systems off the validated version, and the 140-2 sunset changed every 140-2 status on one day. The refresh model [Derived]: 25 percent of scoping; 50 percent of discovery, service and certificate work; 25 percent of OS, appliance, application and cloud review; 0.25 hour per module to re-verify status; full remapping for 20 percent module churn; 40 percent of deliverables; plus 10 percent.

That is 36 to 39 percent of the initial hours. The first refresh after September 2026 is heavier: if every module needs remapping rather than 20 percent, the under-50 refresh rises from 30 to about 44 hours (27.4 − 3.2 + 16.2 = 40.4, plus 10 percent).

7. What makes the number move

• Module count. Each additional ten distinct modules adds 7.5 to 10 hours, $1,900 to $2,500 at the central rate. Consolidating OS builds and appliance models is the cheapest lever.
• Application count. Application review is the largest line in every band (14 of 84 hours under 50; 260 of 1,410 over 1,000). Each CUI application removed from the boundary saves about an hour.
• Enclave scoping. Holding the fixed lines (scoping, discovery, deliverables: 25 hours under 50) and halving every count-driven line gives 50.8 × 1.1 = 56 hours, 30 percent less [Derived].
• Existing tooling. Discovery, service triage and certificate review are 10 of 84 hours under 50 but 469 of 1,410 over 1,000. Tooling matters at scale and barely at all for small firms.
• Rate tier. $150 to $400 is a factor of 2.67 on the same hours; the hours range within a band is a factor of about 2.8. Scope uncertainty moves the number as much as the rate does.
• In-house staffing. In-house labor is $81 to $97 an hour, but GAO found 18 of 24 federal agencies "reported a lack of expertise in cryptography and developing related inventories," 19 used no automated tools and 23 had no documented maintenance process [17]. The model applies no expertise penalty, so in-house hours are likely understated.

8. Questions and answers

9. Steps

1. Count distinct modules, not devices; the module count drives the mapping cost. Get it before asking for quotes.
2. Ask any bidder for hours by task against Section 3. A fixed price that cannot be decomposed this way is a readiness scan, not a 3.13.11 inventory.
3. Budget the yearly refresh as a line at roughly 37 percent of the initial effort.
4. Record the 140-2 Historical position in the SSP now; it is the part an assessor looks at first.

10. What this does not cover

Remediation costs (enclaves, GCC High licensing, replacing unvalidated products), discovery tool licenses, C3PAO fees, a vendor's own FIPS validation, post-quantum migration beyond the inventory, and legal exposure under the annual affirmation. The hours model is our estimate, calibrated against Section 5, not measured from a published dataset, because none exists. UK prices are comparators, not US market prices. Vendor-claimed rates are marked as such; the government figures and published price lists are the hard data.

About HARDAC

HARDAC Industries LLC is a managed security services provider and compliance consultancy, in business ten years, delivering ISO/IEC 27001 and NIST Risk Management Framework consulting and managed security operations to defense contractors and commercial clients. This advisory is general guidance, not legal advice or an assessment finding; contractors should confirm each module's status against the CMVP list and their own assessor's expectations.

Change log

• 1.0, 27 October 2026: first publication.