FIPS 140-3 + CMMC: The On-Premises Guide for Defense Manufacturers

FIPS 140-3 establishes federal security requirements for cryptographic modules. CMMC and NIST SP 800-171 require FIPS-validated cryptography when cryptography protects the confidentiality of CUI, so contractors need to confirm that the cryptographic technology they deploy carries an appropriate validation and operates within its approved configuration.

Yes, when cryptography protects the confidentiality of CUI. The requirement applies to the cryptographic protection, so simply enabling encryption does not establish compliance. The organization must use validated cryptography where the requirement applies.

Yes. Certain WatchGuard Firebox models can support CMMC Level 2 and NIST SP 800-171 requirements when they use the correct FIPS-validated hardware, firmware, and configuration. WatchGuard Fireboxes can provide the network segmentation, access controls, logging, VPN protection, and FIPS-validated cryptography needed within a properly designed CUI environment.

For modern deployments, the hardware and firmware combination matters. CompassMSP’s FIPS 140-3 guidance identifies supported WatchGuard Firebox models running Fireware v12.11 and subsequent v12.11.x minor releases as the appropriate validation track. FIPS mode must also be enabled, and the firewall configured with approved cryptographic algorithms, key lengths, VPN settings, and administrative controls.

A WatchGuard firewall alone does not make an organization CMMC or NIST SP 800-171 compliant. Compliance depends on how the entire CUI environment is scoped, configured, documented, monitored, and maintained. For organizations pursuing CMMC Level 2, the firewall often serves as a critical enforcement point for defining and protecting the compliance boundary.

FIPS 140-2 certificates remain active through September 21, 2026. NIST moves all remaining FIPS 140-2 certificates to the Historical List on September 22, 2026. NIST notes that historical modules may continue in existing systems, while federal agencies determine their transition policies.

WatchGuard currently supports FIPS 140-3 with Fireware v12.11.x on the listed Firebox T Series and M Series models. Organizations should confirm the exact hardware model and Fireware version against WatchGuard’s current FIPS support documentation before deployment.

No. WatchGuard states that FIPS mode does not support WatchGuard Cloud management, visibility, monitoring, or logging. Administrators manage the Firebox locally through the Fireware Web UI or the CLI.

WatchGuard requires administrators to enable FIPS mode through the Fireware CLI with the fips enable command. The Firebox immediately reboots and runs its required FIPS self-tests. Administrators can verify the operating state with the show fips command.

The Firebox records an error and shuts down if a required startup self-test fails. WatchGuard does not allow the appliance to continue operating in that failed FIPS state.

A CMMC enclave is a defined environment that isolates CUI-handling users, systems, and workflows from general corporate operations. The architecture helps contractors apply strict controls to the environment where CUI exists, rather than automatically pulling every business system into the same scope.

A provider-owned model places the compliance environment on infrastructure controlled by the service provider. A customer-owned model places the environment under the contractor’s control, with the contractor retaining the infrastructure, administrative rights, credentials, and portability needed to change providers without surrendering the environment itself.

The boundary should account for systems, users, assets, and workflows that process, store, or transmit CUI, along with relevant security protection assets and services that support that environment. The correct boundary depends on the organization’s architecture and CUI data flows.

DoD suspended implementation of Phase II on July 13, 2026 and currently remains in Phase I. Under the current model, Level 2 uses a self-assessment every three years against the 110 NIST SP 800-171 Revision 2 requirements, with annual affirmation. The suspension did not eliminate the underlying requirement to protect CUI.

Look for a provider that can connect compliance requirements to the systems your business actually uses. Evaluate who owns the enclave, who holds administrative credentials, how the provider documents privileged access, how it staffs support, whether it understands the correct FIPS validation track, and how it manages evidence and change control. A Cyber AB Registered Practitioner Organization provides implementation consulting but does not conduct certified CMMC assessments.