Your company signs that its encryption meets the rules. Can you prove it?

Where a Defense Department contract requires CMMC, a company without the required CMMC status is not eligible for the award. CMMC is the Defense Department’s cybersecurity check. (Source: the contract rule DFARS 252.204-7025.)

Most contractors are not there yet.

• The government says so. In its 2024 CMMC rule, the Defense Department wrote that government audit reports and its own analysis “have shown that the DIB has not consistently implemented the NIST SP 800-171 requirements” (the security rules defense contractors must follow). (The DIB, or defense industrial base, is the companies that supply the Defense Department.)
• Contractors say so. In a 2026 survey of 302 U.S. defense contractors, conducted by Merrill Research for a cybersecurity firm, only 1% said they are completely ready for CMMC certification, and confidence in the accuracy of their own security scores fell from 89% in 2025 to 65% in 2026.
• The inspectors found it. In the Defense Department’s own published data from 117 of its in-depth assessments of contractors between 2019 and 2022, certified (FIPS-validated) encryption was the requirement most often found not satisfied: at about half of the companies assessed. (Source: Defense Contract Management Agency, “Top ‘Other Than Satisfied’ Requirements from DIBCAC High Assessments”, December 2022.)

A score your own company doubts is still a score a senior manager signed.

Defense contracts require encryption (the way your computers scramble sensitive information) that the government has tested and approved. We show which of your systems use approved encryption, which do not, and give you the proof behind what your company signs.

Under CMMC’s self-check, the person who signs is your own senior manager, not an outside inspector. And the approvals keep changing: on 21 September 2026 a large group of older approvals moved to the government’s “Historical” list. It is not the last: 48 more follow through 2027, on NIST’s record as of 14 September 2026.

No installer. No agent. No service. Nothing sent. Unzip a folder, read the scripts, run them, delete the folder.

What the government requires, what your company must do, and what we provide

1: What the government requires

If your company receives CUI on a Defense Department job, your contract’s cybersecurity clause requires those files to be protected with encryption that holds a FIPS certificate whenever they are sent or stored outside your company’s protected systems.

2: What your company must do

• Meet the rules, and sign for them. Every contract with the cybersecurity clause requires your company to follow the security rules. Where your contract includes CMMC, your company also scores itself, posts the score in SPRS (the Defense Department’s supplier database), and a senior manager signs that it is true, and renews that signature every year.
• Check whether your contract asks for it. U.S. Army Corps of Engineers (USACE) construction job postings now include CMMC Level 2 (Self): the level where your company checks itself. Check whether yours does. If it does, your own senior manager signs the statement.
• Hand the signature up the chain. Where the CMMC clause is in the contract, the prime contractor above you must get that signed statement from you before awarding your subcontract, and every year after.
• Be ready to show it. The government can still come and check what you signed.
• Lead it from the top. This is bigger than the IT department. For a small company’s CMMC self-assessment itself, the Defense Department’s own cost estimate budgets a director for 52 hours and an outside expert for 88 hours, and an in-house IT specialist for less than five minutes. (Source: the CMMC rule, 89 FR 83183, small-entity Level 2 self-assessment estimate; hours added up from its three phases.)
• Know that a gap can cost you. If some of your encryption has no certificate, it can count against your company’s security score. Writing it into your plan of action only helps if you can back it up.

3: What we provide

The proof behind what your company signs:

• Which of your systems use encryption that holds a FIPS certificate, which do not, and what each certificate’s government record says.
• How big any problem is, out of all your systems.
• For each gap, where a fix stands, and the letter asking the software maker to confirm it in writing, with a place to record the answer.
• Draft entries for your plan of action, for you to finish and approve.
• Your progress, the next time you run it.
• Every certificate number, so anyone can look it up on NIST’s website.

Encryption is one of the security rules defense contractors sign for. AGILICRYPT™ FIPS CertStanding™ does the hard part and gives you the proof behind what your company signs, with a clear plan for every gap, ready for your team to finish. It is not just a report: it is a tool that gives your IT team a clear plan for every gap and the proof behind its work. For a problem that can cost defense contractors contract awards and millions of dollars in settlements.

What we never do: tell you that you are compliant, or how an inspector will score you. Those are the inspector’s decision and your company’s signature. And a draft only counts once your company finishes and approves it.

Sources: DFARS 252.204-7012 and NIST SP 800-171, requirement 3.13.11; the Defense Department’s CMMC Level 2 Assessment Guide (version 2.13), which limits the certificate requirement to information sent or stored outside the protected environment; 32 CFR 170.22 (the CMMC signature, renewed yearly) and DFARS 252.204-7021(d)(4) (the prime collects it), both only where the contract includes CMMC; and the CMMC rule, 32 CFR Part 170, on how security requirements are scored.

The situation

On 21 September 2026, NIST moved every remaining FIPS 140-2 certificate to its Historical list. Those certificates no longer carry standing for new federal procurement. That happened. It is not a date ahead of you.

Federal agencies are directed not to include those modules in new procurements. Your systems keep running: nothing switches off, and continued use is permitted on a documented assessment of where and how each module is used. What changes is your standing at the next contract action.

Most organizations find out during that contract action, because nobody maintains a map from deployed software to CMVP certificate numbers. It changes every time a vendor re-validates.

Source: NIST CMVP FIPS 140-3 Transition Effort. The date appears on every FIPS 140-2 certificate as its Sunset Date.

Why this is a contract problem, not a curiosity

A Department of Defense contract involving CUI carries DFARS 252.204-7012, which requires NIST SP 800-171, which requires FIPS-validated cryptography. On 21 September 2026 the certificates behind that cryptography moved to the Historical list.

Most companies in the defense industrial base need CMMC Level 2, which is built on 800-171. CMMC Phase 1 is running now, November 2025 to November 2026, so the FIPS deadline lands in the middle of it. Organizations are self-assessing against 800-171, and posting the score to SPRS, at the moment the validations they depend on stop counting for new procurement.

In fairness, the part of this that cuts against us: CMMC Phase 2 was suspended on 13 July 2026, so the third-party assessment that was due to appear in contracts from 10 November is not coming on that date. On 3 September DoD’s class deviation 2026-O0025 (Revision 3) let contracts require CMMC Level 1 or Level 2 (Self) and suspended the November Phase 2 transition, and a reform task force is expected to report in late September or early October. What did not change is everything the FIPS date touches: self-assessment, DFARS 252.204-7012 and NIST SP 800-171 all remain in force. Checked 15 September 2026 (reporting, DoD CIO) CMMC.

Free, instant, and nothing is sent to us: the lookup runs in your browser against USAspending.gov.

The other exposure: what you sign to win the work

Not being selected is the common outcome. It is not the only one. To win federal work you make statements (a representation of compliance, a score posted to SPRS, an answer on a prime’s questionnaire), and those statements go to the government, or to somebody passing them to the government.

The exposure there is not weak encryption. It is affirming something that turns out not to be true, usually because nobody in the building actually knew. Of the eight Justice Department cybersecurity settlements we read, from March 2025 to September 2026, all concerned security requirements that were not met or were misrepresented. Some of these are among the largest names in defense and technology, with large security teams, and it still happened. That’s because a senior manager signs, so it’s a leadership and contract issue. Encryption is one of the security rules defense contractors sign for. A documented gap, with a plan and a date, is a defensible position. An affirmation nobody can evidence is a different thing entirely.

Which is why we will not tell you that you are compliant. That is your assessor’s determination and your own affirmation. What we do is make sure the affirmation you sign is one you can evidence, and say plainly where the record does not settle it.

A description of a public enforcement record, not legal advice, and not a statement about your exposure. If any of it looks close to your situation, that is a conversation for your counsel.

What you get

What a report actually says

There are three honest answers, and we give whichever is true.

1: You have exposure

2 of your 5 systems rely on cryptographic modules that no longer hold federal procurement standing.

Each one named, with its certificate number and what to ask the vendor.

2: You have no validated cryptography at all

No FIPS-validated cryptographic module was identified in this estate.

Nothing expires, because nothing currently holds standing. If a contract requires validated cryptography, that gap is live today rather than in September: a larger problem, and a different conversation.

3: Your input cannot answer the question

This inventory cannot answer the question.

Some inventories structurally cannot show the exposure. We tell you that instead of returning a clean-looking result that means nothing.

Rather than take our word for any of that, see what a report gives you, or book a call and we will walk you through a full example.

How it works

1. Check that it applies to you. Run the free lookup above, and read what your report shows, section by section, in plain words. The only question that matters is whether any contract you work under requires FIPS-validated cryptography. If none does, this is not for you and we would rather say so here than on a call.
2. Confidentiality is already in force. Our terms contain a mutual NDA that binds us from the moment you accept them: nothing to sign, and no week waiting on two legal teams.
3. You get the tool. Collectors, the assessment tool and a dated copy of the NIST record, licensed to you for the year. Run it on your own machines and nothing leaves your network. It reads the exports you already have (ServiceNow, Intune, SCCM, Tanium), or a spreadsheet: the software list, and each machine’s operating system and version.
4. You produce the report. Run the tool and it is written in minutes, on your own machine. It states the date of the NIST record it was checked against.
5. We walk you through it on a call. Including the limits page. It comes with pre-written language for your contracting officer.

What we don’t do

• We don’t install anything. No installer, no service, no scheduled task, nothing written to Program Files or the registry, and no administrator rights needed to produce the report. The bundle is a folder: unzip it, run it, delete it. Nothing is left behind and nothing keeps running afterwards.
• We don’t scan your network. No agents, no credentials, no connections in.
• You can read the collectors before you run them. They are plain PowerShell, a few hundred lines, and they collect a software list: package name, version, machine. Nothing else: no certificates, no keys, no user data. Your administrator should read them, and we wrote them expecting exactly that.
• We don’t receive your data. The tool runs on your machines and nothing comes to us, not the inventory and not the finished report. If you want a second read, we do it on a call while you share your screen.
• We don’t tell you that you are compliant. We assess certificate standing. Compliance is your contracting officer’s determination.
• We don’t publish accuracy figures. We give you numbered certificate records instead, each traceable to the public register.
• We don’t ask you to take our word for it. The assessment is deterministic: the same inventory, assessed against the same dated NIST record, produces the same report (the same document, months later). It records the exact version of every input it used, so an auditor can reproduce the result rather than trust it. That is unusual, and it is the reason we can stand behind findings without ever holding your data.

Run it yourself

Many organizations cannot release an asset inventory. For a defense contractor it is often CUI, and DFARS 252.204-7012 requires CUI to stay in systems meeting NIST SP 800-171. Asking you to upload it to an ordinary website could put you in breach of your own contract.

So the whole assessment runs on your side of the boundary, never ours. We never ask for your inventory.

We send you the collectors, the assessment tool and a dated copy of the NIST record. You run all of it on your own machines. Nothing leaves your network. If you want a second read, we do it on a call while you share your screen, and nothing is sent to us.

Why this is the opposite of the usual approach

Tools in this category generally work by deploying something into your estate: a sensor installed from a package, an appliance stood up as a virtual machine with a port open back to a collection hub, or an analyser that attaches to running processes to watch which cryptographic calls they make. Those are capable products and this is not a criticism of them, but each is a thing your security team has to approve, deploy, monitor and eventually decommission, and none of them is something they can read first.

We are not a lighter version of that. We are the other posture. You already have an inventory, and the assessment is a calculation over it. So there is nothing to deploy, nothing to watch, and nothing to remove afterwards. If you have no inventory to hand, the collectors write one, and you can read every line of them before they run.

To be straight about it: open-source scanners are readable too. They probe a server and report which post-quantum algorithms it will negotiate, which is a different question from which of your deployed components rely on a certificate that no longer carries standing. We know of no other tool that is readable, installs nothing, sends nothing, and answers that second question.

About the collectors

There are three: one for Linux and Unix, one for a single Windows machine, and one your administrator points at a list of Windows hosts. Each writes the same CSV.

They are deliberately unsophisticated, and that is the point:

• Nothing is ever sent to us. None of the three contains any code capable of reaching the internet. They write a file; you decide what happens to it.
• The two single-machine collectors make no network connection at all. Not restricted, not sandboxed (absent). The multi-machine one necessarily reaches the hosts your administrator names, using Windows’ own remote management, inside your own network.
• No agent, no service, no install. Nothing is left running and nothing persists after they exit.
• No credentials stored, and no changes made. They read; they do not write to your systems.
• Short enough to read before you run them. Plain text, a couple of minutes each. Your security team should read them: we wrote them expecting exactly that.

You are never obliged to run one. An export from ServiceNow, Intune, SCCM, Tanium or Jamf works as it comes, and so does a spreadsheet.

Check it yourself, in about a minute

Every vendor says their tool sends nothing home. Here is how to check ours, on the copy in your hands, without an account, a call with us, or anything to install. Open a Command Prompt in the folder holding RUN-ME.cmd.

First, which bundle are you holding?

dir agilicrypt-cmvp.exe

If that file is listed you have the compiled build, and the three source searches below will return nothing because the folder they search does not exist, which proves nothing at all. Skip to “If you have the compiled build”. If it says File Not Found you have the source build and every check below applies as written.

We put that question first because a check that appears to pass for the wrong reason is worse than no check.

Is there any code here that can open a connection?

findstr /S /I /M /C:"urllib.request" /C:"import socket" /C:"http.client" /C:"import requests" tool\*.py

Nothing comes back. Every route Python has to the network goes through one of those, and none of them is in the bundle. We do have a module that fetches the public NIST record (it is how we build the dated snapshot in data\), and it is removed from every bundle before it ships. Confirm with dir /s /b tool\*fetch*: File Not Found. The certificate data was assembled before the bundle was made, so there is nothing to look up and no way to look it up.

Is there an address of ours to call?

findstr /S /I /M /C:"//agilicrypt" tool\*.py collect\*.ps1

Nothing. Not “we choose not to”: there is no address in there to contact.

Can the collectors reach the internet?

findstr /S /I /M /C:"Invoke-WebRequest" /C:"Invoke-RestMethod" /C:"WebClient" /C:"DownloadString" collect\*.ps1

Nothing. Those are how PowerShell fetches something from the internet, and none appears in any collector.

And afterwards: did it install anything? This is the claim on this page that is easiest to make and least often checked, so check it. Run the tool, produce a report, then ask Windows:

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall /s /f AGILICRYPT
sc query AGILICRYPT
schtasks /query /tn AGILICRYPT
dir "%ProgramFiles%\AGILICRYPT*"

0 match(es) found, the specified service does not exist, cannot find the file specified, File Not Found. Nothing in Add or Remove Programs, no service, no scheduled task, nothing under Program Files, and no Run key. The whole product is the folder you unzipped. Delete it and the machine is exactly as it was, not uninstalled, because nothing was installed.

That is not restraint on our part; there is no installer to restrain. It is also why a hardened estate can block the collectors outright (execution policy, AppLocker, constrained language mode), and why we state that as a limitation rather than hide it: a tool that installs nothing has nothing to fall back on.

Two things a looser search will turn up, and we would rather tell you first. support@agilicrypt.com appears in two files: an address printed on screen for a person to read; the tool sends no mail and contains no mail code. And the word “socket” appears once, inside a comment showing an example line of dpkg output that reads Secure Sockets Layer toolkit. You will also find urllib.parse imported, which is Python’s string handling for URL text (it decodes file:/// paths inside SBOM documents and opens nothing). The module that opens connections is urllib.request, which is what the first check looks for.

If you have the compiled build. The engine is agilicrypt-cmvp.exe, native code with its own runtime inside it. You cannot read it, and we are not going to pretend otherwise. Three things are still true and all three are checkable.

• The collectors are unchanged, and they are what actually runs on your servers. They are plain PowerShell in every build, and the third check above works exactly as written.
• Prove the behavior instead of reading the code. Pull the network cable, or run it on an air-gapped machine, and produce a full report: it works, because nothing in the assessment needs a network. Or add an outbound firewall rule denying agilicrypt-cmvp.exe and watch the report come out identical. For a binary that is stronger evidence than reading imports: it tests what the program does rather than what its source suggests.
• One thing you will find, and we would rather say it first. The bundled runtime includes _socket.pyd, the standard Python networking extension. Every Python runtime on Windows ships it. It is there because the interpreter is bundled whole, not because our code uses it: the module that does reach the network is excluded at compile time, so it was never built in rather than merely left unused.

Why compiled at all? To make our component-to-certificate mapping harder to lift wholesale: the one part of this that took years rather than weeks. Not to hide anything from you, and the distinction is worth being exact about: the collectors are what run on your servers, they are plain PowerShell in every build, and you can read every line of them. What is compiled is the engine that reads the result afterwards.

The same checks run in our build, so a later version cannot quietly gain the ability to phone home. But you should not have to trust that either: the commands above are yours, they run on your copy, and they do not depend on us at all. Every bundle ships them as VERIFY-IT-YOURSELF.md, with the same warning about the two bundle shapes that you just read.

Who this is for

Anyone whose obligations reach a validated cryptographic module, and that is wider than federal contracting, though federal is where it bites first and hardest.

Selling to the US federal government

• Defense subcontractors, tier 2 and 3
• Federal systems integrators
• Software vendors on GSA or SEWP schedules
• Managed service providers running federal workloads

The rule is NIST SP 800-171 control 3.13.11: use FIPS-validated cryptography to protect CUI, the government’s term for sensitive data that is not classified. It reaches you through DFARS 252.204-7012, the clause in your contract, so it is a term you signed rather than guidance you may weigh.

Healthcare, through breach notification rather than compliance

HIPAA has a breach-notification safe harbour: if stolen patient data was properly encrypted, it is not a reportable breach. What counts as properly points at NIST-approved encryption: in practice, a validated module. The question is not whether you are fined. It is whether a lost laptop is a non-event or a notifiable breach, and that can turn on the standing of the certificate behind the encryption you already have.

Payments, at the hardware

The PCI rules, the card industry’s own security standard, let you protect PIN data with either a FIPS-validated HSM (a tamper-proof box that holds encryption keys) or a PCI-approved one. Many estates took the FIPS route, and a FIPS certificate has an end date whichever industry relies on it.

Anyone who signs code delivered into a national security system

CNSA 2.0 is the NSA’s list of approved algorithms for systems handling classified or sensitive government data. It sets 1 January 2027 for code and firmware signing to use quantum-resistant algorithms only, and expects new equipment bought for those systems to comply from the same date. A supplier who signs what it ships is inside that whether or not it thinks of itself as a defense contractor.

Anyone buying hardware or software that will outlive the transition

A firewall, an HSM or a storage array bought this year is still in service in 2030. “FIPS 140-3 validated” on a datasheet is a category, not a date, and 63 of the active certificates stop counting within two years of the September cliff. Checking what you plan to buy is part of what our report covers.

Who it is not for: anyone with no FIPS requirement at all. If nothing you sign, store or process reaches a validated module, none of this affects you, and we would rather say so on a website than on a call.

Pricing

Sales are paused while we complete a review. Talk to us and we will tell you when they reopen.

To see what you get before you buy, talk to us or read what your report shows.

The full license: $5,000 for twelve months

$5,000 for twelve months. One price, for the tool and every report it produces on your own machines during the year.

The year includes unlimited runs against your own estate and email support. No per-system charge, no seat count, and no price that varies with the size of your estate. Card or invoice. It does not renew automatically: we write to you before it ends.

Before you buy, four questions

If any answer is no, email us instead of paying: we would rather have the conversation than the refund.

• Does any contract or program you work under require FIPS-validated cryptography? If not, this genuinely does not affect you and we will say so.
• Can you export a list of installed software, or run a script on your own machines? Three columns is enough: package, version, and an identifier if you have one. Without one of those we have nothing to assess.
• Are you assessing servers, workstations or network devices, rather than an application’s own libraries? A list of npm or Maven dependencies structurally cannot answer this question.
• Is the inventory you would use current? The report is only ever about the estate your export describes. A list from eighteen months ago produces an accurate assessment of a network you no longer run, and the tool cannot tell, because an export does not carry the date it was taken. That one is on you, and it is worth checking before you pay rather than after. If your last export is stale, run a collector instead; it takes minutes.

There is no software prerequisite. The tool carries everything it needs: no runtime to install, no version to check, no administrator rights to produce the report. The one thing we cannot fix from our side is an inventory that does not exist, which is what the second and fourth questions are about.

See it before you buy it

See what a report gives you, from the first plain answer to the fix list and the draft plan-of-action entries. On a call, we will walk you through a full example.

Four steps at your own pace: read the inventory, build the report, see the four answers the tool is allowed to give, including the two that decline, and the commands that prove it never touches the network. The other page walks the same ground in plain words.

Prefer to be walked through it? Pick a time that suits you. We will tell you plainly if this does not apply to you.

Who decides what

Four parties settle whether your cryptography survives an assessment, and we are only one of them. We are not a testing laboratory and not a C3PAO, and we do not tell you whether you are compliant: that is your assessor’s call and your affirmation. What we do is produce the evidence, independently and early enough to act on.

The questions we refuse are worth as much as the ones we answer: an assessor who catches a single row claiming coverage the record does not support stops trusting the whole document, and is right to.

Not the person who signs?

Most people who find this page are not the one who approves the spend. There is a one-page briefing written for whoever is: what the deadline means for a contract, what it costs to meet it late, and what the decision actually is. No jargon, no certificate numbers, and it prints cleanly.

Questions

Get in touch

Email us and tell us your situation. We reply the same day.

Useful things to include: your company, whether any contract requires FIPS-validated cryptography, and roughly how many systems are in scope. Nothing sensitive, and confidentiality is already in force under our terms.