You’ve spent months preparing for your CMMC Level 2 assessment. Your policies are tight. Your IT team is ready. Your users have been trained. And then one item nearly derails the whole thing.
It’s more common than you’d think. Organizations that seem assessment-ready sometimes run into a single overlooked issue that can raise major concerns. One common example? Wireless access points that don’t meet Federal Information Process Standard (FIPS) 140-2 encryption standards.
Let’s break down why these issues matter, how they happen, and what you can do now to make sure small missteps don’t snowball into costly delays.
The Gotcha: FIPS Encryption in Transit
One of the key requirements in CMMC Level 2 is that Controlled Unclassified Information (CUI) must be protected in transit using FIPS-validated encryption. That includes any time CUI is moving whether through email, file transfers, or yes, even to a printer.
Here’s a common scenario: an organization has standard wireless access points (WAPs)—the kind that most Managed Service Providers (MSPs) install for small to mid-sized businesses. Those WAPs are great for convenience, but they aren’t FIPS-validated.
The kicker? If the organization could technically print CUI wirelessly, CUI could be transmitted over an unvalidated (and therefore non-compliant) network. That’s enough to trigger a finding from the assessor.
Why This Is a Big Deal
Many companies assume, in error, that if their wireless network is password protected or uses enterprise-grade security protocols like WPA2 or WPA3, they’re covered.
CMMC requires FIPS-validated encryption, specifically for the protection of CUI. If you can transmit or print CUI over a network even unintentionally and that network doesn’t use FIPS-compliant encryption, you’re out of compliance.
A Solution
When it comes to CMMC Level 2 assessments, quick thinking can make all the difference. In some scenarios, organizations avoid major disruptions not by overhauling infrastructure, but by reinforcing smart procedural controls.
If technical safeguards for wireless printing aren’t in place, assessors may raise concerns about how CUI is protected in transit. But there’s a practical way forward:
- First, organizations can revise their CUI Flow Procedures to clearly state that CUI must not be printed over wireless networks.
- Then, formal adoption can be documented such as having a CUI custodian acknowledge the updated policy.
- Finally, communicating the change organization-wide (via email or training) provides proof that users understand and are following the new guidance.
To be thorough, some teams also prep a technical contingency like disabling wireless printing on CUI-connected devices. This provides additional security in case procedural controls alone aren’t sufficient.
Clear policies and proactive communication can be powerful tools. But where technical controls are expected, it’s smart to have both technical and procedural safeguards working hand-in-hand.
What You Can Do Now to Stay Ahead of This
Audit Your Wireless Network
- Ask your MSP or IT provider: “Are our WAPs FIPS 140-2 validated?”
- If they say no—or don’t know—it’s time to dig deeper.
Review CUI Flow Diagrams
- Where does your CUI go?
- Can it be sent to a printer wirelessly?
- Are mobile or Bring Your Own Devices (BYOD) part of the equation?
Update Policies Proactively
- If you can’t fully lock down wireless printing right now, make it policy that CUI must not be printed wirelessly.
- Document the policy, communicate it to users, and get signatures confirming acknowledgment.
Train Your Users
- Cybersecurity isn’t just an IT issue. If your team doesn’t know how CUI is supposed to be handled, you’re already behind.
- Make sure your training covers physical printing procedures and reinforces policies like this one.
Plan for a POA&M If Necessary
- If you can’t technically comply today, develop a Plan of Action and Milestones (POA&M) showing how you’ll get there.
- Assessors appreciate transparency and progress planning, especially if the risk is being actively mitigated in the interim.
Alluvionic Has Your Back
At Alluvionic, we know the ins and outs of CMMC assessments, because we’ve been through it ourselves. We’re not just consultants; we’re a CMMC Level 2 Certified company with deep experience helping defense contractors navigate tricky compliance issues just like this one.
Whether you’re just getting started with your CUI flow mapping or need help identifying where your network might fall short, we’ll help you close those gaps before the assessor ever walks through your virtual door.
CMMC doesn’t leave room for “almost.” One wireless printer could be the difference between winning your next DoD contract or losing it. Let’s make sure you’re ready.
Need Help Reviewing Your Wireless Setup or Policies?
Reach out to Alluvionic today for a gap analysis and expert guidance through your CMMC journey. We’ll help you find the hidden gaps before they become expensive surprises.
About the Author
Sydney Wright is a project management professional with expertise in guiding organizations through complex cybersecurity frameworks such as CMMC and NIST SP 800-171. Leveraging her strong background in communications, she excels at translating intricate cybersecurity concepts into clear, actionable strategies. Passionate about the intersection of technology and effective communication, Sydney is dedicated to fostering collaboration, simplifying compliance, and delivering measurable results.
