FIPS 140 used to be required only for technology companies that sold their software to the federal government. With CMMC, the FIPS 140 requirement applies to every member of the DIB that handle CUI. Any system that performs encryption and touches CUI must use FIPS validated cryptography. Traditional FIPS 140 validations can take as long as two years.