Password managers for CMMC, checked for FedRAMP and FIPS
Published 2026-10-22
A password manager is the one tool in a small shop that holds the keys to everything else: the firewall admin login, the file server, the CAD license portal, the email tenant. NIST SP 800-171 asks that passwords be stored and sent only in cryptographically protected form IA.L2-3.5.10, that every network login use more than one factor IA.L2-3.5.3, and that any cryptography protecting CUI be FIPS-validated SC.L2-3.13.11.
The CMMC rule names "passwords that grant access to the in-scope environment" as Security Protection Data, so the vault is inside your assessment either way. Whether it also needs FedRAMP depends on one thing: whether CUI goes in. We read four vendors' own pages, the FedRAMP Marketplace and NIST's certificate list against both cases. If you have not drawn your boundary yet, start with the CMMC scoping worksheet.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Keeper
The only one of the four with its own FedRAMP Certified listing (High) and an active FIPS 140-3 certificate in its own name, plus US-citizen support for the government edition.
Read the Keeper notesBitwarden
Run it on your own servers inside the boundary, with an active FIPS 140-3 certificate since 2026-08-27. Its cloud is not on the Marketplace yet.
Read the Bitwarden notes1Password
If CUI never goes in, the vault is a Security Protection Asset, and enforced two-factor, an offboarding routine and an exportable audit log cover what gets checked.
Read the 1Password notes
Four vaults against the rule
Rows inside the boundary are what the rule asks of a vault that protects your CUI environment; the FedRAMP row binds only if CUI goes in. Rows outside it are conveniences. Vendor words were read on each vendor's own pages, FedRAMP on the Marketplace and FIPS on NIST's certificate list, all on 2026-10-22.
| What the rule asks | Keeper | 1Password | Bitwarden | LastPass |
|---|---|---|---|---|
| Inside the boundary | ||||
| FedRAMP Moderate or higher, needed only if CUI goes into the vaultDFARS 252.204-7012(b)(2)(ii)(D); 32 CFR 170.19(c)(2) | Certified (High) | Not in Marketplace | Not in Marketplace | Not in Marketplace |
| Cryptographic module with an active FIPS 140 certificate on NIST's listSC.L2-3.13.11 | Active cert #4976 (140-3) | No certificate found | Active cert #5507 (140-3) | No certificate found |
| Admin can require multifactor authentication for every userIA.L2-3.5.3 | Enforced by role | Enforce stated | Policy stated | MFA policies stated |
| Suspend a leaver and keep the credentials they heldPS.L2-3.9.2 | Vault transfer stated | Stated | Revoke stated | Offboarding stated |
| Audit log you can export or stream to a SIEMAU.L2-3.3.1, AU.L2-3.3.2 | SIEM export stated | Export and SIEM stated | Export and SIEM stated | Export and SIEM stated |
| US hosting and a US-person support path, for shops with ITAR data22 CFR 120.50, 120.62 | US citizens stated | US region stated | US region stated | Not stated |
| Outside the boundary | ||||
| Self-hosted option on your own servers | Not stated | Not stated | Stated | Not stated |
| Stores passkeys | Stated | Stated | Stated | Stated |
| Free family plan for staff | Stated | Stated | Stated | Stated |
What the words mean
- MeetsCertified (High)Active cert #4976 (140-3)Enforced by roleVault transfer statedSIEM export statedUS citizens statedStatedEnforce statedExport and SIEM statedActive cert #5507 (140-3)Policy statedRevoke statedMFA policies statedOffboarding stated
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialUS region stated
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot statedNot in MarketplaceNo certificate found
- Not stated in what we read. Ask the vendor in writing before you rely on it.
Does a password manager need FedRAMP?
People search for a "FedRAMP password manager", but the rule asks for FedRAMP only when CUI goes into a vault that runs in someone else's cloud. What decides it is the CMMC rule's own definition of the data a vault holds.
Under 32 CFR 170.19, a cloud provider holding Security Protection Data but no CUI is scoped as a Security Protection Asset: it goes in your asset inventory, your SSP and your network diagram, and it is assessed against the Level 2 requirements relevant to what it does. FedRAMP enters only on the CUI row.
| If the vault holds | In the vendor's cloud | Self-hosted on your servers |
|---|---|---|
| Passwords, keys and MFA seeds for in-scope systems, nothing else | Assessed as a Security Protection Asset, against the Level 2 requirements relevant to what it does. No FedRAMP test. | The same: a Security Protection Asset inside your scope. |
| Also CUI: a drawing attached to a login, a controlled spec pasted into a note | The provider must meet the FedRAMP requirements of DFARS 252.204-7012: FedRAMP Moderate, or equivalent to it. | A CUI asset on your own servers, assessed against all Level 2 requirements. |
| Only passwords for systems outside your boundary | Not an External Service Provider under CMMC; out of scope. | Out of scope, if nothing in it reaches the boundary. |
FIPS follows the same line. Requirement 3.13.11 asks for FIPS-validated cryptography "when used to protect the confidentiality of CUI"; 3.5.10 asks only that passwords be stored and sent cryptographically protected, and names no standard. Once CUI is in the vault, the scoring rule is blunt: encryption that is not FIPS-validated costs 3 points, no encryption costs 5. A prime's questionnaire may ask for a certificate number even for a passwords-only vault, so a validated module is the cheaper argument to win. Where a provider is not on the Marketplace, the DoD CIO memo of 2023-12-21 sets the bar for equivalency: 100 percent of the FedRAMP Moderate baseline, assessed by a FedRAMP-recognized 3PAO, with the body of evidence handed to you. The full test is in FedRAMP Moderate equivalency explained.
Check the claims yourself
Two rows in the table come from registers, not from vendors: FIPS 140 status from NIST's Cryptographic Module Validation Program, and FedRAMP status from the FedRAMP Marketplace. A vendor page that says "FIPS compliant" or "built to FedRAMP standards" is not either one. Here is what the registers showed on 2026-10-22, and how to read them yourself in five minutes.
| Vendor | Certificate | Module | Standard | Status | Validated | Sunset |
|---|---|---|---|---|---|---|
| Keeper | #4976 | Keeper Security Cryptographic Module v2 | FIPS 140-3 | Active | 2025-02-27 | 2029-07-28 |
| Keeper | #3976 | Keeper Security Cryptographic Module | FIPS 140-2 | Historical | 2021-07-12 | Moved to historical (sunset) |
| Bitwarden | #5507 | Bitwarden Cryptographic Module | FIPS 140-3 | Active | 2026-08-27 | 2029-08-26 |
| 1Password, LastPass | No certificate on the active, historical or revoked lists, and none in process, under AgileBits, 1Password, LastPass, GoTo or LogMeIn. | |||||
- Open NIST's validated-modules search and type the vendor's legal name in Vendor (AgileBits for 1Password). The basic search shows the active list only; the advanced search adds historical and revoked certificates.
- Open the certificate. Read Standard (140-2 or 140-3), Status and the Sunset Date. NIST says a Historical module should not go into an agency's new procurement; hold a vendor to the same.
- Read the Caveat. Both active certificates above say the module is validated "when operated in approved mode" or limit what is assured, so ask the vendor how its apps run the module.
- Match the module name to the product. A vendor may build on a module made by someone else; the certificate is still real, but it is not in the vendor's name.
- Write the certificate number and the date you read it into your SSP, next to SC.L2-3.13.11 if CUI is in the vault, or next to IA.L2-3.5.10 if it is not.
The Marketplace has its own trap: it carries two Keeper listings. FR2116544598A, Keeper ICAM & Identity Security Platform for Government, is FedRAMP Certified at Class D (High), certified since 2025-12-18, with seven authorizations. The older FR2116544598, the Government Cloud Password Manager package, shows "FedRAMP In Process" as of 2022-04-28 at Class C (Moderate). Cite the first one in your SSP. Bitwarden, 1Password and LastPass have no listing of their own; Bitwarden says it is pursuing Class D (High) for its cloud. NIST's search and the Marketplace are both free and need no account.
Check your own vault
Buying the right product is half of it. The other half is the handful of settings an assessor reads in the vault itself, each tied to a requirement with a point value. Tick what is true of your vault today and the check tells you how it is scoped, what the open items cost against the 110-point maximum, and which ones the rule will not let you park on a plan of action.
Password vault check for CMMC, cuideck.com
Pre-filled with a typical first vault in a small shop Example only. Change it to match yours; the scope, the points and the SSP entry follow.
Scope. A Security Protection Asset: in your asset inventory, SSP and network diagram, assessed against the Level 2 requirements relevant to it. 32 CFR 170.19 asks no FedRAMP test.
- IA.L2-3.5.3, 3 points: fix before the assessment
- IA.L2-3.5.7, 1 point: may go on a POA&M
- IA.L2-3.5.8, 1 point: may go on a POA&M
- PS.L2-3.9.2, 5 points: fix before the assessment
- AU.L2-3.3.1, 5 points: fix before the assessment
Only 1-point gaps, and 3.13.11 when you encrypt without FIPS, may wait on a POA&M (32 CFR 170.21). The 3 gaps marked "fix before the assessment" cannot.
SSP entry
Password manager: 1Password. Runs on: The vendor's cloud.
Contents: Passwords, keys and MFA seeds only.
Scoping: A Security Protection Asset: in your asset inventory, SSP and network diagram, assessed against the Level 2 requirements relevant to it. 32 CFR 170.19 asks no FedRAMP test.
FedRAMP: Not in Marketplace (FedRAMP Marketplace, read 2026-10-22).
FIPS 140: No certificate found (NIST CMVP, read 2026-10-22).
MFA (IA.L2-3.5.3): required for admins and remote users only.
In place: IA.L2-3.5.10; AC.L2-3.1.5; AU.L2-3.3.2.
Open: IA.L2-3.5.3 (3 pt, fix before assessment); IA.L2-3.5.7 (1 pt, POA&M allowed); IA.L2-3.5.8 (1 pt, POA&M allowed); PS.L2-3.9.2 (5 pt, fix before assessment); AU.L2-3.3.1 (5 pt, fix before assessment).The leaver line is the one small shops skip. NIST's discussion of 3.9.2 lists hardware tokens and keys among the property to recover when someone leaves; a vault full of shared logins is the same thing in software. Suspending the account is not enough: change every shared password the person could see, starting with admin and vendor-portal logins. 1Password's own offboarding steps put "change passwords" between suspending and deleting the account; Bitwarden documents a revoke step, Keeper a vault transfer for a terminated user, and LastPass offboarding driven from your user directory. Put the routine in your written policies with the CMMC policy templates, and paste the SSP entry above into the asset section of your SSP template. To see what the open points do to your whole score, run them through the SPRS score calculator.
The vendors, one by one
Keeper
What it is. A zero-knowledge password manager with a separate government edition, Keeper ICAM & Identity Security Platform for Government, hosted in AWS GovCloud. That edition, not the commercial vault, is the one on the FedRAMP Marketplace, and Keeper says its customer success team for it is made up of US citizens with no support from outside the US.
Who it fits. A shop that may one day keep CUI or ITAR data in the vault, or whose prime asks for a FedRAMP listing and a FIPS certificate by number, and is willing to buy the government edition rather than the commercial one.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or higher, needed only if CUI goes into the vault | Certified (High) |
| Cryptographic module with an active FIPS 140 certificate on NIST's list | Active cert #4976 (140-3) |
| US hosting and a US-person support path, for shops with ITAR data | US citizens stated |
Checked on keepersecurity.com, 2026-10-22
1Password
What it is. A password manager whose Business plan adds policies (enforced two-factor authentication, account password rules, sign-in limits), an audit log you can export, and an Events API that feeds a SIEM. Accounts on 1Password.com keep their data in the United States.
Who it fits. A shop that keeps only passwords and keys in the vault, never CUI, and wants the admin controls an assessor checks to be simple to switch on.
| What the rule asks | What we found |
|---|---|
| Admin can require multifactor authentication for every user | Enforce stated |
| Suspend a leaver and keep the credentials they held | Stated |
| Cryptographic module with an active FIPS 140 certificate on NIST's list | No certificate found |
Checked on support.1password.com, 2026-10-22
Check with the vendor before you buy.
Bitwarden
What it is. An open-source password manager you can use in Bitwarden's cloud (Microsoft Azure, US or EU) or run yourself on your own server in Docker containers. Bitwarden says it is actively pursuing FedRAMP Class D (High) for its cloud, and that many agencies reach compliance today by self-hosting it on their own infrastructure.
Who it fits. A shop with an enclave or on-premises servers that wants the vault inside its own boundary, so the FedRAMP question never comes up and the vault is assessed with the rest of its systems.
| What the rule asks | What we found |
|---|---|
| Self-hosted option on your own servers | Stated |
| Cryptographic module with an active FIPS 140 certificate on NIST's list | Active cert #5507 (140-3) |
| FedRAMP Moderate or higher, needed only if CUI goes into the vault | Not in Marketplace |
Checked on bitwarden.com, 2026-10-22
Check with the vendor before you buy.
LastPass
What it is. A password manager whose Business plan offers more than 100 security policies (password rules, access controls, MFA), user groups, directory-driven onboarding and offboarding, exportable audit reports and SIEM integration.
Who it fits. A shop already on LastPass that keeps only passwords in it and needs to show an assessor the policies and reports, not move platforms tomorrow.
| What the rule asks | What we found |
|---|---|
| Admin can require multifactor authentication for every user | MFA policies stated |
| Audit log you can export or stream to a SIEM | Export and SIEM stated |
| Cryptographic module with an active FIPS 140 certificate on NIST's list | No certificate found |
Checked on lastpass.com, 2026-10-22
Check with the vendor before you buy.
How we read the vendors
Questions small shops ask
Is any password manager CMMC compliant?
Not as a product. CMMC assesses your company, not the tools it buys; a vendor page that says "CMMC compliant" means the product can be set up to meet the requirements it touches. What you can check is what the table checks: a FedRAMP listing where CUI is involved, a FIPS certificate on NIST's list, and the admin settings an assessor will open.
Do I need the FedRAMP edition if the vault only holds passwords?
Not under the CMMC rule. Passwords that grant access to in-scope systems are Security Protection Data, and a cloud provider holding them without CUI is assessed as a Security Protection Asset, with no FedRAMP test. Two reasons to buy it anyway: your prime or contract asks for it, or you cannot be sure CUI will stay out of the vault.
Is a FIPS 140-2 certificate still good enough?
Read the Status, not the number. An Active certificate is on the validated list the day you check; a Historical one is not, and NIST says a Historical module should not go into an agency's new procurement. Keeper's older 140-2 certificate, #3976, has been moved to the historical list for sunsetting; its current one, #4976, is 140-3 and Active.
Can we keep ITAR technical data in the password vault?
Keep it out. If it goes in, the ITAR carve-out for encrypted data needs end-to-end encryption with FIPS 140-2 or successor modules (or at least AES-128 strength) and no storage in a proscribed country, and letting a foreign person see it decrypted is a release under 22 CFR 120.56. No product is ITAR certified; Keeper says the support team for its government edition is US citizens, the most any vendor here states. The guide to ITAR compliance covers the rest.
Does the password manager still matter while Phase 2 is suspended?
Yes. The suspension stops contracts from adding third-party Level 2 and Level 3 assessments. A Level 2 self-assessment can still be required, and DFARS 252.204-7012 with NIST SP 800-171 Rev 2 still applies, so the vault settings above are scored either way. What still applies today.