Commercial National Security Algorithm Suite (CNSA) 2.0 ENF-SC12: ENF-SC12 Measure compliance in the RMF at SC-12 as NSA-approved, never as FIPS-validated

Authorizing officials measure CNSA compliance in the Risk Management Framework when assessing control SC-12 (cryptographic key establishment and management): CNSSI 1253 mandates the RMF for NSS and NSS require the NSA-approved selection, which unless NSA states otherwise includes the CNSA 2.0 algorithm requirements and all other NSA guidance on product validation and operation; NSS are not assessed against FIPS-validated in the RMF, solutions must be NSA-approved, and where a commercial product is accepted NSA generally approves CNSSP 11-compliant products correctly configured under CNSSP 15.