# Contractors Assess FIPS-Compliant SSH

A discussion about Windows SSH use for controlled unclassified information (CUI) raises whether the client’s cryptographic module must be FIPS-validated under the requirements applicable to a given CUI workflow. The post says Microsoft’s supplied SSH uses LibreSSL and that no applicable CMVP certificate was found; participants discuss SSH proxy or inspection, using a Linux virtual machine, or procuring a FIPS-capable Windows SSH client. They also note that a conventional bastion host does not address the Windows client’s first-mile cryptography. The discussion does not establish a universal requirement: the key determination is whether CUI is transmitted through that client and what rules apply to the system.

- Organizations should first map whether CUI passes through the Windows SSH client and identify the compliance requirements governing that specific workflow.
- If a FIPS-validated client is required, procurement teams can evaluate a FIPS-capable Windows SSH product, a Linux VM, or an SSH proxy/inspection design; a bastion host alone may not resolve the client-side issue.
- This creates a targeted software and architecture evaluation for contractors handling CUI, rather than evidence of a new government-wide mandate.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 22, 2026

### Vendors
- Microsoft (Provider of the Windows SSH client discussed)
- SSH.com (SSH Communications Security) (Provider of the PrivX Desktop SSH client mentioned)
- Palo Alto Networks ()
- Fortinet ()

### Key Quotes
> "Just" an SSH jump box (they're officially called bastion hosts, btw) doesn't close the first-mile problem of lacking a FIPS-validated Windows SSH client.
> — Community commenter

> Will CUI even be transmitted over the Windows SSH client?
> — Original poster

### Sources
- [Windows SSH Client FIPS?](https://www.reddit.com/r/CMMC/comments/1xcvq1q/windows_ssh_client_fips) - reddit-cmmc