Status: in development, coming to GCC High
FIPS support is being built for GCC High deployments, where CMMC and CUI workloads most often require it. Until it ships there is no FIPS setting to turn on in Atlas AVD, and the Atlas Fortify section that will hold the session-host controls appears in the console only as a Coming soon teaser.
If your compliance program needs FIPS 140 validated cryptography, contact Atlas support. We can share the current roadmap and tell you when FIPS support is available for your GCC High deployment.
Planned: session-host FIPS Mode (control 3.13.11)
Session-host FIPS enforcement is planned as an optional baseline control in Atlas Fortify. It will enable the Windows FIPS local security policy on session hosts, restricting cryptographic algorithms to FIPS-validated implementations, and drift monitoring will report hosts that fall out of line with your baseline.
Enabling Windows FIPS mode can break applications that use non-FIPS algorithms. When the control ships, verify application compatibility on a test host pool before enforcing it estate-wide.
Planned: FIPS-compliant session encryption (control 3.13.8)
A related Session Encryption control is planned to set the RDP encryption level for AVD sessions to the FIPS-compliant level and enforce TLS 1.2 or later, so you can require FIPS-validated cryptography end to end.
CMMC mapping
Session-host FIPS Mode is planned as Atlas's implementation of CMMC practice SC.L2-3.13.11: "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI." Once it ships, the control's evidence and drift findings will roll into your compliance reporting.
FIPS for the Atlas application itself
Atlas's encryption design already uses FIPS-approved primitives (AES-256-GCM and PBKDF2-SHA256) in every deployment. FIPS support for the application will add a GCC High deployment shape in which a CMVP-validated FIPS crypto provider performs them, and Atlas refuses to start unless the runtime is genuinely in FIPS mode rather than silently falling back to non-FIPS crypto. A FIPS deployment will be updated by deploying a new container image rather than through in-app updates.