. "Agencies employing data encryption within any IT system, including mobile devices, must comply with the FIPS 140-2 specifications or demonstrate that they have sufficient security provisions in place to protect their data." . . .