After 21 September 2026, NIST's CMVP places FIPS 140-2 validated modules on its Historical list. Agencies can keep using them for existing systems only. New federal work should rely on modules validated under FIPS 140-3, so check which validation your cryptographic library actually holds.
The timeline from the CMVP page
The Cryptographic Module Validation Program is run by NIST and the Canadian Centre for Cyber Security. Independent labs accredited under NVLAP test modules and CMVP reviews the results. The program's own timeline states:
- 22 September 2020: FIPS 140-3 submissions began
- 22 September 2021: no new FIPS 140-2 validation certificates
- 21 September 2026: modules stay on the Active list until this date, then move to Historical
- After that date, agencies may keep using Historical modules for existing systems only
The page also advises agencies to keep using FIPS 140-2 modules until FIPS 140-3 replacements are available. Read that as a transition note, not a loophole for new designs.
What FIPS 140-3 is
The FIPS 140-3 page says the standard became effective on 22 September 2019 and supersedes FIPS 140-2 in its entirety. It points to ISO/IEC 19790 for the requirements and ISO/IEC 24759 for testing.
Three things to check in your product
- Which module do you call? Find the exact library and version that does encryption, hashing and signing in your build, not just the algorithm names.
- What is its certificate status on the CMVP site? Look for the certificate number and whether it is Active or Historical.
- Do you ship the module as validated? A validation covers a specific module in a specific operational environment. Rebuilding it yourself can void the assumption.
Write the answers in a table and keep it next to your SBOM. The dependency list tells you which libraries are present. It does not tell you which are validated.
FedRAMP and crypto module rules
FedRAMP published RFC-0035 on 14 October 2026 about cryptographic module use rules. The RFC text says it does not change agency obligations under FIPS 140-3 and does not set post-quantum requirements. It proposes defining "CMVP-Validated Module" as one with an active validation or an update stream of one. Treat it as a proposal and check the final rule before you plan around it.
What this does not mean
It does not mean existing deployments must be torn out on a set date. The CMVP wording is about the list status and use for existing systems. Contract language and agency policy decide what you must do, so confirm with your sponsor.
Quick check
Does the Historical list ban FIPS 140-2 modules?
Not outright. The CMVP page says agencies may keep using them for existing systems only.
Can I validate a new module under FIPS 140-2 now?
No. The CMVP page says it stopped accepting FIPS 140-2 submissions for new validation certificates on 22 September 2021.
Safeguard's SBOM and dependency scanning lists the crypto libraries in your builds so you can match them to certificates. You can try a free scan at gold.safeguard.sh/scan.
Sources
- NIST CMVP overview and FIPS 140-2 timeline
- FIPS 140-3 standards page
- FedRAMP home page, RFC-0035 listing
- FedRAMP RFC-0035
Last reviewed: 19 October 2026.
