FIPS, the Federal Information Processing Standards, are US government standards. The one most buyers ask about is FIPS 140-3, which sets security requirements for cryptographic modules. A product is "validated" only when the module has a certificate from the Cryptographic Module Validation Program. "FIPS compliant" or "FIPS ready" is a weaker claim and proves nothing on its own.
What is FIPS 140-3?
FIPS 140-3, Security Requirements for Cryptographic Modules, is based on ISO/IEC 19790 and ISO/IEC 24759. NIST says it must be used when designing and implementing cryptographic modules that federal agencies operate, or that operate for them under contract. It defines four increasing, qualitative levels of security.
The requirements cover the module's specification, interfaces, roles and authentication, software and firmware security, operating environment, physical security, management of sensitive security parameters, self-tests, life-cycle assurance and mitigation of other attacks. So the standard is about the module doing cryptography correctly, not about whether a whole product is secure.
Who validates a module?
The Cryptographic Module Validation Program (CMVP) is a joint effort of NIST and the Canadian Centre for Cyber Security. Independent testing laboratories, accredited by NVLAP, verify that each module meets the testable requirements, and the CMVP reviews and validates each submission.
Some dates, from the CMVP page as fetched on 18 October 2026:
- The CMVP began validating to FIPS 140-3 on 22 September 2020.
- It stopped accepting new FIPS 140-2 submissions in 2022, with limited exceptions.
- FIPS 140-2 validated modules could be used for new systems until 21 September 2026. After that date they move to the Historical list, which agencies may use for existing systems only.
- FIPS 140-3 modules go on the Active list for five years, or two for interim validations.
So for a new federal procurement today, a FIPS 140-3 certificate is what to look for.
What is the difference between validated and compliant?
A constructed example: two vendors answer the same questionnaire.
Vendor A says: "Our product uses FIPS 140-3 validated cryptography, certificate number on file, running in approved mode." Vendor B says: "Our product is FIPS compliant."
Vendor A gave something you can check. Vendor B might mean that it uses an approved algorithm such as AES. That is different from using a validated module. Or it might mean it was built to follow the standard but never tested. Neither is proof.
Points to keep straight:
- Certificates are issued for modules, not for whole products. A module may be a component inside a product, so the product claim depends on which module it uses.
- A certificate lists the exact versions and configuration that were tested. A newer software build may not be covered.
- Many validated modules must run in a specific approved mode. Enabling it is often a configuration step the customer has to do.
- Algorithm validation is a separate program. Having an algorithm tested does not equal having the module validated.
- CMVP notes that all questions about use of a validated module go first to the vendor.
Where does it matter outside government?
FIPS validation appears in federal contracts, in programs such as FedRAMP, and in some regulated industries and customer contracts. If you are not selling to those markets, check whether any contract actually requires it. Using well-reviewed cryptography is good practice either way, but certification adds cost, so the requirement should be real.
How to check or apply this
- Ask for the CMVP certificate number, not a statement of compliance.
- Search the CMVP validated modules list and confirm status is Active, not Historical or Revoked.
- Check that the module name and version match what you will run.
- Read the security policy for approved modes and configuration steps.
- Enable and test approved mode in your deployment, and record the evidence.
- Put the version and certificate into your inventory so you can recheck at each upgrade.
Quick check
Is FIPS 140-2 still acceptable?
Per the CMVP, FIPS 140-2 modules moved to the Historical list after 21 September 2026. Agencies may keep using them in existing systems only, so plan for FIPS 140-3 on new work.
Does a FIPS validated module make the whole product secure?
No. It shows the cryptographic module met the standard. The rest of the product still needs its own security work.
Sources
- NIST FIPS 140-3, Security Requirements for Cryptographic Modules
- NIST Cryptographic Module Validation Program
- CMVP validated modules
Last reviewed: 18 October 2026.
