What FIPS 140-3 validated means

Federal Information Processing Standard (FIPS) 140-3 sets the security requirements for a cryptographic module, the hardware, software, or firmware that performs encryption, signing, and key management. The National Institute of Standards and Technology (NIST) published FIPS 140-3 on March 22, 2019, and it superseded FIPS 140-2 in its entirety. A module is validated only after the Cryptographic Module Validation Program (CMVP) issues it a certificate. The CMVP says non-validated cryptography is viewed as providing no protection, and the data would be considered unprotected plaintext. If cryptography is required, it must be validated.

The standard and its history

The CMVP frequently asked questions (FAQs) say FIPS 140-1 was published January 11, 1994, and NIST set up the CMVP on July 17, 1995 to validate modules against it. FIPS 140-2 was released May 25, 2001.

The transition page says the Secretary of Commerce approved FIPS 140-3 on March 22, 2019, the Federal Register announced it on May 1, 2019, and it took effect September 22, 2019. Instead of stating module requirements itself, FIPS 140-3 references International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) standard 19790:2012, with testing under ISO/IEC 24759:2017. NIST Special Publications (SP) 800-140 through 800-140F modify their annexes and test sections. The standard says its major changes from FIPS 140-2 are limited to new non-invasive physical requirements.

The requirement areas run from module specification and interfaces through roles and authentication, physical and non-invasive security, sensitive security parameter management, self-tests, and life-cycle assurance, to mitigation of other attacks. The standard applies to modules federal agencies operate or that are operated for them under contract. Modules approved for classified use may be used in place of FIPS-validated ones.

Four security levels

FIPS 140-3 has four increasing, qualitative levels. The level must suit the application and environment. The detailed requirements sit in ISO/IEC 19790, which FIPS 140-3 calls an update of earlier FIPS 140 versions. The public text of FIPS 140-2 describes its four levels this way:

• Level 1 is the lowest. At least one approved algorithm or security function is used, and no physical security is required beyond production-grade components. Software may run on a general-purpose computer with an unevaluated operating system.
• Level 2 adds tamper evidence, such as coatings, seals, or pick-resistant locks, and at least role-based authentication of operators.
• Level 3 aims at a high probability of detecting and responding to physical access, for example circuitry that zeroizes plaintext keys when a cover is opened, and requires identity-based authentication.
• Level 4 gives a complete envelope of protection, suited to physically unprotected environments, and guards against voltage and temperature outside normal ranges.

FIPS 140-3 cautions that conformance alone does not ensure a module is secure. The operator remains responsible for whether the protection is enough for the information's owner.

Validated, compliant, and in process

Vendors pay Cryptographic and Security Testing Laboratories (CSTLs), accredited under the National Voluntary Laboratory Accreditation Program (NVLAP), to test a module. The algorithms must first pass the Cryptographic Algorithm Validation Program (CAVP). The CMVP, run jointly by NIST and the Canadian Centre for Cyber Security, reviews the lab's report and issues the certificate. The overview counts over 1,000 active validated modules and over 5,000 since the program began.

"Compliant," in the FAQs, means a vendor believes its product meets FIPS 140-3, but the product has not gone through validation. A validated product has a CMVP certificate number. The FAQs say the correct term is "validated" and tell buyers who hear compliance or certification claims to ask for the certificate number. A product that embeds another vendor's validated module cannot call itself validated. It may say "FIPS 140-3 Inside," and nothing assures that the product uses the embedded module correctly.

Two lists show work under way, and neither is validation: the Modules In Process list, of modules submitted but not yet validated, and the Implementation Under Test list, which the FAQs call a voluntary marketing service.

What a certificate covers

The CMVP page on patches and updates says the certificate states the tested module version, the operational environment, and the vendor, and serves as the benchmark for the compliant configuration. A patched version is not validated. The CMVP still strongly recommends patching and runs an expedited path for updates that answer a published vulnerability. Loading non-validated applications into a validated module invalidates the original validation.

Certificate #4626 shows the fields: FIPS 140-3, Overall Level 1, firmware-hybrid, single chip, a list of tested processor part numbers, and a caveat that it applies when the module is configured as Section 12.1.1 of its security policy specifies. Validated October 4, 2023, it has a sunset date of October 3, 2028.

The Validated Modules page sets further limits. Algorithms listed as "other algorithms" were not tested. Implementing an approved function and holding algorithm certificates does not meet the standard. Supply chain, supplier reputation, and ownership are not assessed.

The FIPS 140-2 sunset

The CMVP accepted FIPS 140-3 submissions from September 22, 2020, and stopped taking FIPS 140-2 submissions for new certificates on April 1, 2022. New validations stay on the Active list for five years, or two years for interim validations, which began June 6, 2024.

FIPS 140-2 modules could be accepted for controlled unclassified information through September 21, 2026. The transition schedule placed all FIPS 140-2 certificates on the Historical list on September 22, 2026, and the FAQs say only FIPS 140-3 validations remain active from that date. Historical modules should not go into new systems but can be bought for legacy systems, under the agency's own risk determination. The CMVP overview tells agencies to keep using FIPS 140-2 modules until FIPS 140-3 replacements become available. A revoked certificate is no longer valid.

What to check

• What is the certificate number, and does the CMVP entry show FIPS 140-3 and Active status?
• Does the validated version and tested configuration on the certificate match what is installed?
• Is the product itself validated, or does it embed a validated module and claim only "Inside"?
• Has the module been patched since validation, and has an updated version been submitted?
• Which overall level and caveats does the certificate state, and is the module run in the approved mode its security policy describes?
• For a FIPS 140-2 module, is it being used only in an existing system, under a documented risk decision?

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Sources

1. 1FIPS PUB 140-3, Security Requirements for Cryptographic Modules · National Institute of Standards and Technology, March 22, 2019
2. 2FIPS PUB 140-2, Security Requirements for Cryptographic Modules · National Institute of Standards and Technology, May 25, 2001, with change notices of December 3, 2002
3. 3Cryptographic Module Validation Program (CMVP) · NIST Computer Security Resource Center, updated August 21, 2026
4. 4CMVP FAQs · NIST Computer Security Resource Center, updated August 21, 2026
5. 5FIPS 140-3 Transition Effort · NIST Computer Security Resource Center, updated April 13, 2026
6. 6Validated Modules · NIST Computer Security Resource Center, updated August 21, 2026
7. 7FIPS Validation and Updates, Patches, and CVEs · NIST Computer Security Resource Center, updated August 21, 2026
8. 8Certificate #4626 · NIST Cryptographic Module Validation Program, validated October 4, 2023

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.