Written and maintained by CASRAI Editorial Board
Last updated
FIPS 140-3 is the U.S. federal standard for the security requirements of a cryptographic module, and the Cryptographic Module Validation Program (CMVP) is the process that confirms a specific module meets it. For a research office, the practical point is that a validated module appears on an official NIST list under a certificate, while a product that merely says it is “FIPS compliant” does not. The facts below are as described on the official NIST pages on 2026-10-29. Programs change, so confirm current dates on the official pages before relying on them.
What FIPS 140-3 is and who runs the validation program
FIPS 140-3, Security Requirements for Cryptographic Modules, was approved by the Secretary of Commerce on March 22, 2019, became effective on September 22, 2019, and supersedes FIPS 140-2 (issued 12/03/2002), as NIST describes it. NIST’s abstract describes the standard as providing “four increasing, qualitative levels of security” for a wide range of applications and environments.
Validation is run by the CMVP, which NIST describes as a joint effort of NIST and the Canadian Centre for Cyber Security (part of the Communications Security Establishment). Its stated aims are to promote the use of validated cryptographic modules and to give federal agencies a security metric for procurement. Testing is done by Cryptographic and Security Testing Laboratories (CSTLs); NIST states that each CSTL is an independent laboratory accredited by NVLAP, and that CMVP reviews and validates each submission.
Note the two dates that people mix up. The standard became effective in 2019, but NIST’s program page records that CMVP began validating modules to FIPS 140-3 on September 22, 2020. For background on the encryption itself, see our guide to what cryptography is.
Who needs validated modules
The CMVP page frames validation as a security metric for federal agencies buying cryptographic modules. Beyond that statement, this page does not claim that any particular regulation, funder rule or contract clause requires FIPS 140-3. If a data-security plan, award term or agreement names FIPS 140 validation, the text of that document is the authority; read it for the exact wording. Research teams that handle regulated data often meet the standard indirectly, for example through controlled unclassified information or NIST SP 800-171 programs, and in the cloud-storage questions covered in our ITAR-compliant cloud storage guide.
What the standard covers
NIST lists the areas FIPS 140-3 addresses:
- Cryptographic module specification and module interfaces
- Roles, services and authentication
- Software and firmware security, and the operating environment
- Physical security and non-invasive security
- Sensitive security parameter management
- Self-tests and life-cycle assurance
- Mitigation of other attacks
The unit being validated is the cryptographic module, as the standard’s title says. That is why a validation certificate is listed against a named module rather than against a whole product line or a vendor. NIST also notes that the SP 800-140 series of documents modifies ISO/IEC 19790:2012 and the associated testing standard, so the requirements are read alongside those publications.
How validation works, step by step
- A module is submitted to a CSTL. The laboratory checks the module against the testable cryptographic and security requirements.
- CMVP reviews the submission. NIST states that CMVP reviews and validates each CSTL submission.
- The module is listed. A validated module goes on the Validated Modules list as Active, for 5 years, or 2 years for interim validations, per the CMVP page.
The CMVP page also links to two other lists, Modules In Process (MIP) and Implementation Under Test (IUT). Validation itself is recorded on the Validated Modules list, so check a module there and ask the vendor for the certificate number.
Timeline phases for the FIPS 140-2 to 140-3 transition
As described on the official CMVP page on 2026-10-29, the transition ran in phases:
| Date on the CMVP page | What NIST states |
|---|---|
| 2020-09-22 | CMVP begins validating modules to FIPS 140-3 |
| 2021-09-22 | No new FIPS 140-2 submissions for new validation certificates |
| 2022-04-01 | Only FIPS 140-2 reports that do not change the validation sunset date are accepted |
| 2024-06-06 | Two-year interim validations begin, for modules submitted before January 1, 2024 |
| 2026-09-21 | FIPS 140-2 active modules usable for new systems until this date; afterward they move to the Historical list and agencies may keep them only in existing systems |
The last date has now passed. In practice this means a module that appears only on the Historical list should not be selected for a new system, whereas a FIPS 140-3 module on the Active list is the current basis.
Common mistakes
- Accepting “FIPS compliant” as validation. Ask for the module name and CMVP certificate number, then find it on the Validated Modules list.
- Checking the product rather than the module. Validation is listed per cryptographic module.
- Skipping the Validated Modules list. Modules In Process and Implementation Under Test are separate CMVP lists; confirm the module on the Validated Modules list.
- Ignoring the validity period. Active status lasts 5 years, or 2 years for interim validations, so note the listing date when you record a certificate in a data-security plan.
- Relying on FIPS 140-2 for new systems. After 2026-09-21 those modules are on the Historical list.
Related programs and standards
| Item | What NIST says about it |
|---|---|
| CMVP | Joint NIST and Canadian Centre for Cyber Security program that validates cryptographic modules |
| CSTL | Independent laboratory accredited by NVLAP that tests modules |
| FIPS 140-2 | Predecessor standard (12/03/2002), superseded by FIPS 140-3; certificates move to the Historical list after 2026-09-21 |
| ISO/IEC 19790:2012 | International standard referenced by FIPS 140-3 |
| SP 800-140 series | NIST documents that modify ISO/IEC 19790:2012 and its testing counterpart |
For the wider security context, see our overview of what cybersecurity covers.
FAQ
What is FIPS 140-3?
It is the federal standard for the security requirements of cryptographic modules, with four increasing levels of security, approved March 22, 2019 and superseding FIPS 140-2.
When did FIPS 140-3 take effect?
NIST says it became effective on September 22, 2019. CMVP began validating modules to it on September 22, 2020.
Is FIPS 140-2 still valid?
Per the CMVP page, active FIPS 140-2 modules could be used in new systems until 2026-09-21. After that date they move to the Historical list and agencies may keep them only in existing systems.
Who tests and validates modules?
NVLAP-accredited CSTLs test; CMVP reviews and validates each submission.
How long does a validation last?
The CMVP page says modules go on the Active list for 5 years, or 2 years for interim validations.
Sources
- NIST CSRC, Cryptographic Module Validation Program: https://csrc.nist.gov/projects/cryptographic-module-validation-program (checked 2026-10-29)
- NIST CSRC, FIPS 140-3: https://csrc.nist.gov/pubs/fips/140-3/final (checked 2026-10-29)
- NIST, Announcing approval and issuance of FIPS 140-3: https://www.nist.gov/news-events/news/2019/05/announcing-approval-and-issuance-fips-140-3-security-requirements (checked 2026-10-29)
