What is FIPS 140-3?
FIPS 140-3 is a US federal standard that sets the security requirements for cryptographic modules: the hardware, software or firmware that encrypts data, generates keys and creates digital signatures. NIST published it on 22 March 2019, replacing FIPS 140-2. It builds on two international standards, ISO/IEC 19790 for the requirements and ISO/IEC 24759 for how they are tested, with NIST’s SP 800-140 series filling in the US specifics.
US federal agencies must use validated modules to protect sensitive information, and the Canadian government relies on the same programme. Many other rules point to it, so the phrase “FIPS-validated” turns up far beyond government.
What does “validated” mean?
A module isn’t validated because its vendor says it follows the standard. It must be tested by an accredited laboratory and then reviewed by the Cryptographic Module Validation Program (CMVP), run jointly by NIST and the Canadian Centre for Cyber Security. Successful modules get a certificate number, listed publicly on NIST’s site with the exact versions and the operating environments tested.
That detail matters in practice. A product that merely “uses AES” or “uses a FIPS-approved algorithm” is not the same as one that runs a validated module, in a tested configuration, in its approved mode.
What are the security levels?
FIPS 140-3 defines four increasing levels. Level 1 covers basic requirements for production-grade cryptography, typically software libraries. Higher levels add physical protection, tamper evidence and response, and stronger identity-based authentication, up to Level 4 for hardware built to resist determined physical attack. Buyers choose the level their risk and their contract require; most software only ever needs Level 1.
What changed in 2026?
The CMVP stopped accepting new FIPS 140-2 submissions in September 2021. Existing FIPS 140-2 certificates could still be used for new systems until 21 September 2026. After that date the CMVP moves them to the historical list, where agencies may keep using them only in systems they already have. If you sell to the US government, check that the modules in your product have FIPS 140-3 certificates, or plan the replacement.
Who needs it?
- Federal agencies and their suppliers, where cryptography protects sensitive government information.
- FedRAMP cloud services, which must use validated modules where cryptography is required.
- Defence contractors under CMMC, which assesses NIST SP 800-171 Revision 2 and its requirement for FIPS-validated cryptography to protect the confidentiality of Controlled Unclassified Information.
- Regulated organisations, including some healthcare and financial services firms, that adopt it as a benchmark for strong cryptography.
Common misconceptions
FIPS 140-3 validates modules, not whole products, and it says nothing about how well a product as a whole is secured. It is also not a certificate a company can hold for itself. Check the CMVP certificate and its security policy document to see exactly what was tested.
Sources and official references
- FIPS 140-3, Security Requirements for Cryptographic Modules — NIST Computer Security Resource Center (official source)
- Cryptographic Module Validation Program — NIST Computer Security Resource Center (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with NIST, with the Canadian Centre for Cyber Security through the Cryptographic Module Validation Program (CMVP).