Understand what FIPS 140-3 validates, when U.S. federal use or another assurance requirement makes it relevant, who tests and validates the module, and what evidence a buyer or operator must verify.
Start with applicability and boundary. Then map services, algorithms, , and tested environments; prepare the and laboratory evidence; and keep the claim tied to the live record after release.
FIPS 140-3 applies ISO/IEC 19790:2012 module requirements and ISO/IEC 24759:2017 test methods with changes in the NIST SP 800-140 series. It covers a defined hardware, software, firmware, or hybrid , not automatically the product that contains it. An accredited Cryptographic and Security Testing laboratory tests the module; NIST and the Canadian Centre for Cyber Security jointly operate CMVP and issue the validation decision. A algorithm certificate is supporting evidence, not a CMVP module validation.
Focused FIPS 140-3 guidance
Compare Federal Information Processing Standard (FIPS) 140-3 with its predecessor, choose a security level for the and its operating environment, or prepare module-level evidence for Cryptographic Module Validation Program () review.
FIPS 140-2 is the previous cryptographic-module security standard; FIPS 140-3 replaced it with requirements aligned to ISO/IEC 19790 and ISO/IEC 24759. Compare the standards, then check the exact module, version, operating environment, certificate status, and transition rules before relying on a legacy validation.
Compare FIPS 140-2 and FIPS 140-3FIPS 140-3 has four security levels. Level 1 provides the baseline; Levels 2 to 4 add progressively stronger requirements in areas such as tamper evidence, role authentication, physical protection, and environmental-failure protection. Choose the level that the module's application and threat environment require.
Review FIPS 140-3 security levelsBefore laboratory testing, define the module boundary, services, approved cryptographic algorithms, random-number source, self-tests, public , and change records. A Cryptographic Algorithm Validation Program () certificate confirms an algorithm implementation test; only validates the complete .
Open the FIPS 140-3 validation checklistFIPS 140-3 was approved and published on March 22, 2019, became effective on September 22, 2019, and began validating modules to it on September 22, 2020. A non-interim FIPS 140-3 validation is normally Active for five years; an Interim Validation has a two-year sunset. A certificate can move earlier to Historical because of programmatic transitions or dependency status, and a Revoked certificate may no longer demonstrate conformity. Check the live record rather than calculating status from the issue date.
Start by deciding why validation matters and what the module boundary contains. Then choose the security level and services, prepare the evidence package, follow the lifecycle, and maintain only claims that still match the public validation record.
Identify the procurement or assurance trigger, define the module rather than the surrounding product, and choose a level appropriate to the application and environment.
Connect approved and non-approved services to algorithm implementations, sensitive security parameters, entropy, and the exact environment covered by the evidence.
Turn the eleven requirement areas into an owned readiness review, a non-proprietary Security Policy, and evidence for laboratory and CMVP review.
Follow the vendor-laboratory-CMVP process, distinguish Active, Historical, and Revoked status, and reassess boundary, version, tested or affirmed environment, algorithm, dependency, and vulnerability changes.
Distinguish FIPS 140-3 from legacy FIPS 140-2 certificates and its ISO/IEC technical basis, or go directly to the focused FAQ set.
Use the FIPS 140-3 guides to align product, engineering, security, and compliance teams before engaging a Cryptographic and Security Testing laboratory or updating an existing validation.
