FIPS 140-3
FIPS 140-3 and guide for scope, security levels, approved services, operating environments, and validation evidence.
Understand what FIPS 140-3 validates, when U.S. federal use or another assurance requirement makes it relevant, who tests and validates the module, and what evidence a buyer or operator must verify.
FIPS 140-3 applies ISO/IEC 19790:2012 module requirements and ISO/IEC 24759:2017 test methods with changes in the NIST SP 800-140 series. It covers a defined hardware, software, firmware, or hybrid , not automatically the product that contains it. An accredited Cryptographic and Security Testing laboratory tests the module; NIST and the Canadian Centre for Cyber Security jointly operate CMVP and issue the validation decision. A algorithm certificate is supporting evidence, not a CMVP module validation.
Confirm why validation is required, freeze the module identity and boundary, map the target security levels and approved services, and assemble the laboratory and evidence.
Document included and excluded components, ports, interfaces, operating environments, and bound or embedded modules before testing starts.
Tie each approved service to its algorithm implementation and evidence without presenting an algorithm certificate as module validation.
Decide whether the need comes from U.S. federal use, a contract, or voluntary adoption; then record the exact module, version, boundary, target level, services, and environment for testing by an accredited Cryptographic and Security Testing laboratory.
Separate the cryptographic boundary from the surrounding product, excluded components, ports, interfaces, operating-environment assumptions, and any bound or embedded validated module.
Map each approved service to its algorithm implementation and evidence without treating an algorithm certificate as a module validation.
Compare Federal Information Processing Standard (FIPS) 140-3 with its predecessor, choose a security level for the and its operating environment, or prepare module-level evidence for Cryptographic Module Validation Program () review.
FIPS 140-2 is the previous cryptographic-module security standard; FIPS 140-3 replaced it with requirements aligned to ISO/IEC 19790 and ISO/IEC 24759. Compare the standards, then check the exact module, version, operating environment, certificate status, and transition rules before relying on a legacy validation.
FIPS 140-3 has four security levels. Level 1 provides the baseline; Levels 2 to 4 add progressively stronger requirements in areas such as tamper evidence, role authentication, physical protection, and environmental-failure protection. Choose the level that the module's application and threat environment require.
Before laboratory testing, define the module boundary, services, approved cryptographic algorithms, random-number source, self-tests, public , and change records. A Cryptographic Algorithm Validation Program () certificate confirms an algorithm implementation test; only validates the complete .
Start by deciding why validation matters and what the module boundary contains. Then choose the security level and services, prepare the evidence package, follow the lifecycle, and maintain only claims that still match the public validation record.
Identify the procurement or assurance trigger, define the module rather than the surrounding product, and choose a level appropriate to the application and environment.
Connect approved and non-approved services to algorithm implementations, sensitive security parameters, , and the exact environment covered by the evidence.
Turn the eleven requirement areas into an owned readiness review, a non-proprietary , and evidence for laboratory and review.
Follow the vendor-laboratory- process, distinguish Active, Historical, and Revoked status, and reassess boundary, version, tested or affirmed environment, algorithm, dependency, and vulnerability changes.
Distinguish FIPS 140-3 from legacy FIPS 140-2 certificates and its ISO/IEC technical basis, or go directly to the focused FAQ set.
"Information in this document is subject to change by NIST and CCCS"
"validated modules"
"specifies the security requirements that will be satisfied by a cryptographic module"
Next steps
Use the FIPS 140-3 guides to align product, engineering, security, and compliance teams before engaging a Cryptographic and Security Testing laboratory or updating an existing validation.
Organize FIPS 140-3 scope, evidence requests, owners, and review checkpoints for a validation-readiness assessment.
Research guidance, approved-mode questions, and change-impact issues with cited outputs.
Review your module scope, laboratory-readiness questions, and validation evidence model.