FIPS 140-3 Certificate maintenance FAQ

Treat the public CMVP certificate entry as the current reference for the validation claim. Before using it in procurement, customer trust, audit, or product-security material, verify the status, certificate number, module name, vendor, version, tested configuration, caveats, Security Policy, and validation history on the official NIST CMVP site. Record the date of that check because the public status and supporting documents can change.

Do not rely on a downloaded certificate image or a vendor slide as the only proof. FIPS 140-3 treats CMVP validation as a module-level decision after accredited-laboratory testing and CMVP review, so the public claim must continue to identify the module that was actually validated rather than the surrounding product by implication.

Review the certificate whenever the module, product packaging, embedded validated module, operational environment, algorithm set, Security Policy wording, vendor evidence, or vulnerability status changes. First decide whether the change is outside the validated boundary, changes only documentation, or changes security-relevant code, hardware, configuration, or dependencies. Then ask the vendor and Cryptographic and Security Testing (CST) laboratory which CMVP submission or revalidation path, if any, applies; a customer cannot extend a certificate by its own assessment.

A maintenance review does not extend the original validation. CMVP guidance makes this concrete for bound or embedded modules, operational environments, algorithm implementations, software or firmware loading, and security-relevant vulnerabilities. After validation, a security-relevant Common Vulnerabilities and Exposures (CVE) entry may require design changes, implementation changes, updated guidance, or a CST-laboratory submission; the vendor must address the module's continued validated-list status with CMVP.

Keep a compact evidence record that lets a reviewer repeat the check. It should show the official CMVP entry, the Security Policy used, the exact product or module version in scope, the claim being made, and any change or revalidation question that remains open.

Separate completed validation evidence from engineering, vendor, or laboratory work in progress. FIPS 140-3 says that modules validated under CMVP are considered conforming; planned testing, internal readiness, CAVP algorithm certificates, or an unpublished submission do not establish that completed module-validation claim.