FIPS 140-3 Certificate maintenance FAQ

Treat the CMVP certificate entry as living evidence. Before using it in procurement, customer trust, audit, or product-security material, verify the current validation status, certificate number, module name, vendor, version, tested configuration, caveats, Security Policy, and validation history on the official NIST CMVP site.

Do not rely on a downloaded certificate image or a vendor slide as the only proof. The CMVP Management Manual says the database entry includes the version number and benchmark configuration from the original validation, and that users should refer to the NIST website for the latest validation information.

Review the certificate whenever the module, product packaging, embedded validated module, operational environment, algorithm set, Security Policy wording, vendor evidence, or vulnerability status changes. The review question is whether the current certificate still describes the module and configuration being claimed.

For validated modules, the maintenance path is not an internal memo. The CMVP Management Manual states that after validation the vendor manages post-module validation through a new validation or revalidation process submitted by a CSTL, and that changes outside validation or revalidation invalidate the module.

Keep a compact evidence record that lets a reviewer repeat the check. It should show the official CMVP entry, the Security Policy used, the exact product or module version in scope, the claim being made, and any change or revalidation question that remains open.

Separate active validation evidence from work-in-progress evidence. The CMVP Management Manual says IUT and MIP lists are informational, voluntary, and do not imply or guarantee FIPS 140 validation. They can support tracking, but they should not be used as proof that a module is already validated.