Use FIPS 140-3 and the certificate when the question is whether a specific cryptographic module is validated for a claimed use. Use for the international module requirements and for the test requirements. Always name the edition: FIPS 140-3 and current CMVP guidance still identify ISO/IEC 19790:2012 with its 2015 correction and ISO/IEC 24759:2017, while ISO published ISO/IEC 19790:2025 and ISO/IEC 24759:2025 as the current standalone editions and withdrew the older editions.
Side-by-side comparison
FIPS 140-3 vs ISO/IEC 19790 and ISO/IEC 24759: practical differences
This side-by-side view helps distinguish validation claims from the ISO/IEC requirements and test standards referenced by FIPS 140-3.
The validation and federal-use side: use it for certificate scope, federal procurement claims, security levels, approved algorithms, module evidence, and program guidance.
Second framework
ISO/IEC 19790 and ISO/IEC 24759
The international standard-reference side: use it for cryptographic module security requirements and test-requirements framing, not as a standalone certificate.
FIPS 140-3 vs ISO/IEC 19790 and ISO/IEC 24759: practical differences
FIPS 140-3 covers cryptographic modules used in security systems and validation of those modules, including the defined module boundary, security level, interfaces, roles, services, and operational environment.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
covers security requirements for cryptographic modules; covers test requirements for cryptographic modules. A detailed clause mapping requires review of the exact ISO editions named in the requirement.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Scope the claim by module and validation purpose first; do not treat an ISO standards reference as proof that a module is validated.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Vendors, CST laboratories, reviewers, federal buyers, and Canadian federal users rely on the FIPS/CMVP result to evaluate validated cryptographic modules.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Standards, assurance, procurement, and lab teams may cite or to describe the requirement or test basis behind cryptographic module assessment work.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Send certificate-status questions to the FIPS/ evidence set; send standards-lineage questions to the ISO reference set.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
The FIPS side matters when a product claim, federal procurement response, system authorization, customer contract, or module release depends on FIPS 140-3 validation or approved cryptography evidence.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
The ISO side matters when a customer, lab, or policy asks which international cryptographic module requirements or test requirements sit behind the FIPS 140-3 work.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Record the trigger in the evidence file so teams know whether they need a certificate, an ISO standards explanation, or both.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
FIPS/ work products include module specification, security policy, service and approved-mode descriptions, operational-environment details, algorithm validation evidence, test reports, entropy and self-test support, and change-impact records.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
and references support the requirements and test-method vocabulary, while a one-to-one deliverable crosswalk requires review of the exact ISO text and applicable modifications.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Build the deliverable list from guidance for a FIPS claim, then use ISO references only where the source material or customer request actually cites them.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Keep ISO references as standards support: the requirements citation, the test-requirements citation, and any separately reviewed ISO text or procurement crosswalk.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Separate validation proof from standards background so auditors and customers can see what has actually been tested and validated.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
FIPS 140-3 superseded FIPS 140-2, became effective after approval, and is supported by guidance that changes over time; validation evidence should track the guidance version used for the submission or change review.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO published :2025 as edition 3 and withdrew ISO/IEC 19790:2012 and Cor.1:2015. FIPS 140-3 names the 2012 requirements edition with its 2015 corrections.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports the February 2025 publication of edition 3 and ISO's withdrawn status for the 2012 edition and its 2015 correction.
Record the edition used by each claim. Do not treat the standalone 2025 ISO edition as an automatic replacement for the edition and NIST modifications used in a validation.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
FIPS 140-3 assurance runs through validation, with testing by accredited CST laboratories and acceptance by U.S. and Canadian federal agencies for protected information uses described in the source material.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
and provide standards references; the cited public sources do not show an independent enforcement or certificate route equivalent to validation.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
When a buyer asks for validated cryptography, confirm whether they mean a -listed FIPS 140-3 module rather than a general ISO standards citation.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO references can explain the underlying security and test framework, but they should not absorb FIPS-specific certificate, approved-mode, CAVP, or evidence requirements.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Reuse explanatory text across the two sides, but keep validation artifacts and public claims tied to the FIPS/ source that supports them.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Use or as controlling only when the question is about the international requirements or test-requirements standard named in the request.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Name both layers: the exact ISO edition for requirements or tests, and the FIPS/ evidence for validation status.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Scope and covered activity
FIPS 140-3 and CMVP
FIPS 140-3 covers cryptographic modules used in security systems and validation of those modules, including the defined module boundary, security level, interfaces, roles, services, and operational environment.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
covers security requirements for cryptographic modules; covers test requirements for cryptographic modules. A detailed clause mapping requires review of the exact ISO editions named in the requirement.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
Scope the claim by module and validation purpose first; do not treat an ISO standards reference as proof that a module is validated.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Who uses the result
FIPS 140-3 and CMVP
Vendors, CST laboratories, reviewers, federal buyers, and Canadian federal users rely on the FIPS/CMVP result to evaluate validated cryptographic modules.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
Standards, assurance, procurement, and lab teams may cite or to describe the requirement or test basis behind cryptographic module assessment work.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
Send certificate-status questions to the FIPS/ evidence set; send standards-lineage questions to the ISO reference set.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
When the comparison matters
FIPS 140-3 and CMVP
The FIPS side matters when a product claim, federal procurement response, system authorization, customer contract, or module release depends on FIPS 140-3 validation or approved cryptography evidence.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
The ISO side matters when a customer, lab, or policy asks which international cryptographic module requirements or test requirements sit behind the FIPS 140-3 work.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
Record the trigger in the evidence file so teams know whether they need a certificate, an ISO standards explanation, or both.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Work products
FIPS 140-3 and CMVP
FIPS/ work products include module specification, security policy, service and approved-mode descriptions, operational-environment details, algorithm validation evidence, test reports, entropy and self-test support, and change-impact records.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
and references support the requirements and test-method vocabulary, while a one-to-one deliverable crosswalk requires review of the exact ISO text and applicable modifications.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
Build the deliverable list from guidance for a FIPS claim, then use ISO references only where the source material or customer request actually cites them.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Evidence and records
FIPS 140-3 and CMVP
Keep certificate scope, module version, boundary diagrams, security levels, service tables, approved algorithm certificates, security policy text, lab test evidence, and change decisions together.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
Keep ISO references as standards support: the requirements citation, the test-requirements citation, and any separately reviewed ISO text or procurement crosswalk.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
Separate validation proof from standards background so auditors and customers can see what has actually been tested and validated.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Timing and updates
FIPS 140-3 and CMVP
FIPS 140-3 superseded FIPS 140-2, became effective after approval, and is supported by guidance that changes over time; validation evidence should track the guidance version used for the submission or change review.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
ISO published :2025 as edition 3 and withdrew ISO/IEC 19790:2012 and Cor.1:2015. FIPS 140-3 names the 2012 requirements edition with its 2015 corrections.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports the February 2025 publication of edition 3 and ISO's withdrawn status for the 2012 edition and its 2015 correction.
Operational implication
Record the edition used by each claim. Do not treat the standalone 2025 ISO edition as an automatic replacement for the edition and NIST modifications used in a validation.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports the need to distinguish the current standalone ISO edition from the 2012 edition named in FIPS and CMVP materials.
Assurance route
FIPS 140-3 and CMVP
FIPS 140-3 assurance runs through validation, with testing by accredited CST laboratories and acceptance by U.S. and Canadian federal agencies for protected information uses described in the source material.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
and provide standards references; the cited public sources do not show an independent enforcement or certificate route equivalent to validation.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
When a buyer asks for validated cryptography, confirm whether they mean a -listed FIPS 140-3 module rather than a general ISO standards citation.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Overlap and reuse
FIPS 140-3 and CMVP
FIPS 140-3 incorporates and references and adds FIPS/-specific validation context, NIST SP 800-140 modifications, and implementation guidance.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
ISO references can explain the underlying security and test framework, but they should not absorb FIPS-specific certificate, approved-mode, CAVP, or evidence requirements.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
Reuse explanatory text across the two sides, but keep validation artifacts and public claims tied to the FIPS/ source that supports them.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Practical decision rule
FIPS 140-3 and CMVP
Use FIPS 140-3 and as controlling when the question is "Is this cryptographic module validated for the claimed use?"
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
ISO/IEC 19790 and ISO/IEC 24759
Use or as controlling only when the question is about the international requirements or test-requirements standard named in the request.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Operational implication
Name both layers: the exact ISO edition for requirements or tests, and the FIPS/ evidence for validation status.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Practical decision rule
How to choose between FIPS 140-3 and ISO/IEC 19790 and ISO/IEC 24759
Choose FIPS 140-3 and when the team needs validation status, certificate scope, or a yes-or-no answer about whether the module is accepted as validated for the claimed use.
Choose or when the team needs the international requirements or test standard, and name the edition.
When a request mixes compliance and validation language, name both layers: the exact ISO edition for the requirement or test basis, and the FIPS/ certificate evidence for validation status.
Program guidance for FIPS 140-3 validation evidence, binding/embedding, approved service indicators, CAVP certificates, change impact, and CMVP operating expectations.
CAVP addresses the testing of Approved Security Functions
Official ISO catalogue entry for the international cryptographic-module test requirements cited in this comparison.
Test requirements for cryptographic modules
1
Section 1
What is being compared?
FIPS 140-3 is the published Federal Information Processing Standard for security requirements for cryptographic modules. It applies to federal agencies using cryptography-based security systems and is the basis for validation of modules used to protect sensitive information.
FIPS 140-3 is based on :2012/Cor.1:2015 for module requirements and :2017 for testing. NIST's SP 800-140 series modifies specified ISO annexes and test sections, while implementation guidance supplies program decisions and clarifications.
:2025 and :2025 are the current standalone ISO editions, and ISO lists the 2012 requirements edition, its 2015 correction, and the 2017 test edition as withdrawn. FIPS 140-3 incorporates ISO/IEC 19790:2012 with the 2015 corrections and ISO/IEC 24759:2017. Do not assume that citing either 2025 edition proves conformity with the older editions and NIST modifications used for a FIPS 140-3 validation.
Use FIPS 140-3 when the claim is about validation, federal-agency acceptance, certificate scope, or a FIPS-labeled procurement requirement.
Use when the claim is about international cryptographic-module requirements, and state whether the claim concerns the 2025 edition or the 2012 edition incorporated into the current FIPS/ material.
Use :2017 for the test-requirements frame referenced by FIPS 140-3 and current guidance; use ISO/IEC 24759:2025 for the current standalone ISO test standard.
Do not describe or as a substitute for validation unless the procurement or assurance document explicitly allows that.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports that ISO/IEC 24759:2025 is the current published fourth edition, tests conformity to ISO/IEC 19790:2025, and replaced the withdrawn 2017 edition.
2
Section 2
Where FIPS 140-3 adds operational work
A FIPS claim requires more than a standards citation. FIPS 140-3 names four qualitative security levels and covers module specification, interfaces, roles, services and authentication, software and firmware security, operational environment, physical security, non-invasive security, sensitive security parameter management, self-tests, life-cycle assurance, and mitigation of other attacks.
guidance turns those requirements into validation operations: module boundary and service descriptions, algorithm certificate handling, approved security service indicators, operational-environment records, entropy and SSP evidence, self-test expectations, CVE management, and change-impact decisions.
Start FIPS evidence with the module boundary, version, operating environment, security level claims, roles, services, and approved versus non-approved services.
Attach algorithm claims to CAVP certificate evidence where guidance requires it.
Keep approved-mode indicators, security policy text, test reports, entropy support, self-test behavior, and change records together with the certificate scope.
Rerun the comparison when the module boundary, implementation, operational environment, validated algorithms, or public claim changes.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
3
Section 3
Where ISO/IEC 19790 and ISO/IEC 24759 fit
defines cryptographic module security requirements, and defines cryptographic module test requirements. The current standalone editions are ISO/IEC 19790:2025 and ISO/IEC 24759:2025. For the FIPS route, the baseline remains the older editions named in FIPS 140-3 and current material, together with the applicable NIST modifications, Derived Test Requirements, management manual, and implementation guidance.
An ISO citation explains the requirements or test-standard layer. It does not establish a module's validation status, certificate scope, approved services, or tested operational environments.
Record the exact ISO edition. Do not collapse the 2012/2015 and 2025 requirements editions, or the 2017 and 2025 test editions, into an undated claim.
Use FIPS and citations to support validation status, certificate scope, submission evidence, and U.S./Canadian federal acceptance claims.
Build a detailed clause crosswalk only after obtaining and reviewing the exact ISO editions named in the requirement.
Flag customer requests that ask for "ISO 19790 compliant" evidence when they actually require a FIPS 140-3 validated module.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Supports the current standalone ISO test-requirements edition and the withdrawn status of ISO/IEC 24759:2017.
4
Section 4
Procurement and audit evidence to keep separate
Keep three evidence sets separate: the FIPS 140-3 validation claim, the requirements reference, and the test-requirements reference. They overlap, but the labels answer different procurement and assurance questions.
For customer-facing claims, avoid broad wording such as "ISO/FIPS compliant" unless the statement identifies the module, version, boundary, certificate status, operational environment, and the source that supports the claim.
FIPS claim record: module name, version, boundary, security level, certificate identifier or status, operational environment, validated algorithms, and security policy link or artifact.
ISO requirements record: the exact edition, the procurement language, and the requirement area being discussed. Do not silently substitute the 2025 edition for the 2012 edition named by FIPS 140-3.
Test-method record: the or /DTR test reference named by the lab, assessor, or customer.
Gap record: unsupported equivalence assumptions, missing certificate scope, expired or changed operational environments, and evidence reused from a different module.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
CAVP addresses the testing of Approved Security Functions
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Test requirements for cryptographic modules
Recommended next step
Review FIPS and ISO module claims
This comparison helps separate CMVP validation evidence from ISO requirement and test references before making procurement, audit, or public security claims.
Supports the ISO/IEC 19790 comparator at scope level only: it is the international cryptographic module security requirements standard referenced by FIPS 140-3.
ISO page for the withdrawn ISO/IEC 19790:2012 edition that FIPS 140-3 identifies, together with Cor.1:2015, as its requirements basis.
ISO page for the withdrawn ISO/IEC 19790:2012 edition that remains the edition named in FIPS 140-3 and current CMVP implementation guidance.
Show 1 more
Official ISO catalogue entry for the cryptographic-module security requirements edition identified by FIPS 140-3.
Current ISO source showing that the 2025 fourth edition tests conformity to ISO/IEC 19790:2025 and replaced the withdrawn 2017 edition.
Supports that ISO/IEC 24759:2025 is the current published fourth edition, tests conformity to ISO/IEC 19790:2025, and replaced the withdrawn 2017 edition.
Supports the current standalone ISO test-requirements edition and the withdrawn status of ISO/IEC 24759:2017.
Supports the program-evidence side: CMVP implementation guidance for submissions, algorithm validation certificates, service indicators, operational environments, entropy, self-tests, CVE management, and change handling.
Program guidance for FIPS 140-3 validation evidence, binding/embedding, approved service indicators, CAVP certificates, change impact, and CMVP operating expectations.
"CAVP addresses the testing of Approved Security Functions"
Supports the ISO/IEC 24759 comparator at scope level only: it is the international test requirements standard referenced by FIPS 140-3 and CMVP guidance.
Official ISO catalogue entry for the international cryptographic-module test requirements cited in this comparison.
Supports the FIPS 140-3 side: federal-agency applicability, four security levels, CMVP validation context, incorporated ISO/IEC 19790 and ISO/IEC 24759 references, and the module security requirement areas.
Primary source for cryptographic module scope, security levels, module areas, federal applicability, and the transition from FIPS 140-2.