--- title: "FIPS vs Common Criteria (CC) - What to Validate vs Evaluate" canonical_url: "https://www.sorena.io/artifacts/global/fips-standards-hub/fips-vs-common-criteria" source_url: "https://www.sorena.io/artifacts/global/fips-standards-hub/fips-vs-common-criteria" author: "Sorena AI" description: "Deep comparison of FIPS, especially FIPS 140-3 and CMVP, versus Common Criteria: scope differences, evidence overlap, and when procurement requires both." published_at: "2026-03-04" updated_at: "2026-03-04" keywords: - "FIPS versus Common Criteria" - "FIPS 140-3 versus Common Criteria" - "CMVP versus Common Criteria" - "cryptographic module validation versus product evaluation" - "NIAP CCEVS" - "Common Criteria portal" - "GLOBAL compliance" - "FIPS 140-3" - "CMVP" - "Common Criteria" - "Assurance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # FIPS vs Common Criteria (CC) - What to Validate vs Evaluate Deep comparison of FIPS, especially FIPS 140-3 and CMVP, versus Common Criteria: scope differences, evidence overlap, and when procurement requires both. *Comparison* *GLOBAL* ## FIPS Standards Hub FIPS versus Common Criteria FIPS 140-3 is about cryptographic modules and approved-mode behavior. Common Criteria is about product evaluation against defined security requirements. Some programs need both. The key is designing evidence so you reuse artifacts instead of rebuilding them twice. FIPS and Common Criteria are often bundled together in procurement language, but they solve different assurance problems. FIPS 140-3 and the CMVP validate cryptographic modules. Common Criteria evaluates products against defined evaluation targets and protection profiles under national schemes and mutual recognition arrangements. If you understand the scope boundary, you can build one evidence architecture that supports both tracks. ## Scope difference in one sentence FIPS 140-3 validates a cryptographic module: its boundary, roles and services, SSP management, self-tests, lifecycle assurance, and approved-mode behavior. Common Criteria evaluates a product or target of evaluation against a defined security target or protection profile and is broader than cryptography alone. - FIPS asks whether the crypto module is secure and validated within its defined scope - Common Criteria asks whether the product meets its defined security requirements - Procurement should always ask for the right certificate for the right scope *Recommended next step* *Placement: after the comparison section* ## Use FIPS Standards Hub FIPS versus Common Criteria as a cited research workflow Research Copilot can take FIPS Standards Hub FIPS versus Common Criteria from how this topic compares with adjacent regulations or standards to a reusable workflow inside Sorena. Teams working on FIPS Standards Hub can keep owners, evidence, and next steps aligned without copying this guide into separate documents. - [Open Research Copilot for FIPS Standards Hub FIPS versus Common Criteria](/solutions/research-copilot.md): Start from FIPS Standards Hub FIPS versus Common Criteria and answer scope, timing, and interpretation questions with cited outputs. - [Talk through FIPS Standards Hub](/contact.md): Review your current process, evidence gaps, and next steps for FIPS Standards Hub FIPS versus Common Criteria. ## What evidence overlaps and what does not Evidence overlap exists when you build disciplined boundaries and traceability. Configuration management, secure development evidence, vulnerability handling, and some test artifacts can often be reused. The part that does not overlap cleanly is certificate meaning. FIPS certificates speak about validated crypto modules. Common Criteria certificates speak about evaluated products. Mixing those certificate meanings creates procurement risk. - Overlaps: configuration management, secure development, vulnerability handling, change control - FIPS-specific: approved mode, services map, SSP lifecycle, self-tests, module boundary - CC-specific: TOE boundary, security target mapping, protection-profile claims beyond crypto ## When you need FIPS, Common Criteria, or both You need FIPS when the requirement is explicitly about cryptography assurance, especially validated cryptographic modules. You need Common Criteria when the procurement requires a product evaluation certificate for a class of products under a national scheme or protection profile. You need both when the product evaluation requires cryptographic functions and the procurement separately requires a validated crypto module story. In that case, treat the validated module as a component inside the broader product-evaluation scope. - FIPS-only: crypto module validation requirement is explicit - CC-only: product evaluation requirement is explicit - Both: the product must meet product-evaluation requirements and use validated crypto where required ## How to design one evidence blueprint for both The highest-leverage move is to build a stable artifact set with two mappings: a FIPS mapping around the module boundary and approved mode, and a Common Criteria mapping around the TOE boundary and security target. That lets different reviewers navigate the same evidence pack through different lenses without forcing the engineering team to duplicate every artifact. - Define both the cryptographic module boundary and the TOE boundary and explain how they relate - Create stable artifact IDs and version rules - Tie the crypto services map to the product security-function map - Run one change-control process that checks impact on both assurance tracks ## Primary sources - [FIPS 140-3 (Security Requirements for Cryptographic Modules)](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf?ref=sorena.io) - Primary FIPS 140-3 source for module requirement areas and security levels. - [NIST and CCCS CMVP program overview](https://csrc.nist.gov/projects/cryptographic-module-validation-program?ref=sorena.io) - CMVP validation context and certificate meaning. - [Official Common Criteria Portal](https://www.commoncriteria.org/?ref=sorena.io) - Official portal for Common Criteria information, schemes, and mutual recognition material. - [NIAP CCEVS](https://www.niap-ccevs.org/?ref=sorena.io) - US scheme information for Common Criteria evaluations and requirements. ## Related Topic Guides - [FIPS Standards FAQ (Procurement, CMVP, Evidence)](/artifacts/global/fips-standards-hub/faq.md): FIPS Standards FAQ for procurement, compliance, and crypto-engineering teams: what FIPS-compliant means, FIPS algorithms versus FIPS 140-3 validated modules. - [FIPS vs NIST SP Series (Standards vs Cryptographic Guidance)](/artifacts/global/fips-standards-hub/fips-vs-nist-sp-series.md): Deep comparison of FIPS standards versus NIST Special Publications in the cryptographic ecosystem: how they differ, how they are used together. - [What Is Included in FIPS Standards Hub (FIPS 140-3, CMVP, FIPS Crypto)](/artifacts/global/fips-standards-hub/what-is-included.md): Coverage map for the FIPS Standards Hub: FIPS 140-3 cryptographic module requirements, CMVP context and guidance. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/fips-standards-hub/fips-vs-common-criteria