Executive Summary: What is it?
Federal Information Processing Standard (FIPS) 140-3 is the NIST standard specifying security requirements for cryptographic modules: the hardware and software components that perform encryption, decryption, key management, and authentication. Validated modules are listed in the CMVP (Cryptographic Module Validation Program) registry maintained jointly by NIST and the Canadian Centre for Cyber Security. FIPS 140-3 supersedes FIPS 140-2. After 21 September 2026, FIPS 140-2 validations moved to the Historical List, whose modules may be used in existing systems only; new validations are issued under FIPS 140-3.
CFO / Business Impact: What does it cost/risk?
- Federal & DoD Market Access: FIPS 140-3, approved by the Secretary of Commerce, binds every federal agency that uses cryptography to protect sensitive information, including systems contractors operate for it. Self-certification ("we use AES-256") is not sufficient. The library itself must be CMVP-listed.
- CMMC & Impact Level Prerequisite: FIPS 140 validation is a foundational requirement for CMMC (Cybersecurity Maturity Model Certification) and DoD IL2–IL5 authorizations. Under CMMC Level 2 the duty falls on the contractor's own system: it must use FIPS-validated cryptography where cryptography protects the confidentiality of CUI (NIST SP 800-171 requirement 3.13.11).
Technical Reality: How does it work?
- CMVP-Listed Libraries: The cryptographic library in use (e.g., OpenSSL with its FIPS Provider, BoringCrypto, or Microsoft's CNG) must be independently tested by an NVLAP-accredited laboratory and appear on the NIST CMVP active modules list.
- FIPS Mode Enforcement: Self-hosted deployments must be configured to run in a validated "FIPS mode," which disables non-approved algorithms (MD5 for security, DES, RC4) and enforces approved cipher suites (AES-256-GCM, SHA-2/SHA-3, ECDH P-384).
- Key Management: Key generation, storage, zeroization, and destruction procedures must satisfy FIPS 140-3 Level 1 (software) through Level 4 (hardware) requirements depending on the target deployment classification.
What the Label Means in a Solution Profile
FIPS 140-3 validation belongs to a named cryptographic module, tested by an accredited lab and validated by the Cryptographic Module Validation Program (run by NIST and the Canadian Centre for Cyber Security), not to the application that uses it.
- Self-Hosted line: "FIPS 140-3 Ready" means the free self-hosted build offers a documented FIPS mode or build in which all its cryptography runs through modules with an active FIPS 140-3 certificate, in the certified version, with non-approved algorithms switched off. It also has the basic security controls (encryption, role-based access, audit logs and data export).
- Managed service line: "FIPS 140-3 (Self-Assessed)" means the vendor names those certificates. No audited form exists: a certificate validates a module, not a service, and FedRAMP requires validated modules only at Class D.