Every time you send sensitive data across a network, cryptographic modules stand between that information and the attackers trying to steal it. But how do you know those encryption modules actually work?
You trust a standard. And for the United States government and dozens of regulated industries, that standard is FIPS 140-3.
FIPS 140-3 is the federal information processing standard that defines security requirements for cryptographic modules used to protect sensitive information in computer and telecommunication systems. It is the baseline.1
If your encryption modules have not been validated against FIPS 140, your cryptographic security has a gap you cannot measure.
What Is FIPS 140-3?
What is FIPS 140-3? It is the current version of the federal information processing standard published by the National Institute of Standards and Technology (NIST). FIPS 140-3 sets the security requirements that cryptographic modules must meet before federal agencies and contractors can deploy them.2
FIPS 140-3 covers cryptographic hardware, software, firmware, and hybrid modules protecting everything from laptops to million dollar funds transfers.
The standard became mandatory for new validations on September 22, 2021. After that date, the CMVP stopped accepting new FIPS 140-2 submissions. Organizations must use FIPS validated encryption to sell to the U.S. government.1
FIPS 140-3 aligns U.S. security standards with international encryption standards, specifically ISO IEC 19790 for security requirements and ISO IEC 24759 for test requirements. This alignment means that cryptographic modules validated under FIPS 140-3 meet both the United States and Canadian governments' requirements through a single certification process.3
Cryptographic Modules and Cryptographic Security Under FIPS 140-3
FIPS 140-3 defines four increasing security levels for cryptographic modules. Each level builds on the one below it, adding stronger protections against increasingly sophisticated attacks.2
Level 1: Approved Cryptographic Algorithms
Level 1 is the entry point. It requires approved cryptographic algorithms and approved security functions but imposes no physical security requirements on the module.
Software-only cryptographic modules typically pursue Level 1 validation. The module must implement algorithms correctly and pass a rigorous testing process, but it can run in a completely unprotected location.4
Level 2: Tamper Evidence and Role-Based Authentication
Level 2 introduces tamper evidence and role-based authentication. Cryptographic modules at this level require tamper-evident mechanisms like coatings, seals, or pick-resistant locks that show visible signs of physical tampering.2
Access control at Level 2 uses role based authentication. Operators must authenticate into defined roles before accessing cryptographic keys or performing sensitive operations.
Level 3: Tamper Resistance and Identity Based Authentication
Level 3 is where FIPS 140-3 gets serious about physical attacks. Cryptographic modules must include tamper resistance mechanisms that actively detect and respond to intrusion attempts.4
Identity-based authentication replaces role-based authentication at this level. Every operator must prove their individual identity, not just their assigned role, before accessing the module.
Level 3 also requires key zeroization, the automatic destruction of cryptographic keys when the module detects tampering. Cryptographic components at this level operate in a guarded facility with strict physical access controls.
Level 4: Maximum Assurance Against Physical and Environmental Attacks
Level 4 offers the highest assurance against physical attacks and environmental attacks. Cryptographic modules validated at Level 4 must resist not just deliberate tampering but also voltage fluctuations, temperature extremes, and other environmental interference.2
This level protects life-protecting data and the most critical government systems. The stringent requirements at Level 4 make it the choice for national security applications where compromise is not an option.
The Cryptographic Module Validation Program
The Cryptographic Module Validation Program (CMVP) is the joint effort between NIST and the Canadian Centre for Cyber Security that validates cryptographic modules against FIPS 140-3.1
How FIPS 140-3 Validation Works
The testing process follows a structured path. Vendors submit cryptographic modules to accredited laboratories certified under the National Voluntary Laboratory Accreditation Program (NVLAP).3
Testing laboratories perform rigorous testing against every applicable FIPS 140-3 requirement. The lab produces a report documenting compliance. The CMVP reviews it, asks questions, and either issues or denies validation certificates.4
The certification process is thorough. Validation runs 18 to 30 months from initiation to certificate issuance. Every module must be independently tested by accredited laboratories before it earns a spot on the CMVP validated modules list.
Cryptographic validation through this program ensures modules meet documented security requirements. FIPS 140-3 emphasizes validation over mere compliance claims from vendors.1
FIPS 140 Compliance Requirements for Federal Agencies
FIPS 140 compliance is law. FISMA requires federal agencies handling sensitive data to use FIPS-validated encryption. This applies to agencies, defense contractors working with controlled unclassified information, and any organization processing personal identity information or administrative data on behalf of the government.2
Compliance requirements extend beyond the federal workforce. Healthcare providers, financial institutions connected to government contracts, and cloud service providers all face FIPS 140 mandates. Organizations using FIPS 140-3 validated modules benefit from meeting regulatory requirements for data protection.3
FIPS 140-3 compliance is required for federal information systems. Federal agencies handling sensitive data cannot deploy cryptographic solutions that lack current FIPS 140-3 validation.
FIPS 140-3 vs. FIPS 140-2: ISO IEC 19790 and ISO IEC 24759 Alignment
FIPS 140-3 replaces FIPS 140-2 entirely. The transition has real deadlines and consequences.
All remaining FIPS 140-2 validation certificates moved to a historical list on September 21, 2026. Modules validated only under the old standard are no longer considered actively validated for new federal procurements.1
The new standard introduces several important changes over its predecessor.
International alignment: The standard adopts ISO IEC 19790 as its technical foundation and uses ISO IEC 24759 for testing. This international standard defines requirements that apply across borders.
Non-invasive attack testing: The updated standard adds testing for side-channel attacks and other modern threats that exploit power consumption, electromagnetic emissions, and timing patterns.
Enhanced lifecycle management: The standard requires more structured documentation for module updates, patches, and the full cryptographic module lifecycle.
Stricter algorithm requirements: Block ciphers must use AES-128 or higher. Legacy algorithms are restricted to decryption-only modes.
FIPS 140-2 certifications transitioned to a historical list after September 21, 2026. Organizations still relying on older validated cryptographic modules need to plan their migration now.4
Who Needs FIPS 140-3 Compliance?
The standard is widely adopted across regulated industries and government ecosystems.
Federal agencies are required by law. Defense contractors handling controlled unclassified information must comply through NIST SP 800-171 and CMMC requirements. Financial institutions that handle government contracts or process million dollar funds transfers use FIPS 140 validated encryption modules as a baseline.2
Healthcare organizations protecting patient records, cloud service providers pursuing FedRAMP authorization, and any vendor selling cryptographic solutions to the U.S. or Canadian governments need current validation.
Data sensitivity determines the obligation. If you protect sensitive data, customer data, personal identity information, or controlled unclassified information, validated cryptographic modules should be part of your security system.3
Protecting Sensitive Data from Cyber Threats with FIPS 140-3
Cyber threats grow more sophisticated every year. Data breaches expose billions of records. Sensitive information flows through networks that attackers probe constantly.
FIPS 140-3 helps protect sensitive data from cyberattacks by ensuring every cryptographic module utilized in a security system has passed rigorous testing. FIPS 140-3 reduces vulnerabilities by enforcing standardized encryption practices across federal agencies and regulated industries.1
Key management, proper implementation, and validated cryptographic hardware all matter. The standard covers all of these through its security levels and test requirements.
Encryption methods that have not been validated through the CMVP may contain implementation flaws invisible to the user. Validation proves that the module works as specified under rigorous testing conditions. Protecting sensitive information starts with knowing your encryption tools actually do what they claim.4
FIPS 140-3 and Post-Quantum Cryptography
The cyber threats landscape is shifting. Post-quantum cryptography algorithms are now being standardized by NIST, and FIPS 140-3 will be the framework through which those new approved cryptographic algorithms are validated.5
As quantum computing advances, cryptographic modules built on today's public key algorithms face future obsolescence. The standard provides the validation infrastructure that ensures new post-quantum cryptography implementations meet the same stringent requirements as current algorithms.
Organizations planning their migration to quantum-resistant encryption methods should ensure their roadmap includes validated cryptographic solutions. The Cryptographic Module Validation Program will remain the gatekeeper for approved security functions in the government ecosystem.
Sources
NIST, "Cryptographic Module Validation Program (CMVP)," https://csrc.nist.gov/projects/cryptographic-module-validation-program
NIST, "FIPS 140-3: Security Requirements for Cryptographic Modules," https://csrc.nist.gov/pubs/fips/140-3/final
NIST, "FIPS 140-3 Transition Effort," https://csrc.nist.gov/projects/fips-140-3-transition-effort
Digi International, "FIPS 140-3 Standard Explained: Compliance, Security Levels, and Real-World Use Cases," https://www.digi.com/blog/post/the-fips-140-3-standard-and-use-cases
NIST, "Post-Quantum Cryptography Standardization," https://csrc.nist.gov/projects/post-quantum-cryptography
