DataTerminology.comNEW
Also known as: Federal Information Processing Standards 140-3
A U.S. federal standard that specifies security requirements for cryptographic modules used to protect sensitive information.
DESCRIPTION
FIPS 140-3 defines criteria for designing, implementing, and validating cryptographic modules, ensuring they meet rigorous security requirements. Managed by NIST’s CMVP with Canada’s CCCS, it covers areas like module interfaces, roles, services, physical security, and self-tests. Vendors undergo conformance testing for certification. FIPS 140-3 aligns closely with ISO/IEC 19790, updating the widely used FIPS 140-2.
ALTERNATIVE DEFINITIONS
NIST
This publication specifies the security requirements that will be satisfied by a cryptographic module utilized within a security system protecting sensitive information.
Authoritative standard language defining scope and purpose.
NIST CMVP
The Cryptographic Module Validation Program (CMVP) is a joint effort between NIST and the Canadian Centre for Cyber Security (CCCS) to validate cryptographic modules to FIPS 140-3.
Emphasizes the validation program and international partnership.
RELATED TERMS
NIST CMVP Cryptographic Module Hardware Security Module Rijndael TLS Certification FedRAMP SP 800-140
COMPETING TERMS
FIPS 140-2 ISO/IEC 19790
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure AI Governance
TARGET AUDIENCE
Chief Information Security Officer Security Architect Cybersecurity Engineer Cloud Architect IT Auditor IT Manager
EXTERNAL SOURCES
- Wikipedia - FIPS 140-3
- NIST - Official FIPS 140-3 standard
- Canadian Centre for Cyber Security - Canadian CMVP partner overview
- AWS - AWS guidance on FIPS compliance
TOP QUESTIONS
What is FIPS 140-3?
It is a U.S. federal standard specifying security requirements for cryptographic modules used to protect sensitive information.
Category: Definition
Why is FIPS 140-3 relevant to enterprises?
It ensures cryptographic modules meet rigorous security criteria, supporting compliance and trust in cryptographic protections.
Category: Relevancy
How does FIPS 140-3 differ from FIPS 140-2?
FIPS 140-3 aligns with ISO/IEC 19790 and updates requirements, superseding 140-2 with modernized criteria.
Category: Distinction
Who validates modules against FIPS 140-3?
NIST’s CMVP, in partnership with Canada’s CCCS, validates modules through accredited labs.
Category: Governance
What are the FIPS 140-3 security levels?
It defines multiple security levels reflecting increasing assurance, from basic to robust physical and logical protections.
Category: Overview
What’s a common mistake regarding FIPS 140-3?
Assuming algorithm implementation alone suffices; module-level requirements and validation are mandatory.
Category: Mistakes
Does FIPS 140-3 apply to cloud services?
Yes, cloud services often use FIPS-validated modules for crypto operations, especially for regulated workloads.
Category: Applicability
How do we plan for FIPS 140-3 compliance?
Inventory cryptographic modules, verify validation status, and work with vendors offering FIPS-validated components.
Category: Requirements
Is ISO/IEC 19790 an alternative to FIPS 140-3?
ISO/IEC 19790 is closely aligned and internationally recognized; many organizations reference both.
Category: Alternatives