United States (federal) · federal standard
FIPS 140-3: what it requires, and the records to keep
FIPS 140-3 sets security requirements for cryptographic modules at four increasing levels, by reference to ISO/IEC 19790 and 24759; modules are tested by accredited labs and validated by the Cryptographic Module Validation Program. Since September 2026 all FIPS 140-2 certificates are historical, so new federal purchases look to FIPS 140-3 validations.
01 / What it requires
What FIPS 140-3 requires
Federal agencies and the vendors whose cryptographic modules they buy; validated jointly by NIST and Canada's Cyber Centre through the CMVP.
- 01Use cryptographic modules validated under the CMVP to protect sensitive federal information.
- 02Have modules tested by an accredited lab against ISO/IEC 19790 and 24759 as modified by SP 800-140x.
- 03Meet requirements for the chosen security level (1 to 4), covering interfaces, roles, self-tests, key management and physical security.
- 04Use only approved security functions and keep modules in their validated configuration.
02 / AI work
Where it touches AI work
Applies to AI systems as to any system: encryption of model weights, training data and inference traffic in federal settings must use validated modules.
03 / Dates
The dates that matter
FIPS 140-3 approved
FIPS 140-3 effective
CMVP begins accepting FIPS 140-3 submissions
CMVP stops accepting new FIPS 140-2 submissions
All FIPS 140-2 certificates moved to the Historical List
04 / Enforcement
Who enforces it
NIST and Canada's Cyber Centre run validation; agencies enforce through procurement and authorization (FISMA, FedRAMP). No direct penalties.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01CMVP certificate numbers for each module used
- 02Module security policy and approved-mode configuration
- 03System inventory mapping data flows to validated modules
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
NIST CSRC
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: FIPS 140-3 vs SHA-256 / FIPS 180-4 · FIPS 140-3 for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · SHA-256 / FIPS 180-4 · NIST SP 800-53 Rev. 5