This is a potential security issue, you are being redirected to https://csrc.nist.gov . Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Documentation Topics Date Published: March 22, 2019 Supersedes: FIPS 140-2 (12/03/2002) Planning Note ( 05/01/2019 ): See the FIPS 140-3 Transition project for the following information: FIPS 140-3 Transition Schedule Supporting SP 800-140x documents that modify requirements of ISO/IEC 19790:2012 and ISO/IEC 24759:2017 See the FIPS 140-3 Transition project for the following information: FIPS 140-3 Transition Schedule Supporting SP 800-140x documents that modify requirements of ISO/IEC 19790:2012 and ISO/IEC 24759:2017

National Institute of Standards and Technology The selective application of technological and related procedural safeguards is an important responsibility of every federal organization in providing adequate security in its computer and telecommunication systems. This standard is applicable to all federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106 and the Federal Information Security Management Act of 2002, Public Law 107-347. This standard shall be used in designing and implementing cryptographic modules that federal departments and agencies operate or are operated for them under contract. The standard provides four increasing, qualitative levels of security intended to cover a wide range of potential applications and environments. The security requirements cover areas related to the secure design, implementation and operation of a cryptographic module. These areas include cryptographic module specification; cryptographic module interfaces; roles, services, and authentication; software/firmware security; operating environment; physical security; non-invasive security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks. The selective application of technological and related procedural safeguards is an important responsibility of every federal organization in providing adequate security in its computer and telecommunication systems. This standard is applicable to all federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106 and the Federal Information Security Management Act of 2002, Public Law 107-347. This standard shall be used in designing and implementing cryptographic modules that federal departments and agencies operate or are operated for them under contract. The standard provides four increasing, qualitative levels of security intended to cover a wide range of potential applications and environments. The security requirements cover areas related to the secure design, implementation and operation of a cryptographic module. These areas include cryptographic module specification; cryptographic module interfaces; roles, services, and authentication; software/firmware security; operating environment; physical security; non-invasive security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks. Publication: https://doi.org/10.6028/NIST.FIPS.140-3 Download URL Supplemental Material: Cryptographic Module Validation Program (CMVP) NIST News Article Related NIST Publications: ITL Bulletin SP 800-140 Document History: 07/13/07: FIPS 140-3 (Draft) 12/11/09: FIPS 140-3 (Draft) 03/22/19: FIPS 140-3 (Final) cryptography , testing & validation E-Government Act , Federal Information Security Modernization Act