Identify the requirement
Ask which cryptographic service must use a validated module and where that service runs.
FIPS · US cryptographic standards
Evaluating FIPS 140 module validation for file transfers
If procurement requires validated cryptography, request the module name, certificate and deployed version. Compare them with the operating environment proposed for your exchange.
Locate the implementation
Record the module version and the boundary within which it performs the operation.
Compare the operating conditions
Read the certificate and security policy against the actual configuration.
Check the module behind the encryption claim
Match the certificate number to the deployed version and approved operating conditions. Keep discrepancies in your procurement record.
| When you hear | Ask instead | Why it matters |
|---|---|---|
| “We use AES.” | Which module performs the cryptography? | An approved algorithm alone does not establish module validation. |
| “The module is validated.” | What is the certificate number and exact version? | The listed implementation must match what is actually deployed. |
| “It runs in FIPS mode.” | What configuration and security policy apply? | Approved operation may depend on specific settings and procedures. |
| “Our product is covered.” | Which cryptographic services and boundaries are covered? | A component’s validation is not a blanket assurance for every product feature. |
Distinguish algorithm, module and service
Ask the supplier to identify evidence for each layer and explain which part of the exchange that evidence covers.
| Layer | Scope of the review |
|---|---|
| Algorithm | The cryptographic function.Identify the operation required for this workflow and where in the service that operation runs. |
| Module | The defined implementation.Match the module name, version and certificate to the component performing the operation. |
| Deployment | Your actual use.Check the module security policy and approved operating conditions against the configuration proposed for deployment. |
Turn a requirement
into a useful brief.
Bring your contract language and architecture questions to the discussion. Request evidence before deciding whether a service fits.
Discuss your security requirementsYour review should record
- The contractual standard and required assurance level
- The information and transfer paths in scope
- Module identity and current validation evidence
- Operating conditions and configuration owner
- Any gaps requiring resolution before use
Check current CMVP records at the time of procurement; certificate status and transition rules can change.
A few important
distinctions.
Is this a claim that MX is FIPS validated?
No. This page explains how to evaluate a requirement. Request current evidence from MX and verify that it applies to the proposed deployment before relying on any FIPS-related claim.
Are FIPS and FIPS 140-3 the same thing?
FIPS refers to a broader family of standards. FIPS 140-3 specifically sets security requirements for cryptographic modules. Start by identifying the exact standard referenced by your contract.
Does an algorithm certificate validate the entire product?
No. Algorithm validation and cryptographic module validation have different scopes. A product can also contain a validated component without all of its functions being covered.
Where can we verify module details?
Use the NIST CMVP validated-module search, then review the certificate and associated security policy. Ask the supplier to explain how that evidence maps to the actual service.