Compliance FrameworksAmericas
FIPS 140-3
Cryptographic modules: crypto component inventory, version pinning, PURL/CPE, hash integrity.
Cryptographic modules: crypto component inventory, version pinning, PURL/CPE, hash integrity.
| Short name | FIPS |
| Region | Americas |
| Country or scope | United States |
| Sector | Government |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers FIPS
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for FIPS.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for FIPS and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
FIPS140-SPEC-INV Module Component Specification | The cryptographic module specification must define the module's boundary and enumerate all hardware, software and firmware components within it (FIPS 140-3 / ISO/IEC 19790, cryptographic module specification requirements) | Scan |
FIPS140-VER Versioned Module Components | Validation applies to specific versions of the module's software and firmware, so every component must carry an exact version matching the validation certificate (FIPS 140-3 / ISO/IEC 19790, versioning of validated modules) | Scan |
FIPS140-VERSPEC No Floating Crypto Versions | A module cannot remain within its validated configuration if component versions are expressed as ranges or 'latest'; versions must be pinned exactly (FIPS 140-3 validation scope; CMVP guidance on module versioning) | Scan |
FIPS140-INTEG Software Integrity Test Evidence | Modules must perform pre-operational integrity verification of software and firmware using approved techniques, which presupposes published cryptographic digests for the components (FIPS 140-3 / ISO/IEC 19790, pre-operational software/firmware integrity test) | Scan |
FIPS140-ID Unambiguous Component Identification | Life-cycle assurance requires configuration items to be uniquely identified throughout development and delivery, satisfied by standard identifiers such as PURL or CPE (FIPS 140-3 / ISO/IEC 19790, life-cycle assurance - configuration management) | Scan |
FIPS140-CM-DOC Configuration Management Records | Configuration management documentation for the module must be maintained and traceable, requiring identifiable and dated composition records (FIPS 140-3 / ISO/IEC 19790, life-cycle assurance documentation) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
FIPS140-3-L1-01 | Use FIPS 140-3 validated cryptographic modules |
FIPS140-3-L2-01 | Implement physical security for Level 2 modules |
FIPS140-3-KM-01 | Manage cryptographic keys using approved key management procedures |
FIPS140-3-AS-01 | Use only approved cryptographic algorithms |
FIPS140-3-SE-01 | Protect sensitive security parameters within modules |
FIPS140-3-ST-01 | Perform self-tests on cryptographic modules |
FIPS140-3-OP-01 | Operate modules in approved operational modes only |
FIPS140-3-AU-01 | Audit use of cryptographic modules |
Policy templates
Written for FIPS:
- FIPS 140-3 Cryptographic Module Selection and Use Policy
- Cryptographic Key Management Policy (FIPS 140-3)
- FIPS-Compliant TLS and Protocol Configuration Policy
And 22 from the standard set, adapted to FIPS.