Standard · Safety & Security
FIPS 140-3 (Federal Information Processing Standard 140-3)
The US and Canadian validation standard for cryptographic modules, defining four security levels covering algorithm correctness, key management, physical tamper evidence and response, and self-tests.
It adopts ISO/IEC 19790 as its technical basis.
- Also known as
- FIPS 140
- Type
- Standard
- Domain
- Safety & Security, Security standards
Notes
Replaced FIPS 140-2, whose certificates were sunset in 2026, and is effectively mandatory for US federal procurement.
Overview
FIPS 140-3 is the US federal standard, published by NIST, that sets the security requirements a cryptographic module must meet, whether that module is a chip, a hardware security module, a firmware library or a complete device. It is used through a formal validation programme run jointly by NIST and the Canadian Centre for Cyber Security, and federal agencies use the resulting certificates when choosing security products to buy. FIPS 140-3 replaced FIPS 140-2 and draws its detailed requirements from the international standard ISO/IEC 19790.
How it works
The standard was approved in March 2019 and took effect in September 2019. Rather than writing every requirement itself, it points to ISO/IEC 19790:2012 for security requirements and ISO/IEC 24759 for the matching test methods, with NIST's SP 800-140 series adding US-specific changes. The ISO standard defines four increasing security levels across eleven requirement areas, including areas such as physical security, self-tests and the management of keys and other sensitive parameters.
A vendor first defines the cryptographic boundary: exactly which hardware, firmware or software forms the module. An independent testing laboratory accredited under NIST's NVLAP scheme then tests it against the requirements, and the Cryptographic Module Validation Program reviews the report and issues a certificate. Validated modules stay on the active list for five years.
The transition from the older standard is now complete: FIPS 140-2 certificates moved to the historical list on 22 September 2026, and agencies may now use such modules only in existing systems. Validation takes time and money, so vendors plan the boundary and the target level carefully.
Examples
- A secure microcontroller vendor validating its on-chip cryptographic engine and firmware as a hardware module at Level 2 or Level 3.
- A hardware security module for a bank, built to a high security level with tamper response that erases keys when the case is opened.
- A cryptographic software library validated as a software module so that operating systems and applications can inherit its certificate.
- A government buyer replacing equipment whose FIPS 140-2 certificate moved to the historical list in September 2026.
Why it matters
For chip and IP vendors selling into government, defence, finance and many enterprise markets, a FIPS 140-3 certificate can be a condition of sale. Security architects design the module boundary and self-tests, crypto engineers implement the approved algorithms, and certification engineers manage the laboratory work and documentation.
In the chip lifecycle, the target security level and boundary are chosen at architecture, the requirements shape design and verification of the cryptographic blocks and firmware, laboratory testing follows on production silicon, and the certificate must be maintained or renewed as the product and its firmware change.
It matters most to: Cryptographic Library Engineer, FIPS 140-3 Cryptographic Module Validation Engineer, Hardware Cryptography Engineer, Security Certification Engineer (Common Criteria, FIPS 140-3, EMVCo), Security Certification Manager, Semiconductors
Common confusions
- Not the same as Common Criteria
- Common Criteria (ISO/IEC 15408) evaluates a product against a chosen security target or protection profile and is recognised internationally. FIPS 140-3 tests cryptographic modules against one fixed set of requirements for the US and Canadian governments. FIPS 140-3 vs Common Criteria
- Not the same as FIPS compliant
- A product described as FIPS compliant may only use approved algorithms. FIPS validated means the module holds a certificate issued by the Cryptographic Module Validation Program.
- Not the same as FIPS 140-2
- FIPS 140-2 was the previous version, published in 2002 and superseded by FIPS 140-3. Its certificates are no longer accepted for new systems after September 2026.
Related standards
- ISO/IEC 19790 (security requirements for cryptographic modules)
Sources
- FIPS 140-3: Security Requirements for Cryptographic Modules (opens in a new tab), NIST, 2026-10-22
- Cryptographic Module Validation Program (opens in a new tab), NIST, 2026-10-22
- FIPS 140-3 Transition Effort (opens in a new tab), NIST, 2026-10-22
- ISO/IEC 19790:2025 Information security, cybersecurity and privacy protection: Security requirements for cryptographic modules (opens in a new tab), ISO, 2026-10-22
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 11 pages of the Hub. In each group, the pages that mention it most come first.
Lifecycle stages and gates
Roles
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary