Terms / Certification
FIPS 140 validation
A cryptographic module tested and certificated under the NIST validation program. Encryption that is merely strong does not satisfy the requirement.
Also called FIPS validation, FIPS 140, FIPS-validated cryptography.
Practitioner Guidance
What it means in practice
Validated is a specific claim about a specific module, not a property of an algorithm.
SC.L2-3.13.11 asks for cryptography validated under the Federal standard when you protect controlled information. A module earns that by being tested by a laboratory and issued a certificate under the validation program. Using a strong algorithm is not the same thing. The certificate is the evidence, and it names a module, a version, and an operational configuration.
The configuration matters as much as the product.
Many products contain a validated module that only operates in validated mode when a setting is enabled. Full disk encryption and remote access tools both commonly work this way. Turn the mode on, record that you did, and keep the certificate reference. A validated module running outside its validated configuration does not satisfy the requirement.
This is the one requirement the rule lets you carry, and only in one situation.
Section 170.21 bars any requirement worth more than one point from a POA&M. It makes a single exception: the encryption requirement may be carried at three points where encryption is employed but is not validated. Employed matters. Carrying the requirement with no encryption at all is not what the exception allows.
A patch can break validation, and the rule anticipates that.
When a validated version needs a patch and the patched version is not yet validated, the rule gives this as its own example of a temporary deficiency. Documented in your operational plan of action, that is assessed as met. Keep the record rather than hoping nobody notices the version.
What falls short
- Encryption described as meeting the standard with no certificate number recorded. The certificate is the evidence.
- A product whose validated mode was never enabled. The module must run in its validated configuration.
- A certificate for a version you do not run. Validation attaches to the version.
Edge cases
- Your data sits in a cloud service. The provider's validated modules may cover it, so record the inheritance and keep the reference.
- The module is validated and the surrounding product is not. The requirement follows the module protecting the information.
- Your encryption is employed but not validated at assessment time. That is the one case the plan of action exception covers, at three points.
Over-engineering
- Replacing working encryption across the business. The requirement follows the controlled information, so the scope decides where it applies.
- A cryptographic inventory of every system you own. Inventory what protects controlled information and record those modules.