[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is FIPS 140-2? Cryptographic Module Validation Program](/blog/fips-140-2) Publish date December 9, 2025 {x} minute read # What is FIPS 140-2? Cryptographic Module Validation Program [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Nicholas Sollitto](/team/nicholas-sollitto) Senior Cybersecurity Writer Nicholas's cybersecurity writing has been featured in G2. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) [FIPS 140-2](https://csrc.nist.gov/pubs/fips/140-2/upd2/final) is a federal information processing standard that manages security requirements for cryptographic modules. The [National Institute of Standards and Technology (NIST)](https://www.nist.gov/) published the security standard in November 2001 to develop coordinated requirements for hardware computer components. NIST replaced FIPS 140-2 with [FIPS 140-3](https://www.upguard.com/blog/fips-140-3) in March 2019. This iteration introduced new critical security parameters for software and firmware and updated the four critical security levels that FIPS 140-2 introduced. These four levels of security include regulations that the U.S. government and other highly regulated industries that store, collect, or disclose [sensitive information](https://www.upguard.com/blog/sensitive-data) ([finance](https://www.upguard.com/industries/financial-services), [healthcare](https://www.upguard.com/industries/healthcare), etc.) must comply with. ## What is Cryptography? [Cryptography](https://www.upguard.com/blog/cryptography) is an [encryption method](https://www.upguard.com/blog/encryption) that utilizes technical codes to [protect sensitive data](https://www.upguard.com/blog/protecting-sensitive-data) and ensure [information security](https://www.upguard.com/blog/information-security). This method commonly uses cryptographic keys, algorithms, and crypto techniques such as microdots or encryption (scrambling plaintext into ciphertext). ## What is Sensitive Data? Sensitive data includes any information, whether original or copied from another source, that contains: * Racial or ethnic origin * Political opinion * Religious or philosophical beliefs * Trade union membership * Genetic data * [Biometric data](https://www.upguard.com/blog/biometrics) * Health data * Sex life or sexual orientation * Financial information (bank account numbers and credit card numbers) * Classified information Some regulatory standards, including the [EU’s General Data Protection Regulation (GDPR)](https://www.upguard.com/blog/compliance-guide-tprm-and-the-gdpr), the [Health Insurance Portability and Accountability Act of 1996 (HIPPA)](https://www.upguard.com/blog/hipaa-privacy-rule), and the [Gramm-Leach-Bliley Act (GLBA)](https://www.upguard.com/blog/glba), all include provisions that protect other types of information as sensitive data. **Recommended reading:**[** **What is the Primary Method for Protecting Sensitive Data?](https://www.upguard.com/blog/protecting-sensitive-data) and[ What is Sensitive Data?](https://www.upguard.com/blog/sensitive-data) ## FIPS 140-1 vs. FIPS 140-2 vs. FIPS 140-3 NIST released the FIPS 140 publication series in 1994 to establish the cryptographic module validation program (CMVP) through a joint effort with the Canadian government. Starting with FIPS 140-1, the publication series now spans three iterations, each improving upon the last and fortifying the validation process with increasingly robust standards. ### FIPS 140-1 As previously mentioned, FIPS 140-1 established the CMVP. The publication is one of NIST’s most successful standards and is still relevant today. Unlike other published standards that have changed in scope or applicability, FIPS 140-1 has only been strengthened by FIPS 140-2 and FIPS 140-3. When the NIST introduced FIPS 140-1, it imposed requirements across eleven areas of cryptographic modules: 1. Cryptographic module specification (documentation and procedural records) 2. Ports and interfaces (what information flows in and out of a cryptographic module) 3. User roles, access levels, and [authentication](https://www.upguard.com/blog/mfa-multi-factor-authentication) 4. Finite state model (documentation of what states a module can occupy and when and why transitions are triggered) 5. Physical security (tamper evidence and resistance) 6. Operational environment (what operating system does a module use) 7. Cryptographic key management (encryption generation, storage, lifecycle, and destruction) 8. Electromagnetic compatibility (what systems is a module compatible with) 9. Security tests (procedures outlining what tests must be completed and the consequences of failure) 10. Module design (documentation that proves a module was designed to meet current industry standards) 11. Attack mitigation (records proving a module has been designed to mitigate particular types of environmental attacks) ### FIPS 140-2 FIPS 140-2 ensures that the hardware organizations utilize to store sensitive data and other protected information meets critical security specifications and key management requirements. This second iteration of the FIPS publication series introduced the FIPS certification process, which is defined by four increasing, qualitative levels of security. #### Qualitative Levels of Security * **Level 1:** Requires organizations to utilize “production-grade” hardware, physical security mechanisms, and externally tested and approved algorithms - **Level 2: **Adds additional requirements for physical tamper-evidence and role-based authentication. It also requires all operating systems to be approved by common criteria - **Level 3: **Adds requirements for identity-based authentication and tamper-proof physical security functions (pick-resistant locks). It also requires a logical separation between the interfaces, enabling “critical security parameters” to enter and leave the module. Encryption keys that meet the Advanced Encryption Standard (AES) are also required during entrances and exits * **Level 4: **Adds physical security requirements that will erase the contents of a device if the system detects severe vulnerabilities or cyber-attacks ### FIPS 140-3 Overall, FIPS 140-3 expanded the scope of FIPS 140-2 to cover firmware and software in addition to hardware computer components. The FIPS 140-3 standard supersedes all FIPS 140-2 standards from its effective date in 2019. FIPS 140-3 also incorporates two existing standards (ISO 19790 and ISO 24759) to elevate its requirements for cryptographic modules and cryptographic algorithms. With FIPS 140-3, NIST also updated several requirements within its qualitative security levels. Most notably, these updates included: * Level 2 security clearance can now be achieved by software modules without common criteria dependency * Level 2 security clearance now includes OS requirements that are similar to the criteria outlined in Common Criteria OSPP * Level 3 security clearance now requires Environmental Failure Testing (EFT) or Environmental Failure Protection (EFP) * Level 4 security clearance now requires Environmental Failure Protection (EFP) to meet voltage and temperature demands * Level 4 security clearance now requires fault induction protection * Level 4 security clearance now requires [multi-factor authentication](https://www.upguard.com/blog/mfa-multi-factor-authentication) ### Where Can I Learn More About FIPS 140-3? The UpGuard blog,[ “What is FIPS 140-3? The Critical Updates You Must Be Aware Of,”](https://www.upguard.com/blog/fips-140-3) includes additional information about FIPS 140-3. The blog also lists additional technical differences between FIPS 140-2 and FIPS 140-3. ## Who Must Comply With FIPS 140? The[ Federal Information Security Management Act (FISMA)](https://www.upguard.com/blog/fisma) requires various U.S. entities to maintain FIPS-compliant cryptographic modules. Canada has also adopted FIPS standards to validate cryptographic modules throughout several highly regulated industries. Overall, the following groups are required to comply with FIPS 140 standards: * U.S. government agencies and U.S. government contractors * Canadian federal agencies and Canadian government contractors * Third parties working alongside federal government agencies * Cybersecurity organizations that market or sell to regulated industries Additional industries, such as [finance](https://www.upguard.com/industries/financial-services), [healthcare](https://www.upguard.com/industries/healthcare), and other highly regulated practices, have also adopted FIPS standards because of the publication’s advanced focus on securing and protecting sensitive data. ## When Will FIPS 140-2 Certificates Be Retired? The U.S. Federal Government is currently establishing practices to validate all FIPS 140-2 certificates with the new standards outlined by FIPS 140-3. In addition, NIST announced that all FIPS 140-2 validations will be retired by September 2026. ## How Can UpGuard Help with FIPS 140-3? UpGuard's [vendor questionnaire software](https://www.upguard.com/product/vendor-risk/questionnaire-management) empowers organizations to achieve compliance across their [digital supply chains](https://www.upguard.com/blog/what-is-the-digital-supply-chain). Users of UpGuard Vendor Risk can access UpGuard’s flexible vendor questionnaire library or configure custom questionnaires of their own using the platform’s intuitive and easy-to-use interface. After sending and receiving [vendor questionnaires](https://www.upguard.com/product/security-questionnaires), organizations can also utilize UpGuard’s remediation workflows to work alongside vendors to solve compliance issues and eliminate compliance risks. Overall, UpGuard Vendor Risk enables organizations to elevate their third-party risk management programs through the use of powerful cybersecurity tools such as: * Objective and up-to-date vendor [security ratings](https://www.upguard.com/product/security-ratings) * Flexible and custom security questionnaires * Comprehensive [vendor risk assessments](https://www.upguard.com/product/risk-assessments) * Powerful and intuitive remediation workflows and more Start your [UpGuard free trial](https://www.upguard.com/demo) right now. Or, discover how UpGuard helps organizations protect their internal and external [attack surfaces](https://www.upguard.com/blog/attack-surface-management) by learning more about [UpGuard’s robust cybersecurity solutions](https://www.upguard.com/). Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)