(Last updated September 21, 2026)
On September 21, 2026—the official FIPS 140-2 sunset date—the Cryptographic Module Validation Program (CMVP) will declare all remaining active FIPS 140-2 certificates ‘Historical’. After this date, software vendors can no longer use FIPS 140-2 certificates to support new acquisitions across the U.S. federal government.
What is FIPS 140-2?
FIPS 140-2 is the second iteration of a standard NIST established to define minimum cryptographic security requirements for federal deployments.
NIST published the original standard, FIPS 140-1, in 1994 and FIPS 140-2 in 2001—meaning FIPS 140-2 has served as a foundational element of cybersecurity for a full 25 years. Along the way, it became the benchmark for cryptographic quality. Numerous major security frameworks adopted FIPS 140-2 as their standard, including Common Criteria, FedRAMP, CMMC 2.0, CSfC, FISMA, NIST SP 800-53, and NIST SP 800-171.
In 2019, NIST published its successor, FIPS 140-3. CMVP began FIPS 140-3 testing in 2020 and issued its first certificate in 2023.
What’s Different with FIPS 140-3?
FIPS 140-3 introduces significant enhancements, including alignment with international ISO/IEC standards, heightened physical security requirements, improved key management, stricter software security controls, and updated laboratory testing procedures.
As NIST raised the bar, direct validation lead times expanded dramatically. According to CMVP data, processing times for the CMVP portion of the queue alone increased from an average of 367 days for FIPS 140-2 to 542 days for FIPS 140-3—a 42% increase!
With direct validation timelines stretching to two – three years, starting a ground-up validation now means missing the September 2026 transition window entirely, even if your code and documentation are ready for submission.
Is FIPS 140-2 Still Valid? What CMVP ‘Historical’ Status Means
Many industry professionals refer to September 21, 2026, as the FIPS 140-2 expiration date. While “expiration” is the practical outcome for sales cycles, the official CMVP term is a transition to Historical status.
When a certificate moves to Historical status, three critical distinctions are worth separating:
Historical is not Revoked (or Expired in the Traditional Sense). Your module does not stop working. Systems already running a FIPS 140-2 module remain functional, and the public validation entry stays readable on the CMVP database.
Historical means “No New Procurements”. CMVP guidance explicitly states that Historical modules should not be used in new acquisitions. Any federal procurement, RFP, ATO, FedRAMP authorization, or compliance assessment requiring an active certificate will no longer accept FIPS 140-2 after the FIPS 140-2 sunset date.
Historical is Permanent. There is no path to restore a FIPS 140-2 certificate to Active status. CMVP stopped accepting FIPS 140-2 submissions years ago; the only path forward is a FIPS 140-3 certificate.
What This Looks Like on the Ground
If you sell into the public sector or regulated industries that mirror federal standards, September 22 marks a visible shift:
- RFPs & Questionnaires: Prompts requesting an “active FIPS 140 validation” will no longer accept legacy FIPS 140-2 entries.
- Procurement Reviews: Compliance teams verifying the CMVP database will see “Historical” next to your module—a tag many treats as an automatic disqualifier.
- Competitive Dynamics: Competitors with active FIPS 140-3 certificates will point out your module status to prospective buyers during deal evaluations.
The Hidden Risk of “FIPS Inside” Strategies
To bypass lengthy validation queues, some vendors attempt to rely on “FIPS Inside” claims—asserting their software is compliant because it sits on top of a third-party’s certified cryptographic library.
This strategy introduces severe commercial and operational risk:
- Verification Roadblocks: Procurement officers cannot easily verify if an unvalidated application integrates the certified library correctly or adheres to its official Security Policy.
- Upstream EOL Traps: Third-party vendor roadmaps rarely align with your business goals. For instance, if your application runs an older OS distribution whose vendor certifies FIPS 140-3 only on their newer OS release, they will not backport that validation. To achieve compliance, you may be forced into an unplanned, expensive application rewrite just to support the new OS layer.
Bridging the FIPS 140-3 Validation Gap
You don’t have to wait behind multi-year laboratory queues. SafeLogic’s CryptoComply software is already FIPS 140-3 validated, enabling you to:
- Replace open-source cryptographic libraries with minimal code modifications.
- Secure your entire stack—from cloud containers and servers to mobile devices, desktops, and embedded systems.
- Support modern programming environments, including C/C++, C#, Java, Go, Python, and Rust across Linux, Windows, macOS, iOS, Android, and UNIX.
- Obtain a branded FIPS 140-3 certificate in your own company’s name in just two to three months via RapidCert.
September 21 is coming either way. The question is whether your customers discover your compliance status from the CMVP database or from your team.
Talk to us about getting to FIPS 140-3. Frequently Asked Questions
What is the official FIPS 140-2 sunset date?
The official FIPS 140-2 sunset date is September 21, 2026. On September 22, 2026, all remaining active FIPS 140-2 modules transition permanently to the CMVP Historical List.
Does FIPS 140-2 expire on September 21, 2026?
While September 21, 2026, acts as a practical FIPS 140-2 expiration date for new procurements, the code does not stop running. NIST allows agencies to maintain existing FIPS 140-2 deployments, but the certificates can no longer be used for new sales, contracts, or system expansions.
Can federal agencies continue using deployed FIPS 140-2 modules?
Yes. Historical status permits existing deployments to remain operational based on agency risk assessments. However, Historical modules cannot be specified for new procurements or system expansions.
How long does it take to achieve FIPS 140-3 validation after the FIPS 140-2 expiration?
Direct laboratory testing and CMVP processing currently average 18 to 30 months. By leveraging SafeLogic’s pre-validated CryptoComply foundation and RapidCert program, vendors can receive a FIPS 140-3 certificate in their company name in two to three months.
