FIPS 140 Validation & Certification

• Companies selling technology that performs encryption to the federal government must obtain NIST certification per its FIPS 140-2 & 140-3 regulations that confirm their cryptography has been tested and approved for use by government agencies

• FIPS 140 validation has been so successful, it has been adopted as mandatory by several additional security regulations, including FedRAMP, StateRAMP, CMMC v2, Common Criteria, DoDIN APL and CNSA 2.0

• While traditional FIPS 140-2 certification took as long as two years, the queue appears to be even longer as the industry transitions to FIPS 140-3

• Without an active FIPS 140-2 or 140-3 certificate in your company's name, federal procurement agents may block the acquisition of your products, freezing you out of markets requiring FIPS validated solutions

Many people assume these are synonyms.  With FIPS, they are not.  In fact, there is a huge difference between them.

Validation means your company's cryptography module has passed a formal testing process with a NIST-approved lab. Certified means your company has received a certificate in its name from NIST that verifies your module has been validated.

Some claim that using another company’s certified module constitutes 'FIPS compliant’(which is called by some 'FIPS inside'). But compliance is not always good enough.  Compliant today may also not be compliant tomorrow if someone else’s module goes out of compliance (e.g., goes historical).  Historical certificates cannot be used for new government acquisitions.

Also, government procurement agents may block acquisition of products that do not have FIPS certification in their own name listed in NIST's validated modules database.

Why take the chance?

• Less Expertise and Effort Required. Sure you could hire and train your own team to work with a FIPS lab to achieve and maintain FIPS certification, but couldn’t your engineers deliver more value to your customers on other projects?
  
  
• Faster Time to Market.  If you are new to federal markets, did you want to start generating revenue in two months or two years?
  
  
• Predictable Fixed Costs Over Time.  How much will it cost you to develop your encryption software, get it certified by NIST, then get it recertified multiple times over it’s lifetime to avoid going Historical? 

No company knows more about FIPS validation than SafeLogic.  We revolutionized the industry 12 years ago with the first expedited validation program, RapidCert.  Now we are revolutionizing the industry again with the first FIPS certification managed service, MaintainCert.

• Only SafeLogic provides the three necessary elements to expedite your initial FIPS validation and certification in two months, then keep your certification valid at a predictable, fixed cost until its sunset date
  
  
• SafeLogic provides full commercial support for your mission-critical products
  
  

• That even includes upgrading you from FIPS 140-2 to FIPS 140-3 as long as your subscription is active

• You're in good company with SafeLogic.  Many of the largest technologies companies in the world rely on SafeLogic to expedite and maintain their FIPS certifications