Skip to main content
Validate cryptographic modules against US federal security requirements.
FIPS 140-3 is a US government standard that specifies security requirements for cryptographic modules. Maintained by NIST, it defines four security levels and is required for cryptographic products used by US federal agencies and many regulated industries.
FIPS 140-3 validation applies to the cryptographic modules themselves. Organizations typically use validated modules rather than seeking validation directly.

​
Who needs FIPS 140-3?

Cryptographic vendors

Companies that build cryptographic modules requiring federal validation.

Federal suppliers

Organizations that must use FIPS-validated cryptography in their products.

​
Key components

Level 1

Basic security requirements for a cryptographic module.

Level 2

Adds tamper-evidence and role-based authentication.

Level 3

Adds tamper-resistance and identity-based authentication.

Level 4

The highest level, with robust physical security against environmental attacks.

​
How DSALTA helps with FIPS 140-3

1

Activate FIPS 140-3

Select FIPS 140-3 from the Frameworks page. DSALTA maps cryptographic requirements to controls.
2

Review crypto controls

Review controls for using and managing validated modules.
3

Collect evidence automatically

Connect integrations to verify use of validated cryptography.
4

Approve policies

Review and approve cryptography and key management policies.
5

Maintain compliance

Track which systems use FIPS-validated modules.

​
Frequently asked questions

No — validation applies to the cryptographic module. Most organizations select and deploy already-validated modules rather than validating their entire product.
FIPS 140-3 is the current standard, aligning with ISO/IEC 19790. New validations are issued under 140-3 as 140-2 is phased out.