> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FIPS 140-3

> Validate cryptographic modules against US federal security requirements.

> Validate cryptographic modules against US federal security requirements.

FIPS 140-3 is a US government standard that specifies security requirements for cryptographic modules. Maintained by NIST, it defines four security levels and is required for cryptographic products used by US federal agencies and many regulated industries.

<Note>
  FIPS 140-3 validation applies to the cryptographic modules themselves. Organizations typically use validated modules rather than seeking validation directly.
</Note>

## Who needs FIPS 140-3?

<CardGroup cols={2}>
  <Card title="Cryptographic vendors" icon="microchip">
    Companies that build cryptographic modules requiring federal validation.
  </Card>

  <Card title="Federal suppliers" icon="landmark">
    Organizations that must use FIPS-validated cryptography in their products.
  </Card>
</CardGroup>

## Key components

<CardGroup cols={3}>
  <Card title="Level 1" icon="1">
    Basic security requirements for a cryptographic module.
  </Card>

  <Card title="Level 2" icon="2">
    Adds tamper-evidence and role-based authentication.
  </Card>

  <Card title="Level 3" icon="3">
    Adds tamper-resistance and identity-based authentication.
  </Card>

  <Card title="Level 4" icon="4">
    The highest level, with robust physical security against environmental attacks.
  </Card>
</CardGroup>

## How DSALTA helps with FIPS 140-3

<Steps>
  <Step title="Activate FIPS 140-3">
    Select FIPS 140-3 from the Frameworks page. DSALTA maps cryptographic requirements to controls.
  </Step>

  <Step title="Review crypto controls">
    Review controls for using and managing validated modules.
  </Step>

  <Step title="Collect evidence automatically">
    Connect integrations to verify use of validated cryptography.
  </Step>

  <Step title="Approve policies">
    Review and approve cryptography and key management policies.
  </Step>

  <Step title="Maintain compliance">
    Track which systems use FIPS-validated modules.
  </Step>
</Steps>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Do I validate my whole product?" icon="circle-question">
    No — validation applies to the cryptographic module. Most organizations select and deploy already-validated modules rather than validating their entire product.
  </Accordion>

  <Accordion title="How is 140-3 different from 140-2?" icon="code-compare">
    FIPS 140-3 is the current standard, aligning with ISO/IEC 19790. New validations are issued under 140-3 as 140-2 is phased out.
  </Accordion>
</AccordionGroup>

## Related pages

* [Active Frameworks](/guides/compliance/frameworks-active)
* [Available Frameworks](/guides/compliance/frameworks-available)
* [Controls](/guides/compliance/controls)
* [Audits](/guides/compliance/audits)