FIPS 140-2 and FIPS 140-3 Simplified

• Companies selling technology that performs encryption to the federal government must obtain NIST certification per its FIPS 140-2 & 140-3 regulations that confirm their cryptography has been tested and approved for use by government agencies

• FIPS 140 validation has been so successful, it has been adopted as mandatory by several additional security regulations, including FedRAMP, StateRAMP, CMMC v2, Common Criteria, DoDIN APL and CNSA 2.0

• While traditional FIPS 140-2 certification took as long as two years, the queue appears to be even longer as the industry transitions to FIPS 140-3

• Without an active FIPS 140-2 or 140-3 certificate in your company's name, federal procurement agents may block the acquisition of your products, freezing you out of markets requiring FIPS validated solutions

• Cryptography is everywhere. It is a key security control that enables privacy, security and trust in our digital world

• Classical cryptography is now under threat by the emergence of quantum computers. Gartner predicts they will soon be able to break virtually all existing public key encryption

• With growing compliance challenges and the emerging threat posed by quantum computers, simply choosing an open-source cryptography module as a cryptography solution is no longer a valid option

NIST has taken the leadership role in identifying and standardizing PQC algorithms that run on classical computers but resist attacks from both classical and quantum computers.

SafeLogic is a member of NIST’s National Cybersecurity Center of Excellence (NCCoE) PQC Migration project.

SafeLogic CEO Evgeny Gervis is leading the PQC Migration Risk Management and Prioritization workstream and attended a recent White House conference with the Federal CIO and CISO.

SafeLogic launched a PQC Provider Early Access Program at the RSA Conference 2024 so customers can start testing and experimenting with PQC algorithms and capabilities such as Discovery, Cryptoagility and Hybrid Use Cases.