December 2025
FIPS 140 is a U.S. government standard that sets security requirements for cryptographic modules in hardware, software, and firmware. NetApp offers cryptographic modules that have achieved FIPS 140 validation.
About FIPS 140
The Federal Information Processing Standard 140 (FIPS 140) is a U.S. government standard that sets security requirements for cryptographic modules in hardware, software, and firmware that protect sensitive information. Compliance with the standard is mandated for use by U.S. government agencies, and it is also often used in such regulated industries as financial services and healthcare.
A cryptographic module is a piece of hardware, software, or a component of either that performs encryption operations. Cryptographic modules include cryptographic algorithms. Under the FIPS 140 standard, both the algorithm and the module are evaluated for compliance, using programs that are jointly developed by the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS).
The Cryptographic Module Validation Program (CMVP) is the accreditation program for cryptographic module security. The Cryptographic Algorithm Validation Program (CAVP) provides guidelines for validating the effectiveness of FIPS-approved and NIST-recommended cryptographic algorithms. A NIST-accredited third-party lab tests these algorithms and their components and validates their implementation and strength through this program.
Security requirements encompass four security levels covering, for example, cryptographic module specification, which is related to the design, strength, and operation of a cryptographic module. Each level includes a description of the methods that the NIST lab uses to evaluate the module.
Level 1 is the least restrictive, specifying the lowest level of security, and Level 4 specifies the highest level. Each level builds on the previous one, requiring more evidence and engineering of the product to demonstrate compliance.
- Level 1 validation requires the cryptographic module to contain FIPS-approved algorithms. Typically, software attains Level 1 validation because the remaining levels specify physical requirements, which cannot be addressed through software.
- Level 2 validation adds physical requirements, such as tamper evidence and opacity. If someone tries to tamper with the device, there should be evidence of it—typically, breakaway screws or adhesive that cannot easily be removed. Opacity requires that a human cannot directly observe what the module that is performing the cryptographic operations is doing. Typically, vendors encase the cryptographic module to meet the opacity requirement.
- Level 3 validation adds requirements for physical tamper resistance to prevent intruders from accessing the cryptographic module. Mechanisms may include strong enclosures and circuitry that detects when the module doors have been opened.
- Level 4 validation requires a complete security envelope that detects and immediately responds to all unauthorized physical access.
Accredited third-party labs perform validation tests of the cryptographic modules against FIPS 140 requirements, issuing a validation certificate that includes the module’s overall rating.
.png?width=5760&format=avif&disable=upscale)