September 16, 2026
FIPS 140-2, FIPS 140-3, and CMMC: What Contractors Need to Know
Listen: Oscar W. Murray, Managing Director, reads this post.
The transition from Federal Information Processing Standard (FIPS) 140-2 to FIPS 140-3 is more than a technical standards update. It directly affects how organizations select, document, and defend the cryptography used to protect Controlled Unclassified Information (CUI).
On September 22, 2026, the remaining FIPS 140-2 validated modules move from the National Institute of Standards and Technology (NIST) Active list to the Historical list. That does not mean every FIPS 140-2 product suddenly becomes noncompliant. But you have days, not months, to make sure the words "FIPS validated" in your documentation still hold up.
Historical does not mean revoked
Currently validated and appropriate for new implementations
No longer active, but still supported for existing systems
Validation withdrawn and cannot be relied upon
Why this can't wait
If the July suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II made you relax, read the fine print. The Department of War said it will enforce NIST SP 800-171 through self-assessments and select government-led assessments, and every contractor remains obligated under DFARS 252.204-7012.
A self-assessment is a statement your company makes to the federal government. When that statement turns out to be wrong, it becomes a False Claims Act problem. Aerojet Rocketdyne paid $9 million in 2022 to resolve allegations, brought by a former employee, that it misrepresented its cybersecurity compliance.
"Our encryption is FIPS validated" is one of the easiest claims to make, and one of the easiest to get wrong.
Seven changes. Two should worry you now.
FIPS 140-3 changed more than the version number. We count seven changes that matter to organizations protecting sensitive government data. Two of them can make a compliant looking environment indefensible.
1. "FIPS mode is on" is no longer proof
Picture a company that did everything right on paper. IT turned on the Windows FIPS policy across every laptop, and the screenshot is in the evidence folder. But the file transfer tool engineering uses to send drawings to the prime contractor ships with its own encryption library, and that library never checks the Windows setting. Everyone believes the CUI moved over validated cryptography. No one can prove it did.
FIPS 140-2 only asked whether a module was operating in an approved mode. FIPS 140-3 requires each cryptographic service to indicate whether that specific operation used approved cryptography in an approved way. The checkbox is no longer the evidence. The indicator is.
"Show me your FIPS 140-3 certificate number, and show me how your product indicates that an operation used approved cryptography."
2. Strong encryption with weak keys is still broken
In 2012, university researchers scanned the internet and computed the private keys for 64,000 TLS hosts and 108,000 SSH hosts, mostly headless or embedded devices. The algorithms were fine. The devices generated their keys without enough randomness, so the keys could be recovered.
It has happened in mainstream software too. For roughly 20 months, from September 2006 to May 2008, the random number generator in Debian's OpenSSL package was predictable. SSH keys, OpenVPN keys, and TLS keys created on those systems had to be thrown away and regenerated.
FIPS 140-3 validations are reviewed under NIST's entropy guidance, and the certificate states when a module gives no assurance of minimum key strength. That caveat is printed right on the certificate. Most organizations never read past the certificate number.
Look up the modules in your VPN, firewall, and file transfer tools in the NIST validated modules search. Read the caveats, not just the status.
The other five
The remaining five changes are quieter, and some of them decide whether the products you already own can ever carry a FIPS 140-3 certificate. They are the conversation we would rather you have with us than with an assessor.
Would you sign your "FIPS validated" claim today?
Before your next self-assessment, talk to PMV. We will walk you through all seven changes, what they mean for the products you already own, and what needs to be documented so your claim holds up.
Talk to PMV