FIPS 140-2 Sunset: What the Transition to FIPS 140-3 Means for CMMC Compliance

What the FIPS 140-2 Sunset Means for Defense Contractors 

September 21, 2026, was the last day that active Federal Information Processing Standard (FIPS) 140-2 modules could be used for new systems under NIST’s transition policy. The remaining certificates moved to the Historical List after that date. For defense contractors, the practical question is whether the cryptography already protecting the CUI remains acceptable and what needs to change

The change in certificate status does not, by itself, answer whether an existing product needs to be replaced.
That decision requires a closer look at the module, how it protects CUI, and the requirements governing its use.

For defense contractors pursuing or maintaining Cybersecurity Maturity Model Certification (CMMC) Level 2, the question is how this transition affects the cryptography protecting their CUI. Answering that requires identifying
the modules in use, checking their validation status, and determining what historical status means under the requirements that apply to their environments.

That review provides a basis for deciding what needs to change and when. Contractors should also consider FIPS 140-3 validation when planning purchases and upgrades, so they can account for needed changes before committing resources.

Understanding the FIPS 140-2 Sunset and the Role of CMVP

What Is FIPS 140-2?

FIPS 140-2 established federal security requirements for cryptographic modules used to protect sensitive information. These modules perform functions such as encryption, decryption, and cryptographic key management to protect sensitive information.

A cryptographic module may be a software library, hardware component, or combination of both. The module is not necessarily the entire product. A firewall, for example, may incorporate a validated cryptographic module to encrypt network traffic. That validation applies to the module under specified conditions, rather than to every function of the firewall.

When evaluating a product, contractors need to determine whether the validation covers the version, operating environment, and configuration they’ve deployed.

What Happens When FIPS 140-2 Validations Sunset?

The Cryptographic Module Validation Program (CMVP), jointly administered by the National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security, validates cryptographic modules against federal security standards.

September 21, 2026, was the scheduled sunset date for remaining active FIPS 140-2 validations. Under the transition policy, those certificates moved to the Historical List on September 22.

Historical status means a module with previously completed validation but no longer holds an active certificate. It does not erase that validation, but it raises a question about whether continued use is acceptable in a particular environment.

For defense contractors, the certificate is one part of that decision. They also need to determine whether continued use meets their contractual requirements and the guidance governing their CMMC assessment. Any decision to retain a historical module should identify the authority supporting its continued use and document how that authority applies to the deployed system.

FIPS 140-2 vs. FIPS 140-3: What Has Changed?

FIPS 140-3 replaced FIPS 140-2 and aligned federal cryptographic module validation with international standards. It draws its security requirements from International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 19790 and testing methodologies from ISO/IEC 24759, with additional requirements and guidance from the federal validation program.

Both FIPS 140-2 and FIPS 140-2 define four security levels. The transition changes the requirements and testing use to validate a module, while retaining that four-level structure.

The FIPS 140-2 sunset does not, by itself, make every product using a historical module non-compliant. Whether continued use is acceptable depends on how the module is used and the requirements that apply to the contractor’s environment. 

What Historical Validation Means for Existing Products

When a FIPS 140-2 certificate moves to the Historical List, the module no longer holds an active validation. NIST’s CMVP transition guidance allows federal agencies to continue using historical FIPS 140-2 modules in existing systems only.

That guidance provides context, but a defense contractor still needs to establish whether continued use meets the requirements governing its environment. Those may include NIST Special Publication (SP) 800-171, CMMC assessment guidance, and contractual obligations.

Historical status should prompt a review of the module and its use. If continued use is permitted, document the authority supporting that decision and how it applies to the deployed configuration. If it isn’t, determine what changes are needed to meet the applicable requirements.

Common Misconceptions About the FIPS 140-2 Sunset

Misconception 1: Every FIPS 140-2 validated product must immediately be replaced.

Historical status alone does not establish that a product must be replaced. Review the module, how it protects CUI, and whether applicable requirements permit continued use.

Misconception 2: Products advertised as FIPS compliant automatically meet CMMC requirements.

A product advertised as “FIPS compliant” does not, by that claim alone, demonstrate that it meets CMMC’s cryptographic validation requirement. Verify the module certificate and confirm that it covers the deployed version, operating environment, and configuration.

Misconception 3: Existing FIPS 140-2 validations remain acceptable indefinitely.

A decision to retain a historical module needs a documented basis and periodic review. Changes to applicable guidance, contractual requirements, and vendor support may affect that decision.

How the FIPS 140-2 Sunset Affects NIST SP 800-171 and CMMC Compliance 

For defense contractors, the transition to FIPS 140-3 transition needs to be considered alongside the cryptographic requirements of CMMC Level 2. Level 2 incorporates NIST SP 800-171 Revision 2, including 3.13.11, which calls for FIPS-validated cryptography when it is used to protect the confidentiality of CUI.

When Is FIPS-Validated Cryptography Required?

The key question under requirement 3.13.11 is whether cryptography is being used to protect the confidentiality of CUI.

The requirement does not extend to every cryptographic function simply because it operates within the same environment. The requirement applies when cryptography is used to protect CUI confidentiality.

Depending on how CUI is stored and accessed, examples may include:

• Encryption protecting CUI stored on laptops, servers, and removable media.
• Cryptographic protections securing CUI transmitted across networks.
• Encrypted connections used to protect CUI during remote access or cloud services.

For each use, identify the cryptographic module providing protection. Then verify its validation status and confirm that the deployed version, operating environment, and configuration are covered by the validation.

What Does This Mean for CMMC Level 2 Assessments?

During a CMMC Level 2 assessment, contractors need evidence showing how the cryptographic modules protecting CUI meet the requirements of 3.13.11. NIST SP 800-171A provides the assessment procedures that requirement.

Supporting evidence may include validation certificates, module security policies, software versions, configuration settings, and descriptions of the implementation in the System Security Plan. Together, these records should connect the module’s validation to its actual use in the environment.

A product description that lists AES-256 encryption or advertises a “FIPS mode” does not, but itself, establish module validation. The evidence needs to show that the deployed module and its configuration are covered by validation.

Software updates, firmware changes, and configuration modifications may affect that coverage. Review those changes against the validation documentation and update the supporting records, so they reflect the deployed environment.

How to Verify FIPS Validation and Evaluate Vendor Claims

Vendor statements about FIPS compliance should be supported by verifiable cryptographic module information. The official CMVP database provides validation certificates, module details, and supporting security documentation that organizations can use to evaluate their technology.

Verify Cryptographic Modules Through the CMVP Database 

Identify the cryptographic module the product uses to protect CUI. Then locate its certificate the NIST CMVP Validated Modules Database. Review these details:

	Certificate number and status Record the certificate number and whether its status is active, historical, or revoked.
	Module name and version Confirm that the certificate identifies the module and version used by the product.
	Operating environment Compare the deployed environment with the environments covered by the validation.
	Security policy and configuration Review the module’s security policy and confirm that the deployed configuration meets the conditions required for validated operation.

The certificate needs to support the implementation you are using. A vendor's validation for one module does not establish coverage for every product or configuration that it offers. 

Questions to Ask Technology Vendors 

When reviewing an existing product or evaluating new technology, ask the vendor for documentation supporting its cryptographic validation claims. Useful questions include:

• Which cryptographic module does the product use, and is it validated under FIPS 140-2 or FIPS 140-3?
• What is the CMVP certificate number?
• Does the validation cover the module version, operating environment, and configuration being deployed?
• If the product relies on FIPS 140-2, what is the vendor's plan for moving to a FIPS 140-3 validated module?
• Will the transition require software updates, configuration changes, or product replacement?

Descriptions such as "FIPS compliant," "FIPS capable," and "FIPS-ready" need supporting evidence. Those terms alone do not independently establish that a module has been validated.

Algorithm validation is also separate from cryptographic module validation. Evidence that a product implements an approved algorithm does not establish that its module has been validated. NIST's Cryptographic Algorithm Validation Program explains the algorithm validation process.

Keep the vendor’s responses and supporting records with your assessment evidence. They should show what was verified, what remains unresolved, and the basis for any decision to retain, update, or replace the product.

 

Preparing the Transition to FIPS 140-3

Include FIPS 140-3 when planning technology purchases, upgrades, and replacements. Waiting until a product reaches an end of support may leave less time to evaluate alternatives and make needed changes.

An inventory of the modules protecting CUI, their validation status, and vendor transition plans provide a basis for deciding which changes need attention first and how to budget for them.

Inventory Products That Rely on FIPS-Validated Cryptography

Start by identifying systems, applications, and services that use cryptography to protect CUI.

These may include endpoints, network appliances, operating systems, cloud platforms, remote access technologies, and security tools.

For each relevant product, document the cryptographic module and its version, validation certificate and status, product software or firmware version, operating environment, and configuration required for validated operation.

Flag products that rely on FIPS 140-2modules for review. Record the basis for continued use and any unresolved questions about validation coverage or the vendor’s transition plans.

Keep the inventory current as products and configurations change. It should connect the cryptography operating in your environment with the evidence supporting its use.

Monitor Vendor Transition Plans

Vendors follow different timelines for obtaining FIPS 140-3 validation.

Some products may already incorporate validated modules, while others may have validations in progress or lack a confirmed transition plan.

Ask vendors for current validation documentation, expected timelines, and details about any software or hardware changes the transition will require. For products nearing end of support, consider whether a scheduled upgrade or replacement can also address the cryptographic requirements.

Treat a vendor's planned validation as pending until the certificate has been issued. A vendor’s roadmap can inform your planning, but it does not establish the module is validated.

Include FIPS 140-3 Validation in Technology Lifecycle Management

Review cryptographic validation during procurement, system upgrades, and periodic compliance reviews.

Before committing to a product, verify that its cryptographic modules meet the requirements for its intended use and whether the vendor provides adequate long-term support.

Use the inventory to decide which systems need attention first. Consider how they protect CUI, their validation status, their importance to operations, and how long they’ll remain supported.

Where replacement is needed, coordinate it with scheduled upgrades when the applicable requirements and timelines allow.

Update the documentation when products, configurations, or certificate statuses change. The records should reflect what is deployed and explain the basis for its continued use.

 

How MAD Security Can Help

Reviewing cryptographic validation requires connecting the modules protecting CUI with the evidence supporting their use. That includes identifying gaps and determining what changes may be needed. Through its Virtual Compliance Management (VCM) services, MAD Security helps defense contractors identify compliance gaps, maintain supporting documentation, and coordinate remediation activities.

For the FIPS 140-3 transition, those activities can help contractors establish what they’re using, document unresolved questions, and plan needed changes.

As cryptographic standards evolve, maintaining visibility into security controls and their supporting evidence helps you make informed decisions about your technology and compliance obligations.

 

Prepare for FIPS 140-3 Without Waiting for a
Compliance Gap

Before deciding whether to retain, update, or replace a product, establish which modules protect CUI, what their validations cover, and whether continued use meets the requirements governing your environment. Document the basis for that decision and resolve any questions the available evidence doesn’t answer.

Use those findings to plan needed changes, accounting for compliance requirements, vendor support, and operational needs.

If you need help reviewing evidence or planning the transition, contact MAD Security.

 

Frequently Asked Questions (FAQS)

When did FIPS 140-2 sunset, and what does it mean?

 September 21, 2026, was the last day of active status for the remaining FIPS 140-2 validations. Under NIST's transition policy, these certificates were moved to the Historical List on September 22. That change requires a review of continued use, but it does not establish that every affected product must be replaced.  

Can contractors continue using products with FIPS 140-2 modules?

 Continued use needs a documented basis. NIST’s guidance permits federal agencies to use historical FIPS 140-2 modules in existing systems only. Defense contractors need to determine whether continued use meets their contractual requirements and applicable CMMC assessment guidance. 

Does CMMC Level 2 specifically require FIPS 140-3?

 Requirement 3.13.11 of NIST SP 800-171 Revision 2 calls for FIPS-validated cryptography when it is used to protect CUI confidentiality. It does not name FIPS 140-3 specifically. Whether a historical FIPS 140-2 module remains acceptable requires a separate review of the applicable transition policy, contractual requirements, and assessment guidance.  

How can organizations verify whether a product is FIPS 140-2 or FIPS 140-3 validated?

 Identify the cryptographic module the product uses, then locate its certificate in the NIST CMVP database. Compare the module version, operating environment, and deployed configuration with the certificate and supporting security policy. A “FIPS compliant” or “FIPS-ready” label does not establish validation. 

How should defense contractors prepare for the transition to FIPS 140-3?

 Inventory products that rely on FIPS-validated cryptography to protect CUI. Maintain an inventory of cryptographic modules, verify certificate statuses, and request FIPS 140-3 transition plans from vendors while reviewing NIST's FIPS 140-3 transition information. Use those findings to identify needed changes and plan purchases, upgrades, or replacements. Keep the records current so you understand what is deployed and the basis for its continued use.