FIPS Compliance Guide: U.S. Agencies & Contractors Step-by-Step

Federal Information Processing Standards (FIPS) are mandatory security benchmarks the U.S. government sets for federal agencies and contractors handling sensitive data. These standards ensure consistent, secure processing of federal information across all systems, protecting against cyber threats and unauthorized access.

FIPS compliance is not optional—it is legally required under the Federal Information Security Management Act (FISMA) and enforced by the National Institute of Standards and Technology (NIST). Agencies and contractors must adhere to specific FIPS publications, such as FIPS 140-3 for cryptographic modules, to maintain eligibility for federal contracts and avoid penalties.

---

FIPS are developed and maintained by NIST under the authority of the Federal Property and Administrative Services Act (40 U.S.C. § 11331) and the E-Government Act of 2002 (Pub. L. 107-347). These laws mandate that federal agencies and their contractors use standardized, secure information processing methods.

Key Governing Authorities:

• National Institute of Standards and Technology (NIST): Issues and updates FIPS publications.
• Office of Management and Budget (OMB): Enforces FIPS compliance through OMB Circular A-130, which requires agencies to implement security controls.
• Federal Information Security Management Act (FISMA): Codifies the requirement for federal agencies to secure information systems using FIPS-validated solutions.
• Federal Acquisition Regulation (FAR): Mandates FIPS compliance for contractors under FAR Subpart 39.101, which requires the use of FIPS-validated cryptographic modules in federal procurements.

Core FIPS Publications:

---

1. Determine Applicability

Federal agencies and contractors must first assess whether their systems or products fall under FIPS requirements. Compliance is mandatory if:

• The system processes, stores, or transmits federal information.
• The system is used to protect sensitive data (e.g., personally identifiable information, financial records, or classified information).
• The system is part of a federal contract that explicitly requires FIPS compliance.

Action: Review FAR 39.101 and NIST Special Publication 800-53 to confirm applicability.

---

2. Identify Relevant FIPS Standards

Select the appropriate FIPS publication(s) based on the system or product:

• FIPS 140-3: For cryptographic modules (e.g., encryption software, hardware security modules).
• FIPS 199/200: For security categorization and baseline controls.
• FIPS 201-3: For identity verification systems (e.g., PIV cards).

Action: Consult the NIST FIPS Publications List to identify applicable standards.

---

3. Implement FIPS-Validated Solutions

For FIPS 140-3, agencies and contractors must use NIST-validated cryptographic modules. These modules undergo rigorous testing by accredited laboratories to ensure compliance.

Steps to Implement FIPS-Validated Cryptography:

1. Select a FIPS-Validated Module:
• Browse the NIST CMVP Validated Modules List.
• Choose a module with a FIPS 140-3 validation certificate (or FIPS 140-2 if grandfathered).

2. Integrate the Module:
• Configure the module according to the vendor’s FIPS Implementation Guidance (IG).
• Disable non-FIPS-approved algorithms (e.g., SHA-1, DES, RC4).

3. Document Configuration:
• Maintain records of the module’s validation certificate number, security policy, and configuration settings.
• Include this documentation in the system’s System Security Plan (SSP).

Action: Work with vendors to ensure the module is properly integrated and documented.

---

4. Conduct Security Categorization (FIPS 199/200)

For systems handling federal information, agencies must:

1. Categorize the System:
• Use FIPS 199 to classify the system as Low, Moderate, or High impact based on the potential harm of a security breach.
• Example: A system storing Social Security numbers would likely be categorized as High impact.

2. Apply Baseline Controls:
• Use FIPS 200 to select the appropriate security control baseline from NIST SP 800-53.
• Example: A Moderate-impact system must implement controls from NIST SP 800-53 Revision 5, Moderate Baseline.

Action: Document the categorization and control selection in the System Security Plan (SSP).

---

5. Submit for Validation (FIPS 140-3)

For cryptographic modules, vendors or agencies must submit the product for validation through the Cryptographic Module Validation Program (CMVP).

Validation Process:

1. Engage an Accredited Testing Laboratory:
• Select a lab from the NIST-accredited list.
• Example labs: atsec, Leidos, UL.

2. Prepare Documentation:
• Submit the Security Policy, Finite State Model, and Module Design Documentation to the lab.

3. Undergo Testing:
• The lab tests the module against FIPS 140-3 requirements, including:
• Cryptographic algorithm validation.
• Physical security (for hardware modules).
• Key management and authentication.

4. Receive Validation Certificate:
• If successful, NIST issues a FIPS 140-3 validation certificate.
• The module is added to the NIST Validated Modules List.

Action: Plan for a 6-12 month validation timeline and budget for testing costs (typically $50,000–$200,000).

---

6. Maintain Compliance

FIPS compliance is not a one-time effort. Agencies and contractors must:

• Monitor for Updates: NIST periodically updates FIPS publications (e.g., FIPS 140-3 replaced FIPS 140-2 in 2019).
• Revalidate Modules: FIPS 140-3 certificates expire after 5 years. Modules must be retested to maintain compliance.
• Conduct Annual Assessments: Under FISMA, agencies must perform annual security assessments and update their System Security Plans (SSPs).

Action: Assign a Compliance Officer to track FIPS updates and revalidation deadlines.

---

Common Compliance Mistakes

1. Using Non-Validated Cryptography:
• Agencies or contractors may inadvertently use non-FIPS-approved algorithms (e.g., MD5, SHA-1).
• Fix: Disable non-FIPS algorithms in system configurations.

2. Misclassifying System Impact:
• Incorrectly categorizing a system as Low impact when it should be Moderate or High.
• Fix: Conduct a thorough FIPS 199 impact assessment with stakeholders.

3. Failing to Document Compliance:
• Missing System Security Plans (SSPs) or FIPS validation certificates.
• Fix: Maintain a compliance repository with all required documentation.

4. Ignoring Revalidation Deadlines:
• FIPS 140-3 certificates expire after 5 years. Using an expired module violates FISMA.
• Fix: Set calendar reminders for revalidation 12 months before expiration.

---

Exceptions to FIPS Compliance

FIPS requirements may not apply in the following cases:

• Legacy Systems: Systems in operation before FISMA (2002) may be grandfathered if they meet alternative security controls.
• National Security Systems (NSS): Systems operated by the Department of Defense (DoD) or Intelligence Community (IC) may follow DoD or IC-specific standards instead of FIPS.
• Commercial Off-the-Shelf (COTS) Products: Some COTS products may be exempt if they are not modified for federal use.

Note: Exceptions require written approval from the agency’s Chief Information Officer (CIO) or Designated Approving Authority (DAA).

---

Penalties for Non-Compliance

Failure to comply with FIPS can result in:

• Contract Termination: Federal contracts may be terminated for default under FAR 52.239-1.
• Fines and Penalties: Agencies or contractors may face civil penalties under FISMA (44 U.S.C. § 3554).
• Loss of ATO: Systems may lose their Authority to Operate (ATO), halting operations.
• Reputational Damage: Non-compliance can lead to negative audits and loss of future federal contracts.

Example: In 2020, a federal contractor was fined $1.2 million for using non-FIPS-validated encryption in a healthcare system, violating HIPAA and FISMA.

---

What is the difference between FIPS 140-2 and FIPS 140-3?

FIPS 140-3 is the current standard for cryptographic modules, replacing FIPS 140-2 in September 2019. Key differences include:

• Stricter testing requirements for physical security and side-channel attacks.
• Updated cryptographic algorithms (e.g., SHA-3, AES-GCM).
• New entropy requirements for random number generation.

Modules validated under FIPS 140-2 remain valid until their 5-year certificate expires.

---

Do state and local governments need to comply with FIPS?

FIPS compliance is mandatory for federal agencies and contractors. State and local governments are not required to comply unless:

• They receive federal funding with FIPS compliance stipulations.
• They handle federal information (e.g., Medicaid data, federal grants).
• They are subcontractors to a federal prime contractor.

Example: A state Medicaid agency must comply with FIPS 140-3 if it processes federal healthcare data.

---

How long does FIPS 140-3 validation take?

The validation process typically takes 6–12 months, depending on:

• Module complexity (software vs. hardware).
• Laboratory availability (testing labs may have backlogs).
• Documentation readiness (incomplete submissions delay testing).

Tip: Start the process 12–18 months before contract deadlines to avoid delays.

---

Can I use open-source cryptographic modules for FIPS compliance?

Yes, but the module must be FIPS-validated. Examples of open-source FIPS-validated modules include:

• OpenSSL FIPS Object Module (validated under FIPS 140-2).
• Libgcrypt (used in some FIPS-validated distributions).

Note: Open-source modules often require vendor-specific validation (e.g., Red Hat Enterprise Linux includes a FIPS-validated OpenSSL module).

---

What happens if my FIPS-validated module fails testing?

If a module fails validation:

1. The testing lab provides a detailed report of deficiencies.
2. The vendor or agency must fix the issues and resubmit the module.
3. The lab retests the module, which may incur additional costs.

Tip: Conduct pre-validation testing with a lab to identify issues early.

---

Are cloud service providers (CSPs) required to comply with FIPS?

Yes, if the CSP processes federal information. Under FedRAMP, CSPs must:

• Use FIPS-validated cryptographic modules for data protection.
• Obtain FedRAMP authorization, which includes FIPS compliance.
• Provide FIPS validation certificates for all cryptographic modules.

Example: AWS GovCloud and Microsoft Azure Government are FedRAMP-authorized and FIPS-compliant.

---

FIPS Compliance Checklist

• ✅Determine Applicability:
• Review FAR 39.101 and NIST SP 800-53 to confirm FIPS requirements.

• ✅Identify Relevant FIPS Standards:
• Select FIPS 140-3, FIPS 199/200, or FIPS 201-3 based on system needs.

• ✅Implement FIPS-Validated Solutions:
• Choose a NIST-validated cryptographic module from the CMVP list.
• Disable non-FIPS-approved algorithms.

• ✅Conduct Security Categorization:
• Use FIPS 199 to classify the system as Low, Moderate, or High impact.
• Apply NIST SP 800-53 controls based on the impact level.

• ✅Submit for Validation (FIPS 140-3):
• Engage an accredited testing lab.
• Prepare and submit Security Policy and Module Documentation.
• Await validation certificate (6–12 months).

• ✅Maintain Compliance:
• Monitor FIPS updates from NIST.
• Schedule revalidation 12 months before certificate expiration.
• Conduct annual FISMA assessments.

---

Official Resources & Contact Information

Disclaimer: This article is for informational and educational purposes only. It does not constitute formal legal advice and does not establish an attorney-client relationship.