FIPS (Federal Information Processing Standards)

Key Takeaways

• FIPS is a set of standards developed by NIST to ensure that federal systems use secure, tested, and interoperable technologies.
• The most relevant FIPS standards today focus on cryptography, especially how encryption is implemented and validated across systems.
• FIPS 140-3 is the current encryption standard and replaces FIPS 140-2, introducing stricter testing and better alignment with modern environments like cloud and hybrid systems.
• Organizations use FIPS alongside broader frameworks such as NIST CSF and NIST SP 800-53, which define overall security requirements and controls.
• FIPS validation is often required for organizations working with U.S. federal agencies or handling sensitive government data.
• Even outside government use, FIPS-validated encryption is widely adopted as a trusted benchmark for secure system design.

What is FIPS?

Federal Information Processing Standards (FIPS) were developed by the National Institute of Standards and Technology (NIST) for use in computer systems by non-military United States government agencies and government contractors.

Purpose

FIPS are established to ensure computer security and interoperability. They are created when no suitable existing industry standards exist to meet federal requirements. Many FIPS are modified versions of standards from organizations like ANSI, IEEE, and ISO.

Key Categories of FIPS

The most active and critical FIPS today relate to information security, specifically cryptography.

• FIPS 140 (Security Requirements for Cryptographic Modules): The benchmark standard for defining the security requirements of cryptographic modules (hardware, software, or firmware).
  • FIPS 140-2: The long-standing standard, which stopped accepting new submissions in 2022. All Federal Information Processing Standards 140 2 certificates will move to the “historical” list and be retired on September 21, 2026.
  • FIPS 140-3: The current mandatory standard. It aligns with international standards (ISO/IEC 19790 and 24759), introduces stricter runtime self-tests, requires continuous validation of entropy (randomness), and better accommodates modern cloud-native and hybrid software lifecycles.
• FIPS 197 (AES): Establishes the Advanced Encryption Standard (AES), which replaced the older DES (Data Encryption Standard).
• FIPS 201 (PIV): Specifies requirements for Personal Identity Verification (PIV) for federal employees and contractors.
• FIPS 180 & 202 (Secure Hash Standards): Define algorithms for secure hashing, including SHA-1, SHA-2 (FIPS 180-4), and SHA-3 (FIPS 202).
• FIPS 203, 204, & 205: Recently finalized standards covering post-quantum cryptography, including Module-Lattice-Based mechanisms and stateless hash-based digital signatures.

Geographic and Identification Codes (Legacy/Withdrawn)

Historically, FIPS defined codes to identify geographic entities (counties, states, countries) to ensure uniform data exchange. Most of these have been withdrawn by NIST and replaced by other standards.

• FIPS 5-2 (State Codes) & FIPS 6-4 (County Codes): Withdrawn in 2008 and replaced by INCITS standards, though the U.S. Census Bureau continued using similar “Census Codes” during the transition to the GNIS Feature ID system.
• FIPS 10-4 (Country/Region Codes): Withdrawn and generally replaced by ISO 3166.
• FIPS 55-3 (Place Codes): Codes for cities and towns; withdrawn and replaced by the Geographic Names Information System (GNIS) Feature ID.

Compliance & Status

Mandatory Use: FIPS compliance is generally required for federal agencies and contractors handling sensitive but unclassified information. For example, compliance with FIPS 140-3 is necessary for selling security products to the US and Canadian governments.

Publication Status: NIST categorizes publications as Final (official and current), Public Draft (open for comment), or Withdrawn (obsolete/retired).

Related Terms

CMVP (Cryptographic Module Validation Program): A joint effort by NIST and the Canadian Centre for Cyber Security that validates cryptographic modules against FIPS 140 standards.

NIST Special Publications (SP 800 Series): Guidelines that often accompany FIPS to provide further details on computer security (e.g., SP 800-140 series governs algorithms for FIPS 140-3).

Start Getting Value With
Centraleyes for Free

See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days

Start Free Trial Now

Start Free Trial Now

Learn more about FIPS (Federal Information Processing Standards)
Click Here

How FIPS Connects to NIST Frameworks

FIPS standards are part of the broader ecosystem developed by the National Institute of Standards and Technology (NIST).

NIST frameworks tell you what needs to be secured. FIPS helps ensure how encryption is done meets approved standards

FAQs

1. What are the key changes between FIPS 140 2 and 140-3?

FIPS 140-3 introduces a more modern and structured validation model. It aligns with international ISO standards, adds stronger requirements for runtime testing, and improves how randomness (entropy) is validated.

For most teams, the practical shift is this: certification under 140-3 requires more rigorous testing and better documentation, especially for software running in dynamic environments like cloud systems.

FIPS 140.2 vs FIPS 140-3 (At a Glance)

2. How do post-quantum cryptography standards affect existing FIPS protocols?

The new FIPS 203–205 standards prepare for a future where quantum computers could break today’s encryption methods.

They do not replace existing encryption yet. Instead, they introduce new algorithms that organizations can begin testing and integrating. Over time, systems will need to transition to these quantum-resistant methods, especially in long-term data protection scenarios.

3. Why were the geographic FIPS codes withdrawn?

Geographic FIPS codes were retired because international and industry standards became more widely adopted and easier to maintain.

Standards like ISO 3166 and systems like GNIS provide broader compatibility and more frequent updates, making them better suited for modern data exchange.

4. Does every company need to be FIPS 140 2 or 3 compliant?

No. FIPS is primarily required for organizations working with U.S. federal agencies or selling into government environments.

However, many private organizations adopt FIPS  encryption because it provides a recognized level of assurance and can simplify future compliance requirements.

5. How long does FIPS validation take?

Validation can take several months to over a year, depending on complexity, testing requirements, and backlog in the CMVP program.

This timeline is one reason many vendors plan FIPS validation early in their product lifecycle.

6. How does FIPS relate to broader frameworks like NIST or ISO?

FIPS defines specific technical requirements (especially for cryptography), while frameworks like the NIST SP 800 series or ISO 27001 provide broader security guidance.