Check the NIST FIPS list before you buy a VPN or firewall for an audit

If an audit asks whether your VPN or remote-access encryption uses FIPS-validated cryptography, the vendor’s marketing page isn’t the answer. The answer is a certificate on NIST’s Cryptographic Module Validation Program (CMVP) list, and the details on that certificate matter more than most people expect. Check it before you buy the replacement box, not after.

This matters more than usual right now. NIST stopped accepting FIPS 140-2 modules for new systems after September 21, 2026, and FIPS 140-2 certificates moved to the Historical list. A lot of small-office firewalls and VPN appliances only ever had a 140-2 certificate.

Where to look

The search page is the CMVP validated modules search. Two things trip people up right away:

• The basic search only covers the Active list. To see Historical or Revoked certificates, switch to Advanced search. If a vendor tells you a product “is FIPS validated” and the basic search finds nothing, look again with Advanced before you assume they’re wrong. You may find an old certificate that no longer counts for new systems.
• Search by vendor, not product name. The thing that gets validated is a cryptographic module, and its name often isn’t the product name you know. Microsoft’s Windows user-mode crypto, for example, is certified as the “Cryptographic Primitives Library.” Search the vendor’s name, then read each module’s description to see which products it covers.

Advanced search also lets you filter by standard (140-2 or 140-3), status, and module type.

Active, Historical, and “in process”

Active means the module can be used for new and existing systems.

Historical means existing systems only. NIST’s guidance is that agencies can keep using a module that’s already in place, but you shouldn’t be buying it for a new system. FIPS 140-2 certificates moved here in September 2026, and 140-3 certificates show a sunset date on the certificate page for when they’ll follow.

Revoked means don’t use it at all.

There’s also a separate Modules In Process list of modules the CMVP is actively working on. A vendor whose product is on that list is not validated yet. It may be soon, but “in process” isn’t a certificate.

Read the certificate, not just the status

Open the certificate page itself. The fields worth reading:

• Standard: 140-2 or 140-3.
• Status and Sunset Date.
• Caveat: this is where the conditions live. A common one is “When operated in approved mode,” which means the validation only applies when the product is configured to use the approved algorithms. Other caveats point to a specific section of the Security Policy for setup, or depend on other modules also being validated.
• Security Policy: a PDF linked from the certificate. This is the document that says exactly what was tested.

The Security Policy’s tested platforms

For software modules especially, the Security Policy lists the tested operational environments: the exact operating systems and versions the lab tested on. NIST’s position is that it makes no statement about correct operation on environments that aren’t listed. Some Security Policies also list “vendor affirmed” environments, which the vendor says are equivalent but which weren’t lab-tested.

Microsoft’s Cryptographic Primitives Library certificate is a good example of why this matters. Its Security Policy lists Windows 11 version 22H2 and Windows Server 2022 as the tested environments. If your plan is “use the built-in Windows VPN because Windows crypto is FIPS 140-3 validated,” check that the server and the clients you’ll be running match what that certificate actually covers, and check again when you upgrade.

The same goes for appliances. A certificate for a firewall’s crypto module covers specific hardware models and firmware versions. Make sure the model and firmware you’re quoting are on it.

A quick checklist before you buy

1. Search the vendor in Advanced mode, including Historical.
2. Confirm the certificate is FIPS 140-3 and Active, and note the sunset date.
3. Confirm the product, model, and firmware or OS version you’re buying are covered.
4. Read the caveat and find out what “approved mode” means for that product, and whether turning it on changes features you need.
5. Save the certificate number and a copy of the Security Policy for your audit evidence.
6. If the product isn’t validated, ask the vendor for the certificate number in writing. “In process” and “uses validated algorithms” aren’t the same as a module certificate.

If the audit you’re preparing for is CJIS, the CJIS audit prep article covers what else the auditor will ask for, and the inherited firewall review is a good next step once the box is in.

Sources

• NIST CMVP project page: FIPS 140-2 modules accepted for new systems through September 21, 2026, then moved to the Historical list; Active modules for new and existing systems, Historical for existing systems only
• NIST CMVP validated modules search: basic search covers the Active list; advanced search covers Historical and Revoked
• NIST CMVP Modules In Process list
• NIST CMVP certificate #5410: Microsoft Cryptographic Primitives Library, FIPS 140-3, Active, approved-mode caveat
• Security Policy for certificate #5410 (PDF): tested operational environments (Windows 11 version 22H2, Windows Server 2022) and the vendor-affirmed environment statement