BY NEURABYTE
FRAMEWORKS/GOVERNMENT/FIPS 140 / CMVP
FIPS
GOVERNMENT · NIST and the Canadian Centre for Cyber Security

FIPS 140 / CMVP

Validated cryptography for federal systems.

FIPS 140-3 sets security requirements for cryptographic modules, and the Cryptographic Module Validation Program (CMVP) tests and certifies them. Federal agencies must use validated modules to protect sensitive information. Validation applies to a specific module and version, not to a product as a whole.

AT A GLANCE
ISSUERNIST and the Canadian Centre for Cyber Security REGIONUS and Canadian federal CATEGORYGovernment CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Vendors selling to US or Canadian federal agencies
02Products inside FedRAMP or CMMC boundaries
03Regulated customers whose policy requires validated cryptography
02. KEY REQUIREMENTS

The parts of FIPS 140 / CMVP that touch what agents do.

Validated modules
Cryptographic operations protecting sensitive data run in a CMVP-validated module.
Approved algorithms
Only approved algorithms and key sizes are used in approved mode.
Key management
Keys are generated, stored and zeroized according to the module security policy.
Self-tests
Modules run power-on and conditional self-tests and fail closed on error.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against FIPS 140 / CMVP. Where there is no evidence, the report says gap.

LORE CONTROL FIPS 140 / CMVP REFERENCE
Receipt signingApproved-mode signing when a validated module is configured
BYOK / HSM custodyKeys held in a validated HSM
Trust substrate KMSKey lifecycle and zeroization records
Signed, hash-chained receiptsRecord of which module and key signed
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Lore is not itself a validated cryptographic module. Validation belongs to the module you configure.
Whether a deployment meets an agency FIPS policy is that agency’s determination.
05. QUESTIONS
Is Lore FIPS validated?
No. Lore records which module and key performed each signature, so you can show validated cryptography was in the path when you configure it.
What does "modeled regime" mean?
Obligations and deadlines, such as the FIPS 140-2 sunset, are tracked as data so you can see what applies and when.
140-2 or 140-3?
FIPS 140-2 certificates move to the historical list in September 2026. New validations are under 140-3.
← PREVIOUSCyber Resilience Act ALL FRAMEWORKS NEXT →eIDAS
FIPS 140 / CMVP · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for FIPS 140 / CMVP tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.