How long does a FIPS 140-3 validation take?
As of October 6, 2023, twelve (12) FIPS 140-3 modules are posted on the CMVP validated modules list.
The average time for a FIPS 140-3 validation is 1 year, 7 months, and 2 weeks (584 days). This marks the time the CMVP receives the FIPS 140-3 validation report to the issuance of a FIPS 140-3 certificate.
The average time for the initial CMVP review is 1 year and 1 week (369 days). This is the total of the days the module shows a status of “Review Pending” or “In Review” on the NIST Modules in Process List.
The time spent responding to CMVP comments (Coordination) varies significantly with an average of about 7 months and 1 week (215 days).
KeyPair Consulting – FIPS 140 open-source rebrands & testing