How long does a FIPS 140-3 validation take?
As of February 8, 2024, fourteen (14) FIPS 140-3 modules are posted on the CMVP validated modules list.
The average time for a FIPS 140-3 validation is 1.59 years (579 days or 1 year, 7 months and 4 days). This marks the time the CMVP receives the FIPS 140-3 validation report to the issuance of a FIPS 140-3 certificate.
The average time for the initial CMVP review is 1 year (366 days). This is the total of the days the module shows a status of “Review Pending” or “In Review” on the NIST Modules in Process List. This is represented by the blue portion of the bars in the graph below.
The time spent responding to CMVP comments (“Coordination” or “Finalization”) varies significantly with an average of 7 months and 3 days (213 days). This is represented by the green portion of the bars in the graph below.
Notes:
- Cert. #4650 not included in the totals due to insufficient data from the NIST Modules In Process List. (Inclusion on the MIP List is optional.)
- The CMVP began accepting FIPS 140-3 submissions on September 22, 2020.
- Recently posted Cert. #4676 is the first submission to complete the FIPS 140-3 validation review process in less than 1 year.
KeyPair Consulting – FIPS 140 open-source rebrands & testing