The CMVP posted 421 FIPS 140 certificates from January through September 2026, more than three times the 139 posted during the same period in 2025. With three months still remaining, 2026 has already surpassed the previous full-year record of 331 certificates posted in 2021.
Nearly all of this year’s certificates—416 of 421—are FIPS 140-3, compared with 126 of 139 during January through September 2025.
Of the 421 certificates, 120 (29%) were rebrands, 65 (15%) replaced interim certificates, and 236 (56%) were other validations.
atsec leads the laboratories with 94 certificates associated with its work during the first nine months of 2026.
DEKRA follows with 73, and Lightship ranks third with 68.
Security Level 1 accounted for 76% of all FIPS 140 certificates posted from January through September 2026.
Software modules accounted for 56% of all FIPS 140 certificates posted from January through September 2026.
With the sunsetting of all FIPS 140-2 certificates in September of 2026, 48% of the active FIPS modules were moved to Historical status.
