A federal agency workload must use validated cryptography. The SaaS vendor's sales material states that its encryption module is FIPS compliant. What should the agency's security team require before accepting the claim?
Select an answer to reveal the explanation.
Short Explanation
Saying you passed the bar exam isn't the same as showing your license number. A FIPS 140 validation certificate names the exact module that was tested; a compliance claim names nothing. The trap is thinking approved algorithms alone make a module validated.
Full Explanation
FIPS 140 validation is performed through the Cryptographic Module Validation Program, in which accredited laboratories test a specific cryptographic module and NIST and the Canadian Centre for Cyber Security issue a certificate listing the validated module, its version and operating environments. A requirement for validated cryptography means the service must use a module that holds such a certificate, operated in its approved mode. The agency should obtain the certificate reference and confirm it matches the module and version in use. A vendor's FIPS compliant statement is a self-asserted claim that may mean only that approved algorithms are implemented; it carries no independent testing and does not satisfy a validation requirement. Using AES and SHA-2 is necessary but not sufficient, because validation also tests the module's boundary, key management, self-tests and roles, and an implementation can use approved algorithms incorrectly. Common Criteria evaluates product security functions against a security target and does not replace FIPS 140 validation for cryptographic modules; requirements frequently call for both. Exam caveat: test the concept of validation status, not which FIPS 140 revision is current. Operational check: search the program's public list of validated modules for the vendor's module name and version, and confirm the certificate is active.