FIPS 140-2
The Federal Information Processing Standard (FIPS) Publication 140-2 (FIPS PUB 140-2), commonly referred as FIPS 140-2, is a US government computer security standard used to validate cryptographic modules. FIPS 140-2 was created by the NIST and, per the FISMA, is mandatory for US and Canadian government procurements. Many global organizations are also mandated to meet this standard.
Thales delivers security products that have been tested and validated against the rigorous FIPS 140-2 standard, helping you comply with regulations while also giving you the confidence you need in your cryptographic tools.
- FIPS 140-2 Overview
- Thales Compliance Overview
- Product Compliance Details
Security Standard
According to FIPS Publication 140-2:
“[It] provides a standard that will be used by Federal organizations when these organizations specify that cryptographic-based security systems are to be used to provide protection for sensitive or valuable data. Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrity of the information protected by the module. This standard specifies the security requirements that will be satisfied by a cryptographic module.
… The security requirements cover areas related to the secure design and implementation of a cryptographic module. These areas include cryptographic module specification; cryptographic module ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.”
Certification Authorities
The US NIST (National Institute of Standards and Technology) and Canadian CSE (Communications Security Establishment) jointly participate as certification authorities in the CMVP (Cryptographic Module Validation Program) to provide validation of cryptographic modules to the FIPS 140-2 standard.
For more information, click here.
Thales Support for FIPS 140-2 Security Standard
Thales develops cryptographic products and subsystems that conform to the FIPS 140-2 security standard. Thales eSecurity products that meet the standard include:
Hardware Security Modules (HSMs)
- The payShield family of HSMs are proven hardware security modules dedicated to the payment industry for issuing credentials, processing transactions and managing keys.
Data at Rest Encryption – Vormetric Data Security Platform
- At the center of the Vormetric Data Security Platform is the Vormetric Data Security Manager (DSM), providing key and policy management for Vormetric Transparent Encryption, Vormetric Tokenization and Vormetric Application Encryption. Delivered in virtual and physical appliance form factors, the DSM delivers key storage and protection for data at rest.
Other key data protection and security regulations
GDPR
Regulation
Active Now
Perhaps the most comprehensive data privacy standard to date, GDPR affects any organisation that processes the personal data of EU citizens - regardless of where the organisation is headquartered.
PCI DSS
Mandate
Active Now
Any organisation that plays a role in processing credit and debit card payments must comply with the strict PCI DSS compliance requirements for the processing, storage and transmission of account data.
Data Breach Notification Laws
Regulation
Active Now
Data breach notification requirements following loss of personal information have been enacted by nations around the globe. They vary by jurisdiction but almost universally include a “safe harbour” clause.
Contact a Compliance Specialist
Are you fit for GDPR
