Meet Federal Encryption Standards with FIPS-Validated Solutions

Federal Information Processing Standards (FIPS) are developed by the National Institute of Standards and Technology (NIST) to govern the security of federal computer systems. FIPS 140-3 defines the requirements for validating cryptographic modules in commercial off-the-shelf products, with validations issued through the Cryptographic Module Validation Program (CMVP), a joint program of the U.S. and Canadian governments.

Under FISMA, federal agencies are generally required to protect sensitive information with FIPS-validated cryptography. Fortinet maintains an extensive portfolio of FIPS 140-2 and 140-3 validated products across firewalls, switching, wireless, endpoint and security operations — giving agencies validated encryption from the network edge to the data center.

Why FIPS Validation Matters for Your Agency

• Security — Confirms that a product's cryptographic implementation meets current government-defined encryption requirements.
• Compliance — Supports FISMA, CMMC, and agency-specific mandates that call for validated cryptographic modules.
• Procurement Assurance — Provides an objective, third-party benchmark when acquiring equipment that contains cryptography.

Understanding FIPS Validation Levels

Fortinet validates its products at FIPS 140-2/140-3 Level 1 and Level 2.

• Level 1 — Baseline security requirements applied to software or firmware, such as FortiOS. A Level 1 certificate covers effectively all hardware models that run the validated build.
• Level 2 — Adds hardware requirements such as tamper evidence (for example, FortiGate appliances and FortiASIC processors). A Level 2 certificate applies to the specific combination of validated build and hardware models listed on the certificate.

Each validation is documented in a public FIPS Security Policy, which identifies the exact hardware and firmware versions covered and provides instructions for deploying the product in a FIPS-compliant configuration.
 

FIPS certificates are version- and model-specific, and new Fortinet Federal validations are added on an ongoing basis. Before procurement, confirm the status of any certificate:

NIST CMVP Validated Modules Search

Fortinet Federal FIPS 140-3/140-2 Certifications

NIST FIPS 140-3 Transition Effort