FIPS
What is FIPS?
Federal Information Processing Standards, US government standards for computer systems used by non-military federal agencies and government contractors.
Terms that appear alongside fips
Each of these is named in at least one of the same controls as fips. The number is how many controls name both.
- nist 43 shared controls
- encryption 22 shared controls
- confidentiality 19 shared controls
- fedramp 16 shared controls
- audit 15 shared controls
- integrity 14 shared controls
- tls 13 shared controls
- nist sp 800 53 13 shared controls
Frameworks that govern fips
What the standards actually require on fips
Requirements naming fips across 6 standards, quoted from the control text.
Authorizing officials measure CNSA compliance in the Risk Management Framework when assessing control SC-12 (cryptographic key establishment and management): CNSSI 1253 mandates the RMF for NSS and NSS require the NSA-approved selection, which unless NSA state...
commercial-national-security-algorithm-suite-cnsa-2-0::ENF-SC12 · ENF-SC12 Measure compliance in the RMF at SC-12 as NSA-approved, never as FIPS-validated →Section 9.3 of IRS Publication 1075 establishes the technical and procedural security controls + by inheritance from NIST SP 800-53 Rev 5 Security and Privacy Controls for Information Systems and Organizations.
IRSPub1075-Section93-NIST800-53-Inheritance-IRSModerate-Plus-Baseline-FIPS199-HIGH-Confidentiality · IRS Publication 1075 Section 9.3 + NIST SP 800-53 Rev 5 Inheritance + IRS Moderate-Plus Baseline (Not Just Moderate, Less Than High) + FIPS 199 Confidentiality HIGH for FTI + 18 Control Families + 200+ Controls →Implement FIPS 204 ML-DSA (Module-Lattice-Based Digital Signature Algorithm) based on CRYSTALS-Dilithium for digital signatures + authentication + non-repudiation.
PQC-3 · FIPS 204 ML-DSA Implementation - Module-Lattice Digital Signature →Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
SP800-171-3.13.11 · Employ FIPS-validated cryptography →ISMAP Data Protection establishes comprehensive data lifecycle controls. (1) Data Classification: customer government data must be classified per Japanese government data classification scheme + including (a) General + (b) Sensitive + (c) Confidential + (d) St...
ISMAP-DataProtection-Classification-Encryption-DataResidencyJapan-Backup-SecureDeletion-Cryptography-FIPS · ISMAP Data Protection - Data Classification + AES-256 Encryption At Rest + TLS 1.3 In Transit + Data Residency Japan + Backup + Secure Deletion + Cryptography per FIPS 140-3 + CRYPTREC + KMS HSM →When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-requisite FIPS 140-3 validation is preferred.
ISM-1990 · FIPS 140-3 validation for ML-DSA and ML-KEM →Questions people ask about fips
What is FIPS?
Why is FIPS important for compliance?
Which compliance frameworks address FIPS?
Where can I learn more about FIPS?
See how FIPS applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.