Skip to content

Commit 3262440

Browse files
y82y82
authored
fix: simplified table in FIPS, fixed URL (#1140)
1 parent 0158f5d commit 3262440

File tree

1 file changed

+33
-27
lines changed

1 file changed

+33
-27
lines changed

‎content/nginx/fips-compliance-nginx-plus.md‎

Lines changed: 33 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -24,36 +24,42 @@ Some industries such as finance, healthcare, energy, also adopt FIPS to enhance
2424

2525
Currently, both FIPS 140-2 and FIPS 140-3 certifications are accepted. However, FIPS 140-2 is being phased out as part of the [FIPS 140-3 transition plan](https://csrc.nist.gov/projects/fips-140-3-transition-effort). After September 22, 2026, only FIPS 140-3 certifications will be recognized. Organizations are encouraged to migrate to FIPS 140-3 to meet updated cryptographic security requirements.
2626

27-
{{<bootstrap-table "table table-striped table-bordered table-sm">}}
28-
| **Program/Regulation/Industry** | **FIPS 140-2/140-3 Requirement** | **Current Status** |
29-
|---------------------------------|----------------------------------|---------------------------------------------------------------------|
30-
| CJIS | 140-2 or 140-3 | FIPS required for systems protecting criminal justice data. |
31-
| CMMC | 140-2 or 140-3 | FIPS required for Levels 2 and 3 compliance. |
32-
| Common Criteria | 140-2 or 140-3 | Evaluations reference both FIPS versions for cryptographic security. |
33-
| Critical Infrastructure | 140-2 or 140-3 | Utilities and systems accept both versions depending on deployments. |
34-
| Department of Veterans Affairs| 140-2 or 140-3 | Both versions used for securing sensitive health and personal data. |
35-
| DFARS | 140-2 or 140-3 | Cryptographic modules for CUI must be FIPS compliant. |
36-
| DoDIN APL | 140-2 or 140-3 | Approved IT products must include FIPS validation. |
37-
| FAA | 140-2 transitioning to 140-3 | 140-2 modules common in existing systems; new systems use 140-3. |
38-
| FERPA | 140-2 or 140-3 | Federal-funded educational systems align with 140-2 or 140-3. |
39-
| FedRAMP | 140-2 or 140-3 | FIPS required for encryption; both versions accepted. |
40-
| FISMA | 140-2 or 140-3 | Both versions accepted; agencies adopt existing 140-2 modules. |
41-
| HIPAA | 140-2 or 140-3 | FIPS ensures encryption for ePHI; both versions are valid. |
42-
| HITECH | 140-2 or 140-3 | FIPS use aligns with encryption best practices for ePHI. |
43-
| Intelligence Community | 140-2 transitioning to 140-3 | Current systems mostly use 140-2; newer systems adopt 140-3. |
44-
| Military & Tactical Systems | 140-2 transitioning to 140-3 | 140-2 used widely; transitioning to 140-3 certifications for future tools.|
45-
| NSA CSfC | 140-2 transitioning to 140-3 | NSA accepts 140-2 but prefers newer certifications under 140-3. |
46-
| Nuclear Regulatory Commission | 140-2 or 140-3 | Cryptography for nuclear systems relies on both versions. |
47-
| PCI DSS | 140-2 or 140-3 | Both versions recommended but not mandatory. |
48-
| State and Local Gov Programs | 140-2 or 140-3 | FIPS required for federal grant-funded security systems. |
49-
| TSA | 140-2 or 140-3 | Best practice for cryptographic protection; both versions accepted. |
50-
{{< /bootstrap-table >}}
27+
{{< table >}}
28+
| **Sector / Program** | **Version** | **Status** |
29+
|--------------------------------|----------------|---------------|
30+
| **Federal Programs** | | |
31+
| CJIS | 140-2 or 140-3 | Mandatory |
32+
| FedRAMP | 140-2 or 140-3 | Mandatory |
33+
| FISMA | 140-2 or 140-3 | Mandatory |
34+
| DFARS | 140-2 or 140-3 | Mandatory |
35+
| DoDIN APL | 140-2 or 140-3 | Mandatory |
36+
| FAA | 140-2 to 140-3 | Transitioning |
37+
| TSA | 140-2 or 140-3 | Recommended |
38+
| **Defense & Intelligence** | | |
39+
| CMMC | 140-2 or 140-3 | Mandatory |
40+
| Intelligence Community | 140-2 to 140-3 | Transitioning |
41+
| NSA CSfC | 140-2 to 140-3 | Transitioning |
42+
| Military & Tactical Systems | 140-2 to 140-3 | Transitioning |
43+
| **Healthcare & Education** | | |
44+
| HIPAA | 140-2 or 140-3 | Mandatory |
45+
| HITECH | 140-2 or 140-3 | Mandatory |
46+
| Department of Veterans Affairs | 140-2 or 140-3 | Mandatory |
47+
| FERPA | 140-2 or 140-3 | Recommended |
48+
| **Commercial/Private Sector** | | |
49+
| PCI DSS | 140-2 or 140-3 | Recommended |
50+
| Common Criteria | 140-2 or 140-3 | Recommended |
51+
| **Infrastructure & Critical Systems** | | |
52+
| Critical Infrastructure | 140-2 or 140-3 | Recommended |
53+
| Nuclear Regulatory Commission | 140-2 or 140-3 | Recommended |
54+
| **State & Local Government** | | |
55+
| State and Local Gov Programs | 140-2 or 140-3 | Mandatory |
56+
{{< /table >}}
5157

5258
### FIPS compliance in other countries
5359

5460
Although FIPS 140 is primarily a North American government cryptographic standard, it is widely recognized as a global benchmark for cryptographic security. Numerous countries outside North America align their cryptographic requirements with FIPS, especially in regulated sectors such as finance, defense, healthcare, and critical infrastructure.
5561

56-
{{<bootstrap-table "table table-striped table-bordered table-sm">}}
62+
{{< table >}}
5763
| Country/Region | FIPS Use |
5864
|----------------|-----------------------------------------------------------------------------|
5965
| Australia | Referenced for government, defense, and cryptography systems. |
@@ -74,7 +80,7 @@ Although FIPS 140 is primarily a North American government cryptographic standar
7480
| UAE | Trusted in finance, energy, and interoperability with the U.S. cryptography.|
7581
| United Kingdom | Referenced for defense, health, and procurement standards. |
7682
| United States | Mandatory for federal government systems and contractors. |
77-
{{< /bootstrap-table >}}
83+
{{< /table >}}
7884

7985
## FIPS compliant vs FIPS validated
8086

@@ -129,7 +135,7 @@ The process uses Red Hat Enterprise Linux (RHEL) release 9.6 as an example and c
129135

130136
### Step 1: Configure the operating system to use FIPS mode {#os-fips-setup}
131137

132-
For the purposes of the following demonstration, we installed and configured a RHEL 9.6 server. The [Red Hat FIPS documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations#sec-Enabling-FIPS-Mode) explains how to switch the operating system between FIPS mode and non‑FIPS mode by editing the boot options and restarting the system.
138+
For the purposes of the following demonstration, we installed and configured a RHEL 9.6 server. The [Red Hat FIPS documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/switching-rhel-to-fips-mode_security-hardening) explains how to switch the operating system between FIPS mode and non‑FIPS mode by editing the boot options and restarting the system.
133139

134140
For instructions for enabling FIPS mode on other FIPS‑compliant Linux operating systems, see the operating system documentation, for example:
135141

0 commit comments

Comments
 (0)