Skip to content

Commit ecefcc6

Browse files
y82y82
committed
FIPS: simplified table, fixed URL.
1 parent 2e7a0b2 commit ecefcc6

File tree

1 file changed

+30
-23
lines changed

1 file changed

+30
-23
lines changed

‎content/nginx/fips-compliance-nginx-plus.md‎

Lines changed: 30 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -25,30 +25,37 @@ Some industries such as finance, healthcare, energy, also adopt FIPS to enhance
2525
Currently, both FIPS 140-2 and FIPS 140-3 certifications are accepted. However, FIPS 140-2 is being phased out as part of the [FIPS 140-3 transition plan](https://csrc.nist.gov/projects/fips-140-3-transition-effort). After September 22, 2026, only FIPS 140-3 certifications will be recognized. Organizations are encouraged to migrate to FIPS 140-3 to meet updated cryptographic security requirements.
2626

2727
{{<bootstrap-table "table table-striped table-bordered table-sm">}}
28-
| **Program/Regulation/Industry** | **FIPS 140-2/140-3 Requirement** | **Current Status** |
29-
|---------------------------------|----------------------------------|---------------------------------------------------------------------|
30-
| CJIS | 140-2 or 140-3 | FIPS required for systems protecting criminal justice data. |
31-
| CMMC | 140-2 or 140-3 | FIPS required for Levels 2 and 3 compliance. |
32-
| Common Criteria | 140-2 or 140-3 | Evaluations reference both FIPS versions for cryptographic security. |
33-
| Critical Infrastructure | 140-2 or 140-3 | Utilities and systems accept both versions depending on deployments. |
34-
| Department of Veterans Affairs| 140-2 or 140-3 | Both versions used for securing sensitive health and personal data. |
35-
| DFARS | 140-2 or 140-3 | Cryptographic modules for CUI must be FIPS compliant. |
36-
| DoDIN APL | 140-2 or 140-3 | Approved IT products must include FIPS validation. |
37-
| FAA | 140-2 transitioning to 140-3 | 140-2 modules common in existing systems; new systems use 140-3. |
38-
| FERPA | 140-2 or 140-3 | Federal-funded educational systems align with 140-2 or 140-3. |
39-
| FedRAMP | 140-2 or 140-3 | FIPS required for encryption; both versions accepted. |
40-
| FISMA | 140-2 or 140-3 | Both versions accepted; agencies adopt existing 140-2 modules. |
41-
| HIPAA | 140-2 or 140-3 | FIPS ensures encryption for ePHI; both versions are valid. |
42-
| HITECH | 140-2 or 140-3 | FIPS use aligns with encryption best practices for ePHI. |
43-
| Intelligence Community | 140-2 transitioning to 140-3 | Current systems mostly use 140-2; newer systems adopt 140-3. |
44-
| Military & Tactical Systems | 140-2 transitioning to 140-3 | 140-2 used widely; transitioning to 140-3 certifications for future tools.|
45-
| NSA CSfC | 140-2 transitioning to 140-3 | NSA accepts 140-2 but prefers newer certifications under 140-3. |
46-
| Nuclear Regulatory Commission | 140-2 or 140-3 | Cryptography for nuclear systems relies on both versions. |
47-
| PCI DSS | 140-2 or 140-3 | Both versions recommended but not mandatory. |
48-
| State and Local Gov Programs | 140-2 or 140-3 | FIPS required for federal grant-funded security systems. |
49-
| TSA | 140-2 or 140-3 | Best practice for cryptographic protection; both versions accepted. |
28+
| **Sector / Program** | **Version** | **Status** |
29+
|--------------------------------|----------------|---------------|
30+
| **Federal Programs** | | |
31+
| CJIS | 140-2 or 140-3 | Mandatory |
32+
| FedRAMP | 140-2 or 140-3 | Mandatory |
33+
| FISMA | 140-2 or 140-3 | Mandatory |
34+
| DFARS | 140-2 or 140-3 | Mandatory |
35+
| DoDIN APL | 140-2 or 140-3 | Mandatory |
36+
| FAA | 140-2 to 140-3 | Transitioning |
37+
| TSA | 140-2 or 140-3 | Recommended |
38+
| **Defense & Intelligence** | | |
39+
| CMMC | 140-2 or 140-3 | Mandatory |
40+
| Intelligence Community | 140-2 to 140-3 | Transitioning |
41+
| NSA CSfC | 140-2 to 140-3 | Transitioning |
42+
| Military & Tactical Systems | 140-2 to 140-3 | Transitioning |
43+
| **Healthcare & Education** | | |
44+
| HIPAA | 140-2 or 140-3 | Mandatory |
45+
| HITECH | 140-2 or 140-3 | Mandatory |
46+
| Department of Veterans Affairs | 140-2 or 140-3 | Mandatory |
47+
| FERPA | 140-2 or 140-3 | Recommended |
48+
| **Commercial/Private Sector** | | |
49+
| PCI DSS | 140-2 or 140-3 | Recommended |
50+
| Common Criteria | 140-2 or 140-3 | Recommended |
51+
| **Infrastructure & Critical Systems** | | |
52+
| Critical Infrastructure | 140-2 or 140-3 | Recommended |
53+
| Nuclear Regulatory Commission | 140-2 or 140-3 | Recommended |
54+
| **State & Local Government** | | |
55+
| State and Local Gov Programs | 140-2 or 140-3 | Mandatory |
5056
{{< /bootstrap-table >}}
5157

58+
5259
### FIPS compliance in other countries
5360

5461
Although FIPS 140 is primarily a North American government cryptographic standard, it is widely recognized as a global benchmark for cryptographic security. Numerous countries outside North America align their cryptographic requirements with FIPS, especially in regulated sectors such as finance, defense, healthcare, and critical infrastructure.
@@ -129,7 +136,7 @@ The process uses Red Hat Enterprise Linux (RHEL) release 9.6 as an example and c
129136

130137
### Step 1: Configure the operating system to use FIPS mode {#os-fips-setup}
131138

132-
For the purposes of the following demonstration, we installed and configured a RHEL 9.6 server. The [Red Hat FIPS documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations#sec-Enabling-FIPS-Mode) explains how to switch the operating system between FIPS mode and non‑FIPS mode by editing the boot options and restarting the system.
139+
For the purposes of the following demonstration, we installed and configured a RHEL 9.6 server. The [Red Hat FIPS documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/switching-rhel-to-fips-mode_security-hardening) explains how to switch the operating system between FIPS mode and non‑FIPS mode by editing the boot options and restarting the system.
133140

134141
For instructions for enabling FIPS mode on other FIPS‑compliant Linux operating systems, see the operating system documentation, for example:
135142

0 commit comments

Comments
 (0)