Data brain
Security Certifications Explorer
Every FIPS 140-3 and FIPS 140-2 cryptographic module validation from the NIST CMVP, every Common Criteria certificate and every certificate of the new EU scheme, EUCC, in one place: vendor and product, security level or EAL, status, validity and sunset dates, the evaluation lab, the algorithms a module implements with their CAVP certificates (including post-quantum ones such as ML-KEM and ML-DSA), the certificates it builds on, and the CVEs that may affect it.
The data comes from sec-certs.org, built by the CRoCS lab at Masaryk University from NIST CMVP, the Common Criteria Portal and ENISA, and is refreshed weekly. Ask it from Claude, ChatGPT, or any MCP assistant, with no setup.
5,542 FIPS 140-3 / 140-2 certificates - 6,833 Common Criteria certificates - 110 EUCC certificates - synced October 17, 2026
Certificates claiming this protection profile
- TCOS FlexCert Version 2.0 Release 2/SLC52activeDeutsche Telekom Security GmbH - Common Criteria BSI-DSZ-CC-0904-V3-2026 - EAL4+ - certified July 3, 2026
- STARCOS 3.7 COS HBA-SMCactiveGiesecke+Devrient ePayments GmbH - Common Criteria BSI-DSZ-CC-0976-V5-2026 - EAL4+ - certified June 17, 2026
- IDEMIA_HC_Germany_NEO_G2.1_COS, V3activeIDEMIA Germany GmbH - Common Criteria BSI-DSZ-CC-1261-2025 - EAL4+ - certified August 6, 2025
- STARCOS 3.7 COS GKV C3activeG+D Mobile Security GmbH - Common Criteria BSI-DSZ-CC-1198-2022 - EAL4+ - certified September 2, 2022
- TCOS FlexCert Version 2.0 Release 2/SLC52archivedDeutsche Telekom Security GmbH - Common Criteria BSI-DSZ-CC-0904-V2-2021 - EAL4+ - certified June 24, 2021
- STARCOS 3.7 COS HBA-SMCarchivedG+D Mobile Security GmbH - Common Criteria BSI-DSZ-CC-0976-V4-2021 - EAL4+ - certified June 18, 2021
- IDEMIA_HC_Germany_NEO_G2.1_COS, V1archivedIDEMIA Germany GmbH - Common Criteria BSI-DSZ-CC-1098-2020 - EAL4+ - certified July 30, 2020
- STARCOS 3.7 COS GKV C2archivedG+D Mobile Security GmbH - Common Criteria BSI-DSZ-CC-0976-V3-2019 - EAL4+ - certified November 21, 2019
Source: sec-certs.org (CRoCS, Masaryk University), from NIST CMVP, the Common Criteria Portal and ENISA (EUCC). Related CVEs are automated matches by sec-certs and may be incomplete or wrong.
Guides and use cases
- Which certified products are affected by a CVE? FIPS 140-3 and Common Criteria exposure with AI
A certificate says a product passed an evaluation, not that it is free of vulnerabilities. This use case shows how to find the certified products a CVE may affect, and the CVEs that may affect a certified product, inside Claude or ChatGPT.
- Check FIPS 140-3 and Common Criteria status before you buy, from your AI assistant
Procurement questionnaires ask for FIPS 140-3 and Common Criteria proof. This use case shows how to verify a vendor claim in seconds, including status, level, validity dates and sunset, from Claude or ChatGPT.
- Find FIPS 140-3 validated modules with post-quantum cryptography (ML-KEM, ML-DSA)
Post-quantum migration starts with knowing what is available. This use case shows how to find certified cryptographic modules that support ML-KEM, ML-DSA and other post-quantum algorithms, from Claude or ChatGPT.
- Is it really "FIPS 140-3 pending"? Check the CMVP queue and Common Criteria evaluations with AI
"FIPS 140-3 pending" can mean anything from "we signed with a lab" to "NIST is finalising the certificate". This use case shows how to check where a product really is, from your AI assistant or from the KBrain in-progress page.
- How to check a FIPS 140-3 or Common Criteria certificate in Claude or ChatGPT
AI assistants do not know which certificates are active today and will guess. Connect the KBrain Security Certifications brain and they answer from the public certification records instead.
- FIPS 140-3 vs Common Criteria: security levels, EALs and what each certification proves
FIPS 140-3 and Common Criteria are the two certifications security buyers ask for most. This guide compares what each one covers, how FIPS 140-3 security levels and Common Criteria EALs work, and what neither of them proves.
- What is the CMVP? How FIPS 140-3 validation works, from CAVP to certificate
Every FIPS 140-3 certificate comes out of the CMVP. This guide explains who runs it, how a module goes from algorithm testing to a certificate, what the four security levels require, and what active, historical and revoked mean.
- Common Criteria EAL levels explained: EAL1 to EAL7, augmentations and protection profiles
An EAL tells you how deeply a product's security claims were evaluated, not how strong they are. This guide walks through the seven levels, augmentations such as ALC_FLR and AVA_VAN.5, protection profiles and the national schemes that issue certificates.
- What is EUCC? The EU Common Criteria cybersecurity certification scheme explained
EUCC replaces national Common Criteria certification inside the EU with one scheme and one certificate recognised in every member state. This guide explains how it works and how to search EUCC certificates next to FIPS 140-3 and Common Criteria ones.
- Security certifications MCP server: FIPS 140-3 and Common Criteria data for AI agents
Security agents need certification data as tools, not as PDFs. KBrain hosts an MCP server for FIPS 140-3 and Common Criteria certificates, joined with the CVE brain, so any MCP compatible assistant or agent can query it.