Check FIPS 140-3 and Common Criteria status before you buy, from your AI assistant
Before buying or renewing a security product, ask your AI assistant whether it holds an active FIPS 140-3 validation or Common Criteria certificate, at which level or EAL, until when, and with which lab. Data from sec-certs.org.
Add the Security Certifications brain to your AI assistant
Public sector, defence, finance and healthcare buyers often require a FIPS 140-3 validated cryptographic module or a Common Criteria certified product. Vendor datasheets say "FIPS validated" or "CC certified", but the details matter: which module, which version, which level, whether the certificate is still active, and when it expires. The Security Certifications brain lets you check those details from your AI assistant, against the public certification records.
What to verify on a certificate
- Status: FIPS certificates can be active, historical or revoked. Common Criteria certificates are active or archived.
- Level: FIPS 140-3 security level 1 to 4, or the Common Criteria Evaluation Assurance Level (EAL1 to EAL7), including augmentations such as EAL4+.
- Dates: when the certificate was issued, when it expires, and for FIPS the sunset date after which it moves to the historical list.
- Scope: the exact product name, versions and embodiment (hardware, software, firmware or hybrid) that were evaluated.
- Lab and scheme: which testing lab or certification body evaluated it, and for Common Criteria which national scheme issued it.
FIPS 140-2 is being retired. New validations are issued under FIPS 140-3, and FIPS 140-2 certificates move to the historical list at their sunset date. Ask for the standard and the sunset date, not only for "FIPS validated".
A quick vendor check in practice
Paste the vendor claim into Claude or ChatGPT and ask the assistant to verify it. It searches the certificates by product and vendor, returns the matching records with status, level, dates and lab, and links to the official certificate on the NIST CMVP site or the Common Criteria Portal. If the product has related CVEs, they appear on the same answer.
Questions to try
- "Is this HSM FIPS 140-3 validated, at which level, and until when?"
- "Compare the Common Criteria certificates held by these two smart card vendors."
- "List active Common Criteria certificates at EAL5 or above for network devices."
- "Which lab evaluated FIPS certificate 4282, and when does it sunset?"
Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP and the Common Criteria Portal. KBrain refreshes it weekly and links it to the CVE brain.
Add the Security Certifications brain to your AI assistant
Check FIPS 140-3 and Common Criteria certificates, post-quantum algorithms, and the CVEs that may affect certified products from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed weekly from sec-certs.org, with nothing to set up.
Questions people ask.
Is this an official source for FIPS or Common Criteria status?
No. It reports public certification records as processed by sec-certs.org and links to the official certificate. Check the certificate on the NIST CMVP site or the Common Criteria Portal before a contractual or compliance decision.
How current is the data?
sec-certs.org refreshes its datasets weekly and KBrain loads them weekly, so a certificate issued in the last few days may not appear yet.
Does it cover FIPS 140-2 and FIPS 140-3?
Yes. It covers FIPS 140-1, 140-2 and 140-3 certificates, including historical ones, so you can see when an older validation was moved to the historical list.
Which Common Criteria certificates are included?
Certificates listed on the Common Criteria Portal, active and archived, with their EAL, category, certification scheme and protection profiles.