Is it really "FIPS 140-3 pending"? Check the CMVP queue and Common Criteria evaluations with AI

Validation takes time. A FIPS 140-3 module typically spends months at a testing lab and then months more in the NIST Cryptographic Module Validation Program (CMVP) queue before a certificate is issued. Vendors often sell during that period and describe the product as "FIPS 140-3 pending" or "in process". Some buyers, including US federal agencies, can accept a module that is in the CMVP queue for a limited time, so the claim matters. It is also easy to check: NIST and the Common Criteria schemes publish their queues, and the Security Certifications brain loads them every week.

The lists it searches

• CMVP Modules In Process (MIP): modules submitted to NIST, with their queue status, from Pending Review and Review through Comment Resolution to Finalization, and the date the status started.
• CMVP Implementation Under Test (IUT): modules being tested at an accredited lab and not yet submitted to NIST.
• Common Criteria in evaluation: products that national schemes such as Canada, Japan, the Netherlands, Sweden, Singapore and Australia list as under evaluation, with the claimed level or protection profile and the lab.

How to read the result

• Not in any list and no certificate: the claim cannot be verified from public data. Ask the vendor for the lab name and the CMVP submission.
• In the Implementation Under Test list: lab testing is under way. Expect a long wait before a certificate.
• In Modules In Process, status Review or Comment Resolution: NIST is reviewing the submission. Finalization means the certificate is close.
• Already certified: the product appears in the certificate search, with its certificate number, level, algorithms and sunset date.

Questions to try

• "This vendor says its HSM is FIPS 140-3 pending. Is it in the CMVP Modules In Process list, and with what status?"
• "Which wolfSSL or OpenSSL modules are currently in the CMVP queue?"
• "List products in Common Criteria evaluation in Canada against the network device protection profile."
• "Has the module that was in Finalization last month received its certificate yet?"

Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP, the Common Criteria Portal and ENISA (EUCC). KBrain refreshes it weekly and links it to the CVE brain.