FIPS

Federal Information Processing Standards

*** see also the NIST CSRC FIPS page - http://csrc.nist.gov/publications/fips/index.html  and the International NIST FIPS Page - http://www.itl.nist.gov/fipspubs/

FIPS are a series of Federal standards documents, many of them describe security methodologies.  They dictate how Federal Agencies are to process their data.  In the past, a waiver could be obtained for Agencies that had trouble conforming to a FIPS standard - but no more.  This declaration is pasted into the NIST FIPS page:

"With the passage of the Federal Information Security Management Act (FISMA) of 2002, there is no longer a statutory provision to allow for agencies to waive mandatory Federal Information Processing Standards (FIPS). The waiver provision had been included in the Computer Security Act of 1987; however, FISMA supercedes that Act. Therefore, the references to the "waiver process" contained in many of the FIPS are no longer operative."

Therefore, vendors that sell to the government need to first have their products certified as "FIPS compliant".  For most telecom vendor security hardware such as VPN boxes and encryption devices, they must be certified as FIPS 140-2 compliant (the previous version was FIPS 140-1).  FIPS 140-2 is called "Security Requirements for Cryptographic Modules".

Standards, Standards, Standards - and Certification

*** see also the FIPS 140-1 and 140-2 Certification pre-evaluation process website
*** and see the list of products and what stage they are in the FIPS 140-1 140-2 certification process

The most important certification standards that security products vendors want pass are CC (Common Criteria - ratings EAL1 through EAL7) and the FIPS 140-2 (Pass or Fail).  But there are tons more !!  Nevertheless, if you get both CC and FIPS 140-2 compliancy certifications - they can help comply to other requirements such as:

Here are the main FIPS documents with links to the actual documents: