FIPS 140-3 Compliance
RLC Pro provides access to FIPS 140-3 cryptographic modules for deployments that require federal compliance. FIPS (Federal Information Processing Standards) compliance is required for many government, defense, financial, and healthcare environments.
This page is the canonical FIPS reference for the RLC Pro family. The sub-families inherit the same validated modules and add their own guidance:
- RLC Pro Hardened: see Enabling FIPS Mode for step-by-step enablement and the RLC Pro Hardened Security section.
In this section
- Enabling FIPS: turn on FIPS mode and install the validated packages (Compliant or Certified).
- Certification status: CMVP-validated and in-process modules by version, plus entropy validations.
- Algorithm validation: per-module ACVP algorithm certificates.
- Reference: module enhancements, terminology, and FAQ.
What is FIPS 140-3?
FIPS 140-3 is a US and Canadian government standard, maintained by NIST and validated through the Cryptographic Module Validation Program (CMVP), that defines the security requirements for cryptographic modules used in information systems. Compliance ensures that:
- Cryptographic algorithms meet approved standards
- Key management follows validated procedures
- Random number generation uses approved (validated) entropy sources
- Self-tests verify module integrity at startup
FIPS validates cryptographic implementation correctness, not overall system security. A FIPS-validated system still requires proper hardening, access controls, and vulnerability management.
How CIQ delivers FIPS compliance
FIPS validation is granted per cryptographic module and per module version, not per OS release. Because of this, CIQ describes packages using two delivery states. Understanding the difference is important when planning a compliant deployment.
| State | What it means | Where it comes from |
|---|---|---|
| FIPS Certified | The exact package version completed CMVP validation and holds an official NIST certificate. To keep certified status, packages must stay pinned to the exact certified versions. | CIQ FIPS Certified repositories |
| FIPS Compliant (CIQ definition) | Packages use the same cryptographic implementation as the certified version, with updates limited to non-security-relevant (NSR) changes such as CVE patches outside the crypto boundary. This lets you receive security updates while keeping the certified cryptographic code. | CIQ FIPS Compliant repositories |
"FIPS Compliant" is an industry term with no standardized definition. CIQ's definition above describes CIQ's specific usage: the cryptographic code is identical to the certified version, and only non-security-relevant changes are applied. CIQ is not claiming CMVP validation of the exact compliant build.
Turning on FIPS mode is not the same as being FIPS validated. FIPS mode carries validation only when CIQ's Certified or Compliant modules are installed. Enabling FIPS mode on an unvalidated component (for example, the RLC Pro 9.7 kernel, or stock Rocky Linux) provides no CMVP validation whatsoever. It is a leftover capability from a previously certified version, not evidence that the running system is FIPS.
Non-Security-Relevant (NSR) changes
NSR changes are updates that do not modify the security-relevant portions of a cryptographic module. They do not touch:
- Cryptographic algorithms or implementations
- Key generation, storage, use, or zeroization
- Critical security parameter (CSP) handling
- Module security policy, roles, services, or authentication
Typical NSR examples include CVE patches to non-cryptographic code, platform housekeeping outside the crypto boundary, logging or configuration fixes, and documentation updates.
Patching a certified package breaks its certified status for the running system, even if the original version remains on the NIST validated list, because CMVP validation is tied to a specific module version and configuration. The FIPS Compliant repositories exist so you can keep receiving CVE fixes without changing the certified cryptographic code. Most customers run FIPS Compliant packages; pin to FIPS Certified versions only where a certificate must be cited.
FIPS and LTS
FIPS versions are tied to specific minor releases (e.g., 9.2, 9.6) because cryptographic module validation is performed against a specific software version. RLC Pro LTS ensures these pinned versions continue to receive security updates.
Support
For questions about FIPS compliance, certification documentation, or configuration assistance, contact CIQ Support or CIQ Sales.