FIPS (Federal Information Processing Standards)

What is FIPS (Federal Information Processing Standards)?

Federal Information Processing Standards (FIPS) are a set of publicly announced standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors. These standards aim to ensure the security and interoperability of information technology systems. Compliance with FIPS is often a mandatory requirement for contractors working with sensitive federal data.

Definition

FIPS are developed by the National Institute of Standards and Technology (NIST) and are mandated by law. These standards cover a broad range of areas, including cryptography, data encryption, and security protocols. The most commonly referenced standard for government contractors is FIPS 140-2 (and its successor, FIPS 140-3), which specifies security requirements for cryptographic modules. These modules are responsible for encrypting and decrypting data and ensuring its integrity. FIPS compliance is critical because it demonstrates that a contractor has implemented appropriate security controls to protect sensitive government information from unauthorized access, use, disclosure, disruption, modification, or destruction.

Government solicitations and contracts often explicitly state which FIPS standards must be met, particularly when dealing with protected data, controlled unclassified information (CUI), or personally identifiable information (PII). Achieving and maintaining FIPS compliance typically requires rigorous testing, validation, and ongoing monitoring. Contractors must carefully select hardware, software, and services that are certified as FIPS-compliant to meet contractual obligations and safeguard sensitive data.

Key Points

• Compliance Mandate: Many government contracts require adherence to specific FIPS standards, especially FIPS 140-2 or FIPS 140-3 for cryptographic modules.
• NIST Oversight: NIST develops and manages FIPS standards, providing guidance and resources for contractors.
• Impact on Procurement: FIPS compliance influences the selection of IT products and services, requiring contractors to choose validated solutions.
• Security Assurance: FIPS compliance demonstrates a commitment to data security and protects sensitive government information.

Practical Examples

1. Selecting Encryption Software: A contractor bidding on a project that requires data encryption must choose encryption software validated under FIPS 140-2 or FIPS 140-3 to ensure compliance.
2. Cloud Service Providers: When using cloud services to store government data, contractors must verify that the cloud provider's cryptographic modules are FIPS-compliant, usually documented in their security certifications.
3. Developing a Secure Application: A software development company creating an application for a federal agency must design the application to use FIPS-validated cryptographic libraries and algorithms, ensuring the protection of sensitive data within the application.