The FIPS 140-2 sunset on September 21, 2026

FIPS 140-2 stopped accepting new submissions years ago. What is left of it ends on 2026-09-21, when the CMVP moves every 140-2 certificate that is still active onto the historical list. Historical is not revoked: US and Canadian federal agencies can keep running those modules in systems they already have. They just can't buy them for anything new. The replacement is FIPS 140-3, and NIST's own page on the switch is here.

Nobody outside those two governments is bound by that rule directly. A lot of people are bound by it second-hand, through contracts, procurement checklists and audit frameworks that say "FIPS 140 validated" and mean the active list. If that describes you, the table below is worth a scan before the 21st.

492 certificates are still active on FIPS 140-2 with 23 days to go. If something you run is on the list, the question for the vendor is where its 140-3 submission sits in the modules-in-process queue, and what happens if it doesn't clear by September. Some of them won't.

What is on the list

216 of these are hardware. A hardware module doesn't get fixed by a firmware push. Either the vendor has already put the same part through 140-3 under a new certificate number, or the answer is a newer product.

Vendors with the most certificates still on 140-2:

Active FIPS 140-2 certificates (492)

Sorted by vendor. Each certificate number links to its own page with the sunset date, validation history and the caveat field, which is where bound-module surprises live.