FIPS 140-2 validated modules

FIPS 140-2 was the standard from 2001 until 140-3 replaced it for new submissions. 4,420 certificates were issued under it, which is most of the programme’s history, and none of them is active any more.

The last 481 moved to the historical list on 21 September 2026. Historical does not mean withdrawn or broken. A federal agency may keep the module in a system it already runs but may not buy it new, and the vendor cannot point at that certificate for a new procurement. The sunset page has what the tracker saw on the day.

The table below lists those 481, because they are the ones a contract signed last month may still name. The other 3,939 left the active list earlier, three of them by revocation, and remain on their own pages and in the full index, which has a search box.

Most of the 481 carry numbers issued after NIST closed 140-2 to new submissions in April 2022, mostly rebrands and minor revisions that inherited an older certificate’s sunset date. How that works, and what 140-3 changed in the standard itself, is in FIPS 140-2 vs 140-3: what actually changed.

If you are working out your own exposure, the vendor pages split active from historical. A product whose certificates are all 140-2 and historical, with no 140-3 entry on the same vendor page, is the one worth a conversation.

For what the certificate attests either way, FIPS 140-3 is not a security guarantee is worth reading, and the levels article covers what a level actually buys.

Vendors

Moved to historical on 21 September 2026 (481)

3939 more moved earlier or were revoked. Those stay on their own certificate pages and in the full index, which has a search box.