FIPS 140 validated drives, SSDs and storage modules

Self-encrypting drives, SSDs, tape, storage arrays and the crypto modules inside them. Matched on module names and on NIST descriptions mentioning data at rest, so it catches the TCG drives that do not say “SSD” anywhere in their title.

The level distribution is the useful part, and it is not what buyers usually expect. Of 341 certificates here, 41 are at overall level 3 and none is at level 4. Most sit at level 1 or 2. A drive advertised as “FIPS validated” is almost always telling you that its crypto passed algorithm testing, not that the enclosure resists a determined person with tools. If the requirement you are meeting is physical tamper evidence, check the overall level and the security level exceptions on the certificate page before believing the box.

The other thing worth checking is the caveat field, which is where bound-module surprises live: a drive certificate sometimes covers the controller firmware rather than the drive you are holding.

Vendors here are the drive makers rather than the security industry: KIOXIA, Seagate, Samsung and Western Digital hold the largest share.

FIPS 140-3 levels 1 to 4 sets out what each level requires, which is the thing to check before believing a drive’s marketing. FIPS 140-3 is not a security guarantee covers what the certificate attests and where auditors actually look.

Vendors

Certificates (341)