FIPS

FIPS, or Federal Information Processing Standards, are a set of public standards developed by the United States National Institute of Standards and Technology (NIST) for use by federal government agencies. The standards cover information processing, computer systems, and communications, and are intended to promote interoperability, security, and consistent procurement. FIPS are issued under the authority of the Federal Information Security Management Act (FISMA). While federal agencies are generally required to implement FIPS for information systems and cryptographic modules, non-federal adoption is voluntary.

Key areas of FIPS include cryptographic standards and other security-focused specifications. Notable examples are FIPS 140-3, which specifies Security Requirements for Cryptographic Modules; FIPS 197, the Advanced Encryption Standard (AES); FIPS 180-4, the Secure Hash Standard (SHA-256/512 and related); and FIPS 186-4, the Digital Signature Standard (DSA). Other widely used FIPS documents include FIPS 199, which defines security categorization of information and information systems, and FIPS 201, which covers Personal Identity Verification (PIV) for federal employees and contractors. Historical standards such as FIPS 46-3, covering the Data Encryption Standard (DES), are retained for reference but are considered deprecated for new implementations.

Compliance and validation play key roles in the FIPS program. Cryptographic modules that implement FIPS standards typically undergo independent testing by NIST-accredited laboratories, with results published in the NIST validation programs (CMVP/CAVP). Agencies rely on validated modules for procurement and certification, ensuring consistent security levels across federal systems.

Over time, some FIPS standards have been complemented or superseded by guidelines in the NIST SP 800-series. Nevertheless, FIPS remains the formal basis for mandatory federal security requirements in relevant domains.