The FIPS Lab

FIPS 140-2 Consolidated Validation Certificates

2012-01-20T09:50:00.000-08:00

Q: How long does it take for a recently validated cryptographic module to appear on a FIPS 140-2 Consolidated Validation Certificate?

A: At the end of each month, the CMVP generates a list of cryptographic modules that were issued new FIPS 140-2 certificates. The Consolidated Validation Certificate is signed by a NIST representative in the United States and then routed to Canada for signature by a CSEC representative. The signature and posting process takes about two weeks.

For example, modules that received a certificate number in the month of January will appear on the FIPS 140-2 Consolidated Validation Certificate that gets posted mid-February.

InfoGard exhibiting at RSA Conference in San Francisco

2012-01-10T02:30:00.000-08:00

InfoGard Laboratories will be exhibiting at the 2012 RSA Conference in San Francisco, CA February 27 through March 1. Please visit us at Booth 316 (enter the Expo Hall, make a left).

FIPS 140-2 Annex D updated

2012-01-05T09:45:00.000-08:00

On December 20, 2011, Annex D was updated with the following change:

Key Establishment Techniques
Added: Recommendation for Key Derivation through Extraction-then-Expansion,
Special Publication 800-56C

FIPS certificate totals for 2011 down 19%

2012-01-05T09:35:00.000-08:00

The number of FIPS 140-2 certificates issued in 2011 was down 19% compared to 2010. A total of 185 certificates were issued in 2011 (229 were issued in 2010). Here are the totals by Lab for 2011:

Power-on self-test guidance

2011-12-12T01:30:00.000-08:00

The CMVP intends to release new FIPS 140-2Implementation Guidance clarifying the power-on self-test required forcryptographic algorithms whose outputs do not vary for a given set of inputs(e.g. RSA).

A Known Answer Test (KAT) will be required in the future for cryptographic modules that perform RSA sign and verify when the outputs of those operations are deterministic.

The Implementation Guidance will include a transition date. After that transition date, new FIPS 140-2 validation submissions must implement a Known Answer Test (for a deterministic mode of RSA) as a power-on self-test. A Pairwise Consistency Test will no longer be acceptable as a power-on self-test (for a deterministic mode of RSA).

The release date of the Implementation Guidance and the transition date are not yet available.

2011 FIPS 140-2 certificate totals

2011-12-01T09:09:00.001-08:00

The number of FIPS 140-2 certificates issued through November 30, 2011 remains at a 20% slower pace compared to 2010. Here are the totals by Lab for 2011:

And the percentages:

3rd Quarter FIPS 140-2 certificate totals still trending down

2011-10-05T08:33:00.000-07:00

At the end of 3Q 2011, the CMVP has posted 137 new FIPS 140-2 certificates for the year. The projection for the year is 183 certificates which is 20% less than last year's total of 229.

The chart below shows the breakdown of FIPS 140-2 certificates by Laboratory for 2011 (through September 30, 2011). The number between the Lab name and the percentage is the number of certificates for 2011.

Update: Unofficial FIPS 140-3 schedule

2011-09-21T03:30:00.000-07:00

Here are my thoughts on the current FIPS 140-3 schedule:

Previously, NIST had left open the possibility of another public comment period. The schedule now indicates that another public comment period will occur in 1Q 2012.
Since it has been some time since the last public review, I am expecting a 60 day public review period (perhaps it will be only 30 days? -- share your thoughts in the comment section).
After the comments have been addressed, the Secretary of Commerce receives the FIPS 140-3 publication for signature. Previous estimates allow for 6 months for the Secretary of Commerce to sign.
My unofficial estimate for FIPS 140-3 reports to be accepted by the CMVP is now 2Q 2013 (at the earliest).
My unofficial estimate for the last date FIPS 140-2 reports will be accepted by the CMVP is the end of 2013 (which allows for a 6 month transition period from 140-2 to 140-3).

Update: CMVP review times for FIPS 140-2 validations

2011-09-20T04:51:00.000-07:00

Recent FIPS 140-2 submissions have shown an increase in review time by the CMVP. Since my last update, reports submitted by InfoGard have experienced CMVP review times between 9 and 12 weeks -- although one report submission took only 4 weeks.

(In my May 16 blog entry, I provided a CMVP review estimate between 5 and 10 weeks)

I am raising my Unofficial CMVP Review Time Estimate to "9 to 12 weeks."

[NOTE: My definition of "CMVP Review Time" is the time between report submission to the CMVP (Review Pending block on the Modules in Process List) to the day the Laboratory first receives comments from the CMVP (Coordination block on the Module in Process List).]

My revised estimate is still significantly better than the review times from last year. Please share your experience in the comment section.

FIPS 140-2 revalidation terms to know: 1SUB, 3SUB, 5SUB

2011-09-01T10:02:00.000-07:00

I received a question recently about maintaining a FIPS 140-2 certificate after changes are made to the module. Here is some background for those not familiar with the process.

There are 5 different scenarios when making changes to a cryptographic module. I'll cover the 3 most common. Additional details are found in the FIPS 140-2 Implementation Guidance document, G.8.

1SUB - Modifications are made to hardware, software or firmware components that do not affect any FIPS 140-1 or FIPS 140-2 security relevant items. The vendor is responsible for providing the applicable documentation to the CST laboratory, which identifies the modification(s).

[Mark Minnoch] A "1SUB" (say "one-sub") is a "maintenance" or "bug-fix" activity for the Lab. As an example let's consider the case of a vendor making source code only changes. The Lab reviews the source code changes to determine if any of the changes were security relevant. If the Lab agrees with the vendor that the changes are not security relevant, then a letter request is submitted to the CMVP to include the updated firmware (or software) version on the existing FIPS certificate.

3SUB - Modifications are made to hardware, software or firmware components that affect some of the FIPS 140-2 security relevant items. An updated cryptographic module can be considered in this scenario if it is similar to the original module with only minor changes in the security policy and FSM, and less than 30% of the modules security relevant features.

[Mark Minnoch] A "3SUB" change is commonly referred to as a "revalidation". The Laboratory updates the previous report submission to include changes and also to confirm that the required regression testing was completed. This is more involved than a 1SUB but typically less effort than a new validation. The Lab considers service changes, algorithm changes, hardware changes, etc. when determining if the 30% threshold for security relevant changes is exceeded.

5SUB - If modifications are made to hardware, software, or firmware components that do not meet the above criteria, then the cryptographic module will be considered a new module and must undergo a full validation testing by a CST laboratory.

[Mark Minnoch] A "5SUB" is commonly referred to as a "validation". The Laboratory submits a full validation test report package and the appropriate NIST fee applies.

FIPS 140-2 Annex A, B, C, D updates

2011-08-18T04:25:00.000-07:00

The FIPS 140-2 Annexes have been updated recently:

Annex A: Approved Security Functions [ PDF 07-26-2011]

Added new Section: Transitions
Added: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

Annex B: Approved Protection Profiles [ PDF 08-12-2011]

Added U.S. Government Approved Protection Profile - U.S. Government Protection Profile for General-Purpose Operating Systems in a Networked Environment – CC Version 3.1, 30 August 2010

Annex C: Approved Random Number Generators [ PDF 07-26-2011]

Added new Section: Transitions
Added: Recommendation for Transitioning the Use of Cryptographic Algorithms
and Key Lengths

Annex D: Approved Key Establishment Techniques [ PDF 07-26-2011]

Added new Section: Transitions
Added: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

FIPS 140-2 Implementation Guidance updated

2011-07-18T10:25:00.000-07:00

The FIPS 140-2 Implementation Guidance was updated on July 15, 2011. The NIST website shows the following changes:

New Implementation Guidance:

11.1 Mitigation of Other Attacks
D.4 Requirements for Vendor Affirmation of NIST SP 800-56B
D.5 Requirements for Vendor Affirmation of NIST SP 800-108
D.6 Requirements for Vendor Affirmation of NIST SP 800-132
D.7 Requirements for Vendor Affirmation of NIST SP 800-135

Updated Implementation Guidance:

G.3 Partial Validations and Not Applicable Areas of FIPS 140-2
- Modified in regard to new IG 11.1
G.6 Modules with both a FIPS mode and a non-FIPS mode
- Clarification that all implemented algorithms shall be referenced on the validation certificate.
G.8 Revalidation Requirements
- Added security policy requirements for revalidation Scenarios 1 and 4
G.13 Instructions for Validation Information Formatting
- Added examples for CVL and KTS
1.4 Binding of Cryptographic Algorithm Validation Certificates
- Added examples of an operational environment change
D.1 CAVP Requirements for Vendor Affirmation of NIST SP 800-56A
- Modified the testing for primitives
D.2 Acceptable Key Establishment Protocols
- Modified the transition text and key agreement guidance

Second draft of SP 800-56C open for comments

2011-07-12T13:08:00.000-07:00

Open for public comments: SP 800-56 C - DRAFT (2nd Draft) Recommendation for Key Derivation through Extraction-then-Expansion

The comment period closes on August 11, 2011.

New FIPS 140-2 testing lab, Booz Allen Hamilton

2011-05-31T12:12:00.000-07:00

Booz Allen Hamilton is now the most recent NIST accredited FIPS 140 testing laboratory. The addition of CGI and BAH to the NIST website this week brings the number of FIPS labs back up to 19.

The Booz Allen Hamilton FIPS Lab is located in Maryland (USA).

Welcome, BAH!

Canadian lab, CGI, back as an accredited FIPS 140 lab

2011-05-31T10:12:00.000-07:00

CGI is back on the NIST website of accredited FIPS 140 testing laboratories. Back in March of 2011, I noted that CGI had dropped off the website. Jason Lawlor (CGI Lab Manager) informed me that it was a temporary situation. On May 24, 2011, Jason confirmed that CGI has received their accreditation as a FIPS 140 testing lab.

Welcome back!

FIPS 140-2 certificates trending down in 2011

2011-05-27T11:43:00.000-07:00

The number of FIPS 140-2 certificates issued in 2011 is trending at a slower pace than 2010. My unofficial projection for the end of year total has been lowered to 175 new FIPS 140-2 certs (there were 229 certs last year).

This is actually great news for anyone pursuing a FIPS 140-2 validation in 2011. CMVP review times have significantly improved this year and there is capacity for validation testing at all of the FIPS labs.

The chart below shows the breakdown of FIPS 140-2 certificates by Laboratory for 2011 (through May 27, 2011 there are 73 new FIPS certs). The number between the Lab name and the percentage is the number of certificates for 2011.

FIPS 140-2 turns a decade old

2011-05-25T00:01:00.000-07:00

FIPS 140-2 was signed by the Secretary of Commerce on May 25, 2001. Happy 10th anniversary!

One of the most popular questions I get is "When is FIPS 140-3 coming out?" The NIST schedule for FIPS 140-3 indicates that Secretary of Commerce will receive FIPS 140-3 for signature before the end of June. I have not seen any indication that this target time frame will be met, but I do not claim to have deep insight into the schedule.

If you have thoughts on the FIPS 140-3 schedule, please share in a comment for the benefit of others in the FIPS community. Thanks.

CMVP review times between 5 and 10 weeks for FIPS 140-2 validations

2011-05-16T03:00:00.000-07:00

Back in March, I posted that the CMVP review times for FIPS 140-2 validation reports had significantly improved. Since good news doesn't travel as fast as the other kind of news, I am still trying to get the word out that FIPS validations do not take as long to complete as they used to.

The last 8 reports submitted by InfoGard had the following CMVP review times (in weeks -- and I rounded up!):

2, 2, 5, 5, 5, 6, 7, 7

(Now, the 2-week review times were special cases, but they are worth noting to demonstrate the heightened responsiveness.) With these data points, I am lowering my Unofficial CMVP Review Time Estimate to "5 to 10 weeks."

[NOTE: My definition of "CMVP Review Time" is the time between report submission to the CMVP (Review Pending block on the Modules in Process List) to the day the Laboratory first receives comments from the CMVP (Coordination block on the Module in Process List).]

Share your experience in the comment section.

New drafts posted: SP 800-90 A and SP 800-57 Part 1

2011-05-09T13:25:00.000-07:00

Two new FIPS Special Publication drafts were posted on the NIST website:

SP 800-90 A - DRAFT Recommendation for Random Number Generation Using Deterministic Random Bit Generators
Comments due August 1, 2011

AND

SP 800-57 Part 1 - DRAFT Recommendation for Key Management: Part 1: General
Comments due July 1, 2011

The NIST website has details for comment submissions.

CMVP on pace with last year's FIPS 140-2 validations

2011-04-14T16:57:00.000-07:00

During the first quarter of 2011, the CMVP issued 53 new FIPS 140-2 certificates. If we use simple math to predict the number of new FIPS certificates for 2011 we get 212 (there were 229 new certs last year).

InfoGard is 13% ahead of our record year (2010) after the first quarter. I am predicting that the CMVP will be very close to equaling the number of new FIPS certificates this year. The chart below shows the breakdown by Laboratory for 2011 (through April 12, 2011 there are 57 new FIPS certs). The number under the Lab name is the number of certificates for 2011.

Comments posted for SP 800-131 B and 800-131 C

2011-04-12T12:15:00.000-07:00

The comments received for the following drafts have been posted:

Comments received on SP 800-131 B DRAFT Transitions: Validation of Transitioning Cryptographic Algorithm and Key Lengths

Comments received on SP 800-131 C DRAFT Transitions: Validating the Transition from FIPS 186-2 to FIPS 186-3

The draft SPs are available here.

US government shut down will close NIST CMVP

2011-04-08T12:22:00.000-07:00

NIST CMVP will be closed if the US Federal government is shut down on April 12th. Any work requiring NIST CMVP involvement will be delayed until the US government executes a resolution to the budget. A shut down will impact all FIPS 140-2 validations, revalidations, maintenance letters, and algorithm testing.

InfoGard and other FIPS laboratories will remain open. Lab testing services that do not require NIST CMVP involvement will continue.

If a shut down does occur, I expect that the CMVP's recent excellent review times to be significantly impacted.

InfoGard is hiring: Security Engineer

2011-04-04T12:54:00.000-07:00

InfoGard Laboratories is looking for a talented Security Engineer with great character traits and innate capabilities. Please visit the job description for details.

Code Corp. receives FIPS 140-2 certificates for Bar Code Readers

2011-03-18T08:32:00.000-07:00

Code Corporation selected InfoGard as their testing laboratory for the following FIPS 140-2 Level 2 Bar Code Readers and Bluetooth Modem:

Cert. #

1509 - CodeXML® FIPS Bluetooth® Modem

1519 - Code Reader 2500 FIPS and Code Reader 3500 FIPS

See Code Corporation's Press Release for more information. You may select the FIPS Certificate numbers above to visit the NIST website postings for these devices.

Congratulations on a successful FIPS validation Code Corp. Team!

GDC Technology's Integrated Media Block receives FIPS 140-2 Level 3 certificate

2011-03-17T17:31:00.000-07:00

GDC Technology selected InfoGard as their FIPS 140-2 testing laboratory for validation of their Integrated Media Block (IMB). A FIPS 140-2 validation at Security Level 3 is a requirement to meet Digital Cinema Initiative (DCI) specifications:

Cert. #

1518 - IMB

See the GDC Technology Press Release for more information. You may select the FIPS Certificate number above to visit the posting on the NIST website.

Congratulations to the GDC Team!

Public meeting March 18 to discuss Federal transition to SHA-256

2011-03-14T14:46:00.000-07:00

Re-posted summary from the Federal Register website:

The Civilian Agency Acquisition Council, and the Defense Acquisition Regulations Council are hosting the first of at least two public meetings to start a dialogue with industry and Government agencies about ways for the acquisition community to transition to Secure Hash Algorithm SHA-256. SHA-256 is a cryptographic hash function that is used in digital signatures and authentication protocols.

The meeting is March 18, 2011 from 9am-noon EDT. Visit the Federal Register website for more details.

Draft available for FIPS 201-2 PIV

2011-03-11T08:05:00.000-08:00

On March 8, NIST released the Draft FIPS 201-2, Personal Identity Verification of Federal Employees and Contractors.

Comments are due by June 6, 2011.

A workshop will be held April 18 and 19, 2011 at NIST in Gaithersburg, Maryland. Remote attendance is available via webcast. You must pre-register by April 11, 2011 to participate in the workshop.

The Draft FIPS 201-2 PIV document and workshop details are available at the NIST Draft Publications website.

NVLAP lab code listing

2011-03-08T12:22:00.000-08:00

The FIPS 140-2 validated modules listing now shows the NVLAP lab codes for the CST laboratories. The listing below provides a mapping of NVLAP lab codes to the accredited laboratory names for easy reference.

100414-0	Underwriters Laboratories, Inc.
100432-0	InfoGard Laboratories, Inc.
200002-0	CEAL: a CygnaCom Solutions Laboratory
200416-0	COACT Inc. CAFE Laboratory
200426-0	Computer Sciences Corporation
200427-0	SAIC Accredited Testing & Evaluation (AT&E) Labs (MD)
200492-0	SAIC Accredited Testing & Evaluation (AT&E) Labs (VA)
200556-0	EWA - Canada IT Security Evaluation & Test Facility
200636-0	TÜV Informationstechnik GmbH
200648-0	Aspect Labs, a division of BKP Security, Inc.
200658-0	atsec information security corporation
200697-0	ICSA Labs, An Independent Division of Verizon Business
200802-0	ÆGISOLVE, INC.
200822-0	Information Technology Security Center
200824-0	TTC IT Security Evaluation Laboratory
200835-0	ECSEC Laboratory Inc.
200856-0	Epoche & Espri
200900-0	stratsec lab

Canadian lab, CGI, no longer listed as a FIPS 140 lab

2011-03-08T12:11:00.000-08:00

The newest FIPS testing laboratory, CGI, is no longer listed on the NIST website.

FIPS 140-2 Implementation Guidance updated

2011-03-03T16:46:00.000-08:00

The FIPS 140-2 Implementation Guidance was updated on March 3, 2011. No new guidance is included in this update, but the following modified guidance may be of interest:

A.2 Use of Non-NIST-Recommended Asymmetric Key Sizes and Elliptic Curves

Updated for consistency with recent standards

A.6 CAVP Requirements for Vendor Affirmation of FIPS 186-3 Digital Signature Standard

Transition end date for FIPS 186-3 RSA is defined

Canadian FIPS 140-2 laboratory loses accreditation

2011-03-03T10:31:00.000-08:00

DOMUS Laboratory has dropped off the list of NIST accredited FIPS 140-2 testing laboratories. DOMUS performed the 3rd most validations in 2010 (13% of the total).

CMVP report review times getting faster?

2011-03-02T16:34:00.000-08:00

The CMVP review time for FIPS 140-2 report submissions has improved significantly in recent months. I am reducing my unofficial CMVP review time estimate to 2 to 4 months (previously, I had been telling customers that the queue time was 4 to 5 months).

Please note that this is my personal estimate based on actual report submissions by InfoGard. The review time estimate includes the time from report submission to the CMVP to the time comments are received by the Laboratory.

During lunch last month at the RSA Conference, I mentioned that InfoGard had experienced shorter report review times to Randy, Jean, and Allen of the CMVP. They joked with me that they could slow our report reviews down if it was causing a problem. I assured them that the shorter reviews were a big help to Labs, Vendors, and Customers!

Take the poll on the my home page to share your review time experience with others.

Draft SP 800-147 BIOS Protection Guidelines

2011-02-14T12:54:00.000-08:00

And another draft Special Publication is available:

SP 800-147 DRAFT Basic Input/Output System (BIOS) Protection Guidelines

Comments are due March 13, 2011.

Draft available for FIPS 180-4 (SHS)

2011-02-14T12:51:00.000-08:00

NIST has been busy publishing drafts this month. Now open for comments is:

FIPS 180-4 DRAFT Secure Hash Standard (SHS)

Comments are due May 12, 2011.

NIST draft SP 800-131 B & SP 800-131 C

2011-02-10T17:14:00.000-08:00

NIST published the following draft SPs. As expected, FIPS 140-2 Security Policies need to address algorithms and key lengths subject to transition requirements [details are in SP 800-131 A]. Comments to the draft Special Publications are due March 31, 2011.

SP 800-131 B
DRAFT Transitions: Validation of Transitioning Cryptographic Algorithm and Key Lengths

SP 800-131 C
DRAFT Transitions: Validating the Transition from FIPS 186-2 to FIPS 186-3

Stop by the InfoGard booth at the RSA Conference in San Francisco next week. We would be happy to answer your questions.

Looking for a free RSA Expo Pass for San Francisco?

2011-02-07T17:49:00.000-08:00

Obtain your FREE Hall Pass to visit InfoGard at RSA 2011!

With RSA 2011 approaching, InfoGard welcomes you to stop by our booth at the Moscone Convention Center in San Francisco, CA
February 14^th – February 17^th.

Booth #650

We invite you to explore our many service areas, including:

FIPS 140-2
Common Criteria
FIPS 201 (PIV)
Payment Card Industry (PCI)
Systems Evaluations
Electronic Health Record
And much more!

https://cm.rsaconference.com/US11/portal/regCode.ww. Click on “create new account” to register. Your badge will be available for on-site pick up.

You will need a registration code.

Contact Mark or Steve below to request a registration code.

Deadline to redeem Expo Pass Code - February 11, 2011

If you would like to arrange a meeting, please e-mail one of the following:

Mark Minnoch mminnoch@infogard.com FIPS Program Manager, or

Steve Wilson swilson@infogard.com Common Criteria Evaluations Manger

We hope to see you there!

Sincerely,

InfoGard Laboratories, Inc.

Another InfoGard CISSP

2011-02-01T15:36:00.000-08:00

National Doughnut Day, National Ice Cream Day, National Hot Dog Day -- we celebrate just about everything here at InfoGard (especially if food is involved).

Our favorite celebrations are customer successes and fellow InfoGardian successes. We just had another FIPS Security Engineer pass the CISSP exam. That makes a total of 15 CISSPs at InfoGard!

Congratulations to Harmony!

NIST draft SPs on Cloud Computing

2011-01-28T16:08:00.000-08:00

I check the NIST Special Publications 800 Series on a regular basis so you don't have to. A couple of interesting drafts hit the website today:

SP 800-145: DRAFT A NIST Definition of Cloud Computing
SP 800-144: DRAFT Guidelines on Security and Privacy in Public Cloud Computing

If you would like to provide feedback to NIST on the above documents, do so before February 28, 2011. For more details, visit the NIST website using the link above.

NIST SP 800-131A Released

2011-01-20T16:00:00.000-08:00

JUST RELEASED: NIST Special Publication 800-131A - "Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths"

SP 800-131A addresses the use of algorithms and key lengths used by Federal government agencies for the protection of sensitive but unclassified information.

Another Special Publication is expected soon: SP 800-131B. This SP will address the validation of FIPS 140-2 cryptographic modules that utilize the algorithms and keys detailed in SP 800-131A.

A big "Thank You!" to Elaine and Allen for incorporating the feedback from Federal Customers, Vendors, and Labs into the final version.

No More Posting of Individual FIPS 140-2 Certificates

2011-01-19T11:57:00.000-08:00

As of January 5, 2011, the CMVP will no longer print, sign, or post individual FIPS 140-2 certificates. Instead a consolidated validation certificate is auto-generated that will reference a collection of individual module validations. This will be generated and signed by the NIST and CSEC signatories on a periodic basis. The consolidated certificate will then be posted on the NIST CMVP web site to provide traceability to the signatories.

This more streamlined process should allow for much faster website postings during the "Finalization" phase of the FIPS validation process.

2010 Was a Record Year for the CMVP

2011-01-14T14:21:00.000-08:00

The CMVP had a record year of 229 FIPS 140-2 Certificates in 2010. InfoGard Laboratories performed 34% of the total (78).

2010 Percentage of FIPS 140-2 Certificates by Lab

InfoGard at RSA Conference

2011-01-13T21:40:00.002-08:00

InfoGard will be at Booth #650 at the RSA Conference in San Francisco, CA February 14-17, 2011. Please stop by to see us.

FIPS 140-2 Implementation Guidance Updated

2011-01-13T21:40:00.001-08:00

The FIPS 140-2 Implementation Guidance was updated on December 23, 2010:

New Guidance

12/23/10: 1.16 Software Module

12/23/10: 1.17 Firmware Module

12/23/10: 2.1 Trusted Path

12/23/10: 5.5 Physical Security Level 3 Augmented with EFP/EFT

12/23/10: 9.7 Software/Firmware Load Test

12/23/10: 14.5 Critical Security Parameters for the SP 800-90 DRBGs

Modified Guidance

12/23/10: 9.6 Self-Tests When Implementing the SP 800-56A Schemes – Requirements changed.

CISSPs at InfoGard

2011-01-13T21:40:00.000-08:00

Six more InfoGard Security Engineers passed the CISSP exam in late 2010. That brings the total CISSPs at InfoGard to 14! That sets a record for any FIPS Lab.

Congrats to Annie, Marc, Adam, Kenji, Ryan, and Steve!

New FIPS Lab

2011-01-13T21:31:00.000-08:00

CGI in Canada became accredited by NIST this month to perform FIPS 140-2 validations. That brings the total number of Labs to 20 (11 of the 20 are in the US).

The complete list of Labs is available here: http://csrc.nist.gov/groups/STM/testing_labs/index.html

InfoGard wishes CGI all the best!