The Cryptographic Module Validation Program (CMVP) is a U.S. government program run by NIST and the Communications Security Establishment of Canada. It evaluates cryptographic modules against applicable FIPS standards, including FIPS 140-3. A module is a defined hardware, software, or firmware component that performs cryptographic functions.
CMVP validation applies to a specific module version and documented operating conditions-not automatically to every product from the same vendor. In practice, security teams should check the module’s certificate, status, security policy, and approved mode of operation when assessing an HSM or other cryptographic component. A vendor roadmap or general claim of FIPS compliance is not a substitute for a matching validation record. This matters in procurement and audits because a certificate’s status and scope can affect whether a module is suitable for a particular system or policy.