Cryptographic Module Validation Program CMVP

NIST Cost Recovery Fees

2020 Fees

[Updated 09-15-2020]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 1B, 3 and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 2, 3A, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all five scenarios).

For FIPS 140-3

Currently the CR fee is applicable for Scenarios 1OEM, 3MC and 5FS; the CR fee is not applicable for Scenario's 1VI, 1OEA, 1VA, 1UP, 1AU, 2SC, 1MU, 3CVE and 4PSC. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-3 (all scenarios).

The following fee structure is effective October 1, 2020:

  Base fee: Extended
fee:

FIPS 140-2 IG G.8 Scenarios 1, 2, 3A and 4

FIPS 140-3 Scenarios 1VI, 1OEA, 1VA, 1UP, 1AU, 2SC, 1MU, 3CVE and 4PSC

N/A $1,000

FIPS 140-2 IG G.8 Scenarios 1A and 1B

FIPS140-3 Scenario 1OEM

$2,000 $1,000

FIPS 140-2 IG G.8 Scenario 3

FIPS 140-3 Scenario 3MC

$4,000 $1,500

FIPS 140-2 IG G.8 Scenario 5

FIPS 140-3 Scenario 5FS

   
 Security Level 1: $8,000 $3,000
 Security Level 2: $10,000 $4,000
 Security Level 3: $10,000 $4,000
 Security Level 4: $10,000 $4,000

Back to Top


2019 Fees

[Updated 10-01-2019]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP Management Manual for further information.

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 1B, 3 and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 2, 3A, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all five scenarios).

The following fee structure is effective October 1, 2019:

  • IG G.8 Scenario's 1, 2, 3A, and 4: CR fee N/A, ECR fee: $1000
  • IG G.8 scenario's 1A and 1B: CR fee $2000, ECR fee: $1000
  • IG G.8 Scenario 3: CR fee $4000, ECR fee: $1500
  • IG G.8 Scenario 5:
    • Security Level 1: CR fee: $8000, ECR fee: $3000
    • Security Level 2: CR fee: $10000, ECR fee: $4000
    • Security Level 3: CR fee: $10000, ECR fee: $4000
    • Security Level 4: CR fee: $10000, ECR fee: $4000

Back to Top

Created October 11, 2016, Updated October 16, 2020