Cryptographic Module Validation Program CMVP

[Updated 12-21-2022]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 3, 3B, 4, and 5; the CR fee is not applicable for IG G.8 Scenario's 1 and 3A. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all scenarios). Scenarios 5 and 3 submissions were accepted through March 31, 2022 for those that received prior approval. Scenarios 1B and 2 have been discontinued.

For FIPS 140-3

Currently the CR fee is applicable for Scenarios UP, FS, and Entropy Source Validations (ESV); the CR fee is not applicable for Scenario VU. The ECR fee may be applied to test reports received by NIST CMVP under FIPS 140-3 (all scenarios). As the scenarios are not finalized, the scenario structure may change this year. However, the fees should remain the same as the current scope.

For Entropy Validation

The entropy validation table is provided below.

The following fee structure is effective Jan 1, 2023 and is subject to change to reflect actual operating costs. 

Back to Top

[Updated 12-6-2021]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 3, 3B, 4, and 5; the CR fee is not applicable for IG G.8 Scenario's 1 and 3A. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all scenarios). Scenarios 5 and 3 submissions will be accepted through March 31, 2022 for those that received prior approval. Scenarios 1B and 2 have been discontinued.

For FIPS 140-3

Currently the CR fee is applicable for Scenarios UP, FS, ENT, and EU; the CR fee is not applicable for Scenario VU. The ECR fee may be applied to test reports received by NIST CMVP under FIPS 140-3 (all scenarios). As the scenarios are not finalized, the scenario structure may change this year. However, the fees should remain the same as the current scope.

For Entropy Validation

Currently there is no CR or ECR fee. This is expected to change with next year's update. The entropy validation table is provided below.

The following fee structure is effective Dec 20, 2021 and is subject to change to reflect actual operating costs. 

Back to Top

[Updated 08-10-2021]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 3, and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 3A, 3B, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all scenarios). Scenarios 5 and 3 submissions will be accepted if approved through March 31, 2022. Scenarios 1B and 2 have been discontinued.

For FIPS 140-3

Currently the CR fee is applicable for Scenarios UP, FS, ENT, and EU; the CR fee is not applicable for Scenario's VU, OE & QU. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-3 (all scenarios).

The following fee structure is effective October 1, 2021 and is subject to change to reflect actual operating costs. Any change in rates for FY2021 will be reflected in the table below.

Back to Top

[Updated 09-15-2020]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 1B, 3 and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 2, 3A, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all five scenarios).

For FIPS 140-3

Currently the CR fee is applicable for Scenarios 1OEM, 3MC and 5FS; the CR fee is not applicable for Scenario's 1VI, 1OEA, 1VA, 1UP, 1AU, 2SC, 1MU, 3CVE and 4PSC. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-3 (all scenarios).

The following fee structure is effective October 1, 2020:

Back to Top

[Updated 10-01-2019]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP Management Manual for further information.

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 1B, 3 and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 2, 3A, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all five scenarios).

The following fee structure is effective October 1, 2019:

• IG G.8 Scenario's 1, 2, 3A, and 4: CR fee N/A, ECR fee: $1000
• IG G.8 scenario's 1A and 1B: CR fee $2000, ECR fee: $1000
• IG G.8 Scenario 3: CR fee $4000, ECR fee: $1500
• IG G.8 Scenario 5:
  • Security Level 1: CR fee: $8000, ECR fee: $3000
  • Security Level 2: CR fee: $10000, ECR fee: $4000
  • Security Level 3: CR fee: $10000, ECR fee: $4000
  • Security Level 4: CR fee: $10000, ECR fee: $4000