The CMVP is offering an interim validation process for module submissions. This interim validation option is voluntary; however, CSTLs must notify CMVP of the vendor's intent prior to 1 Oct 2024.
Vendors do not need to take any action if they would prefer to wait for their full review to be completed to receive full, five-year validation. Vendors who would like to elect the interim validation should follow the process below.
These module submissions will be reviewed for completeness by CMVP staff. If needed, there will be a brief period of Coordination with the CST lab to resolve any questions. Once this step is successfully completed:
- A two-year sunset date (expiration date) will be awarded.
- The ‘Interim Validation” caveat will be added to the certificate validation entry to distinguish them from a full validation (see CMVP Caveats webpage for more information)
- A supplementary follow-up submission, adhering to the SP 800-140Br1 format, may be submitted to the CMVP. This follow-up submission must be received by the CMVP prior to the two-year sunset date for the interim validation to remain on the active list until the completion of the follow-up submission.
- Any non-compliance identified (e.g., during the follow-up review) will be resolved with existing processes and provide the opportunity for a timely resolution prior to moving the validation certificate to the Historical or Revocation lists (see FIPS 140-3 Management Manual 4.8 for more information).
- After a successful review and completion of this follow-up, the "Interim Validation" status will be lifted, and the sunset date will be extended to accommodate an increase from two to five years for the total validation period.
- The validation will be moved to the historical list if the follow-up submission is not received prior to the two-year sunset date.
The interim validation submission must meet the following criteria:
- The vendor must inform the CMVP through their Cryptographic Security Testing (CST) lab if they elect to choose interim validation.
- The requesting CST lab must be in an active status with NVLAP.
- The original submission must have been received by the CMVP prior to 1 Jan 2024, and have not yet been validated.
- The submission must be fully tested and evaluated for conformance to the FIPS 140-3 standard by an active, accredited CST lab.
- The submission much be recommended for validation by the accredited CST lab who performed the testing.
- In addition to the original submission documents, the CST lab must also complete and sign a CMVP-provided requirement checklist.
