FIPS 140-2 Certification

Thales eSecurity helps you meet your needs for data security compliance with FIPS 140-2 certified products.

Americas Map


Active now

FIPS 140-2

The Federal Information Processing Standard (FIPS) Publication 140-2 (FIPS PUB 140-2), commonly referred as FIPS 140-2, is a US government computer security standard used to validate cryptographic modules. FIPS 140-2 was created by the NIST and, per the FISMA, is mandatory for US and Canadian government procurements. Many global organizations are also mandated to meet this standard.

Thales eSecurity delivers security products that have been tested and validated against the rigorous FIPS 140-2 standard, helping you comply with regulations while also giving you the confidence you need in your cryptographic tools.

Security Standard

According to FIPS Publication 140-2:

“[It] provides a standard that will be used by Federal organizations when these organizations specify that cryptographic-based security systems are to be used to provide protection for sensitive or valuable data. Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrity of the information protected by the module. This standard specifies the security requirements that will be satisfied by a cryptographic module.

… The security requirements cover areas related to the secure design and implementation of a cryptographic module. These areas include cryptographic module specification; cryptographic module ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.”

Certification Authorities

The US NIST (National Institute of Standards and Technology) and Canadian CSE (Communications Security Establishment) jointly participate as certification authorities in the CMVP (Cryptographic Module Validation Program) to provide validation of cryptographic modules to the FIPS 140-2 standard.

For more information, click here.

Thales eSecurity Support for FIPS 140-2 Security Standard

Thales develops cryptographic products and subsystems that conform to the FIPS 140-2 security standard. Thales eSecurity products that meet the standard include:

Hardware Security Modules (HSMs)

  • The payShield family of HSMs are proven hardware security modules dedicated to the payment industry for issuing credentials, processing transactions and managing keys.

Data at Rest Encryption – Vormetric Data Security Platform

  • At the center of the Vormetric Data Security Platform is the Vormetric Data Security Manager (DSM), providing key and policy management for Vormetric Transparent Encryption, Vormetric Tokenization and Vormetric Application Encryption. Delivered in virtual and physical appliance form factors, the DSM delivers key storage and protection for data at rest.

Data in Motion Encryption Hardware

  • Datacryptor 5000 appliances provide robust network data security, low latency, and high performance in Layer 2 and IP networks.

Please find a summary of Thales eSecurity products that are certified to the FIPS 140-2 standard here.

Data Sheet : Platform Data Sheet

The Vormetric Data Security Platform makes it efficient to manage data-at-rest security across your entire organization. Built on an extensible infrastructure, Vormetric Data Security Platform products can be deployed individually, while sharing efficient, centralized key management.


Data Sheet : Datacryptor 5000 Series

The Datacryptor 5000 Series is a family of high-speed data in motion security platforms that deliver high performance encryption at near zero latency. Using advanced connectivity features, the Datacryptor 5000 Series secures data through Ethernet and IPv4/IPv6 Wide Area Networks. Industry-unique throughput optimization techniques ensure up to 95% network efficiency over Metro Carrier Ethernet, IP, cellular, and SATCOM networks. While other solutions merely encrypt data, Datacryptors provide a complete security solution that scales from simple point-to-point to many hundreds of endpoints.


Other key data protection and security regulations

NIST 800-53 / FedRAMP

Americas Map Thumbnail


Active now

Since June 5, 2014 federal agencies have been required to meet FedRAMP standards, ensuring they meet internal data security standards and extended security controls for cloud-computing.

Learn More


Americas Map Thumbnail


Active now

These regulations cover healthcare information in the US, HIPAA relates to protection; encryption, key management. etc and HITECH relates to disclosure of data breaches.

Learn More


Americas Map Thumbnail


Active now

United States Federal Law setting standards for a range of US companies, SOX Act sections 302 and 404 relate directly to data protection.

Learn More
Contact a Compliance Specialist Contact Us
Are you fit for GDPR Take our readiness assessment now
Read the Compliance and Regulations Solutions Handbook Read the eBook
Watch our interactive demo Explore
Schedule a live demo Schedule
Get in contact with a specialist Contact us