FIPS 140-2 Retirement Sparks Compliance Challenges for MSSPs

The FIPS 140-2 standard will transition to Historical status on September 21, 2026, affecting compliance for many organizations. Managed Security Service Providers (MSSPs) must help clients identify vulnerabilities in older cryptographic libraries and embedded modules, which are often overlooked. While hardware security modules (HSMs) are mostly compliant, authentication tokens and cryptographic libraries are lagging behind, with many still validating at Level 1. This uneven readiness poses a risk for clients under various compliance regimes, including FedRAMP and HIPAA. MSSPs are advised to inventory cryptographic modules by certificate and not by vendor to ensure compliance. The transition to FIPS 140-3 introduces new standards and procedural changes, requiring organizations to adapt their security practices. The current landscape shows a mix of completed transitions and ongoing gaps that could lead to procurement issues.

Key Points: • FIPS 140-2 certificates will move to Historical status on September 21, 2026. • MSSPs need to identify vulnerabilities in older cryptographic libraries and embedded modules. • Transition to FIPS 140-3 introduces new standards and procedural changes for compliance.