The mountains we climb

The certifications we guide

Eight Federal programs, one accountable team.

• FIPS 140-3Cryptographic modules · CUI+

  Who needs it. Vendors whose products use cryptography to protect Controlled Unclassified Information (CUI) in the US and Canada.

  Scope of work. · Initial Assessment (high level understanding of the product, scope, targeted user(s), implementation, targeted release and release date, etc.) · Gap Analysis and determination of targeted Level (1-4) for the cryptographic module (can be a software module, chip, complete hardware, firmware or software product...depends on the boundary) · Guidance on Post Quantum Cryptography (PQC), Implementation Guidance, etc. · Design consultation to close identified gaps in the architecture · Guidance to design future releases with “FIPS in mind” · Documentation preparation (Security Policy, Cryptographic Module Specification, Finite State Model, Vendor Evidence, etc.) · CAVP Algorithm Testing and Certification · Entropy Source Validation · Project Management · Testing Lab recommendations and pricing negotiations

• Common Criteria — NIAP Protection ProfileNIAP CC · US Federal+
• Common Criteria — EAL 2-4 / EUCC / CRAEAL · EUCC · Cyber Resilience Act+
• CSfCCommercial Solutions for Classified+
• FedRAMP & GovRAMPModerate · High · Ready · SLED+
• CMMCLevel 1 & 2 · NIST 800-171 rev.2+
• GSA CIO-IT Security 21-112NIST 800-171 rev.3+
• Section 508Accessibility compliance+