Which is the U.S. standard for cryptographic modules?

• A. ISO 27001
• B. NIST SP 800-53
• C. PCI-DSS
• D. FIPS

Answer: (D)

FIPS defines the U.S. standard for cryptographic modules, setting the security requirements for modules used to protect federal information and the validation process they must go through before they can be used in government systems. Specifically, FIPS 140-2 (and the newer FIPS 140-3) outlines how cryptographic modules should be designed, implemented, and tested, covering areas like physical security, cryptographic algorithms, key management, and tamper evidence. The Cryptographic Module Validation Program (CMVP), run by NIST in partnership with another agency, is how modules get validated to meet these requirements.

Other standards mentioned serve different purposes: ISO 27001 focuses on information security management systems and is international, NIST SP 800-53 catalogs security controls for federal systems, and PCI-DSS targets protection of payment card data. They aren’t the U.S. standard specifically for cryptographic modules, which is why FIPS is the correct reference.