Which standard defines requirements for cryptographic modules used by federal agencies?

• A. FIPS
• B. PCI-DSS
• C. HIPAA
• D. ISO 27001

Answer: (A)

Security for federal systems relies on cryptographic modules that have been formally validated against a U.S. government standard. The standard that defines the requirements for these cryptographic modules is FIPS, specifically the FIPS 140-series. Modules are tested and validated under the Cryptographic Module Validation Program to ensure they meet defined security levels for aspects like algorithm support, physical and logical security, and key management.

Other standards mentioned target different domains: PCI-DSS governs payment card data security, HIPAA addresses healthcare information protection, and ISO 27001 outlines an information security management system. None of these are the official federal cryptographic module validation standard used for agencies.