2026 — Establish the baseline.
FIPS 140-2 modules move to the Historical list in September 2026. The immediate task is to know which cryptographic dependencies exist, who owns them and which must change first.
The NIST Cryptographic Module Validation Program states that FIPS 140-2 modules may continue to be accepted by US and Canadian federal agencies through 21 September 2026. Historical status does not mean that every deployed module instantly becomes unusable; acceptance depends on the applicable procurement and security rules.
FIPS 140-3 addresses cryptographic module validation; FIPS 203, 204 and 205 define post-quantum algorithms. A FIPS 140-3 certificate alone is not evidence that a system has completed post-quantum migration.
- 01
Inventory
Record algorithms, protocols, certificates, HSMs, libraries and embedded devices across IT, operational technology and external services.
OUTPUTCryptographic inventory with owners and dependencies - 02
Classify
Identify data whose confidentiality must survive many years; separate urgent key-establishment exposure from signature and long-lived device risks.
OUTPUTRisk-ranked migration register - 03
Set the control point
Define acceptance criteria for vendors and replacements, including algorithm support, interoperability, validation status and rollback.
OUTPUTApproved baseline and procurement criteria
An accountable owner can identify every priority cryptographic dependency and the planned disposition of each FIPS 140-2 module.