What Is FIPS?
Federal agencies, federal contractors and the vendors they interact with have legal requirements they must follow regarding the security of information technology (IT). The Information Technology Reform Act of 1996 and the Federal Information Security Management Act of 2002 are the laws authorizing the creation of these technology requirements. FIPS are the documents that were created from these requirements.
Other People Are Reading
-
Defining FIPS
-
The Federal Information Processing Standards (FIPS) describe a set of standards that all government contractors, non-military government agencies and vendors working with the government agencies must follow regarding encryption, document processing and other IT (information technology) products and standards. FIPS are developed by the National Institute of Standards and Technology (NIST). The Secretary of Commerce has final approval over what FIPS and guidelines are used.
FIPS Publications
-
Published by the NIST, each FIPS is numbered, titled and dated. Some of the topics found in FIPS are---Personal Identity Verification (PIV) of Federal Employees and Contractors, Minimum Security Requirements for Federal Information and Information Systems, Advanced Encryption Standard, Guideline for The Analysis of Local Area Network Security. Publications are first listed as drafts before approval. FIPS do not apply to national security systems. National security issues are handled by The Committee on National Security Systems (CNSS).
-
FIPS Certification
-
Vendors must use FIPS approved products when working on a government contract. From computer parts to flash drives to modems, every product supplied must follow the requirements outlined in all FIPS publications that are listed with the contract. Sometimes vendors will take a product that is used throughout all government contracts and have it FIPS certified (validated). ScanDisk Corporation is one such vendor who has FIPS certified their Cruzer Enterprise flash drives. This certification indicates the product has met standards for design of the NIST cryptographic module (requirements for strengthened encryption algorithms).
FIPS Standards
-
FIPS are announced in a public forum and are not secrets or classified information. Standards within the FIPS publications are not always original material. Many of the standards that are documented are used among private corporations and businesses all over the U.S. References to these established standards may be documented in full or may be modified to fit government needs. For example, FIPS publication 140-1, titled, Computer Security For Cryptographic Modules, references IEEE (The Institute of Electrical and Electronic Engineers, Inc.) Standard Number 1012, which is titled, Standard for Software Verification and Validation.
Finding FIPS
-
Companies like the 1105 Government Information Group provide information on the latest FIPS news geared specifically for the government information technology sector. The Office of the Federal Register is the governments official publication office for the daily posting of news from Federal agencies including NIST and their FIPS.
-
