FIPS 140-2 Deprecation Is Here: What the September 2026 Transition Means for CMMC Environments

September 21, 2026 marks an important transition for organizations relying on FIPS-validated cryptography. FIPS 140-2 validated cryptographic modules are reaching the end of their time on the Cryptographic Module Validation Program (CMVP) Active list, with FIPS 140-3 becoming the current validation standard moving forward.

For organizations supporting the Defense Industrial Base, that naturally raises questions. Does a FIPS 140-2 module suddenly become noncompliant? Does existing equipment need to be replaced immediately? And what does this transition mean for organizations preparing for or maintaining CMMC compliance?

The short answer: this is a transition that requires attention, not panic.

What Actually Happens to FIPS 140-2 on September 22, 2026?

Beginning September 22, 2026, FIPS 140-2 module validation certificates will be moved from the CMVP Active list to the Historical list. FIPS 140-3 validated modules will remain on the Active list and represent the current standard for new cryptographic module validations.

That distinction matters. A module moving to the Historical list does not mean that its cryptography suddenly stops working, nor does it mean every FIPS 140-2 product must immediately be removed from an environment.

NIST’s guidance recognizes continued use of historical modules in existing systems, while generally discouraging their use in new systems. For organizations operating CMMC environments, the practical question therefore becomes less about replacing everything overnight and more about understanding where FIPS 140-2 modules are currently being relied upon and developing an appropriate transition strategy.

Why This Matters for CMMC and NIST SP 800-171

For organizations operating under CMMC requirements, FIPS validation is not simply a product feature or procurement preference. It connects directly to the cryptographic protections used to safeguard Controlled Unclassified Information (CUI).

Under NIST SP 800-171 Rev. 2, security requirement 3.13.11 states that organizations must employ FIPS-validated cryptography when cryptography is used to protect the confidentiality of CUI. This means organizations should be able to identify where cryptography is performing that function and understand the validation status of the cryptographic modules they rely upon.

NIST SP 800-171 Rev. 3 changes the wording of 03.13.11. Rather than carrying forward the same explicit requirement language from Rev. 2, Rev. 3 requires organizations to define and implement the types of cryptography used to protect CUI confidentiality, while its discussion recommends FIPS-validated cryptography and references FIPS 140-3.

That distinction is important when discussing CMMC. Organizations should evaluate the requirements applicable to their contracts and CMMC environment rather than assuming that the publication of Rev. 3, or the movement of FIPS 140-2 certificates to the Historical list, automatically changes their current contractual obligations.

Historical Does Not Mean “Immediately Noncompliant”

One of the easiest mistakes to make with this transition is to interpret “Historical” as “revoked.” Those are not the same thing.

NIST states that after September 21, 2026, FIPS 140-2 validated modules will move to the CMVP Historical list and may continue to be used for existing systems. The transition primarily changes how organizations should approach new systems and future technology decisions: FIPS 140-2 modules should no longer be selected for new systems, while FIPS 140-3 becomes the path forward.

This means an organization should not look at September 22 as a deadline to indiscriminately replace every FIPS 140-2 module in its environment. Instead, it should understand which systems rely on those modules, whether those systems are existing or new, and what the vendor’s FIPS 140-3 transition path looks like.

There is also a useful signal in current DoD CMMC guidance. The March 2026 CMMC FAQ specifically uses replacing an older FIPS 140-2 firewall with a FIPS 140-3 firewall as an example of a routine security-maintenance change that, by itself, is not considered a significant change.

What Organizations Should Be Doing Now

The FIPS 140-2 transition is a good opportunity to take inventory rather than make assumptions. Organizations should understand not only which products claim to support FIPS, but which cryptographic modules are actually being used to protect CUI and whether those modules have the appropriate CMVP validation.

A practical review should include:

• Identify where cryptography protects CUI. Look beyond firewalls. Consider VPNs, endpoints, servers, storage, cloud services, applications, mobile devices, and other technologies that encrypt CUI.
• Verify the actual cryptographic module. A vendor stating that a product is “FIPS compliant” or operates in a “FIPS mode” is not necessarily the same as the cryptographic module having a CMVP validation certificate.
• Review the CMVP certificate and tested configuration. Determine which module version was validated and whether the implementation and configuration in your environment align with the validated module.
• Check vendor transition plans. For products currently relying on FIPS 140-2 validations, determine whether the vendor has a FIPS 140-3 validated module available or has published a migration roadmap.
• Document your decisions. Maintain evidence showing what was reviewed, the validation status identified, and any migration or replacement decisions. This can be valuable during internal reviews and CMMC assessment preparation.
• Build FIPS 140-3 into future technology decisions. New procurements and major technology refreshes provide a natural opportunity to move away from dependencies on historical FIPS 140-2 modules.

Don’t Confuse “Supports FIPS” With “FIPS Validated”

One final point is worth emphasizing: marketing language is not validation. A product may advertise FIPS support, use FIPS-approved algorithms, or offer a FIPS mode without necessarily using a cryptographic module that has been validated through the CMVP.

When FIPS-validated cryptography is required, organizations should verify the applicable CMVP certificate and confirm that the module, version, and configuration they are using align with that validation. This is especially important when evaluating new products or planning a transition from FIPS 140-2 to FIPS 140-3.

The Bottom Line

September 22, 2026 is an important milestone, but it is not a reason to panic. Organizations should use the FIPS 140-2 transition as a prompt to understand their current cryptographic dependencies, verify what is actually validated, and develop a deliberate path toward FIPS 140-3.

For CMMC environments, knowing what protects your CUI, and being able to demonstrate why you trust it, is ultimately more valuable than simply checking a box that says “FIPS.”

Sources & Further Reading

NIST: FIPS 140-3 Transition Effort
NIST: Cryptographic Module Validation Program: Validated Modules
DoW CIO: CMMC Frequently Asked Questions, Version 5.0 (March 2026)