“Historical” Is Not “Revoked”: Understanding the FIPS 140-2 Transition

September 22, 2026 has arrived, and with it comes an important change to the status of FIPS 140-2 validated cryptographic modules.

As planned by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP), FIPS 140-2 validation certificates have moved from the Active list to the Historical list. FIPS 140-3 validations now represent the modules remaining on the Active list.

That change can sound more dramatic than it actually is.

Seeing a cryptographic module listed as Historical may naturally raise questions about whether its validation is still meaningful or whether continued use of the module is prohibited.

But NIST makes an important distinction:

Historical does not mean revoked.

Understanding that difference is essential when interpreting the FIPS 140-2 transition.

What Does “Historical” Actually Mean?

The CMVP maintains different validation statuses for cryptographic modules.

According to NIST, a validation certificate may be moved to the Historical list because it is older or because of a programmatic transition, exactly what is occurring with FIPS 140-2.

NIST specifically states that a Historical designation does not mean the overall FIPS 140 certificate has been revoked. NIST also notes that certificates and associated documentation on the Historical list may not reflect the program’s latest guidance or transitions.

For the current transition, the distinction is particularly straightforward.

FIPS 140-2 modules remained on the Active list through September 21, 2026. Beginning September 22, only FIPS 140-3 validations remain on the Active list, while the FIPS 140-2 certificates transition to Historical status.

The status changed.

That does not mean the certificates were automatically revoked.

What Does “Revoked” Mean?

Revoked has a substantially different meaning within the CMVP.

NIST states that when a validation certificate is marked Revoked, the module validation is no longer valid and cannot be referenced to demonstrate compliance with the FIPS 140 standards.

That is very different from a module appearing on the Historical list.

A useful way to think about the distinction is:

Historical: The validation has moved off the Active list, but the certificate has not necessarily been revoked.

Revoked: The module’s validation is no longer valid and cannot be used to demonstrate compliance with FIPS 140.

Those two statuses should not be treated interchangeably.

Can FIPS 140-2 Modules Still Be Used?

This is where the transition becomes especially important.

NIST’s current CMVP guidance states that after FIPS 140-2 modules move to the Historical list, agencies may continue using them for existing systems. NIST also states that agencies should continue making use of FIPS 140-2 modules until replacement FIPS 140-3 modules become available.

NIST’s FIPS 140-3 transition material similarly explains that CMVP supports the purchase and use of Historical FIPS 140-2 modules for existing systems.

The distinction between existing systems and new systems therefore matters.

The transition does not amount to a universal instruction to remove every FIPS 140-2 validated module from service on September 22.

Instead, it marks a change in the lifecycle of the validation program as FIPS 140-3 becomes the current standard for new cryptographic module validations.

Why the Active List Changed

FIPS 140-3 itself is not new.

NIST published FIPS 140-3 in March 2019, superseding FIPS 140-2. CMVP began accepting FIPS 140-3 module submissions in September 2020 and stopped accepting new FIPS 140-2 validation submissions as the program transitioned toward the newer standard.

September 22, 2026 represents another milestone in that multi-year transition.

Rather than viewing the date as the moment FIPS 140-2 suddenly became invalid, it is more accurate to view it as the point at which the CMVP’s Active validation list completes its transition to FIPS 140-3.

That distinction matters because the terms Active, Historical, and Revoked have specific meanings within the validation program.

What About CMMC Environments?

For organizations in the Defense Industrial Base, the transition is particularly relevant because FIPS-validated cryptography appears in the cybersecurity requirements associated with protecting Controlled Unclassified Information.

But the movement of FIPS 140-2 certificates to the Historical list should not be interpreted in isolation.

Organizations need to distinguish between the status of a cryptographic module within the CMVP and the cybersecurity requirements applicable to a particular contract or environment.

Current DoD CMMC guidance provides a useful example. The March 2026 CMMC FAQ describes replacing an older FIPS 140-2 firewall with a FIPS 140-3 firewall as an example of routine security maintenance rather than, by itself, a significant change requiring reassessment.

That example reinforces the broader reality of the transition: moving from FIPS 140-2 to FIPS 140-3 is expected to occur as technologies and environments evolve.

It does not suggest that every FIPS 140-2 implementation suddenly became invalid on the same date.

The CMVP Certificate Still Matters

There is another important reason to understand these status terms correctly.

FIPS validation applies to a cryptographic module, not simply to a product name or a vendor’s marketing statement.

The CMVP database provides validation information that can include the module, certificate number, validation standard, status, and other information associated with the validation.

With the September transition, users searching the CMVP database also need to understand that FIPS 140-2 certificates may no longer appear when looking only at Active validations.

NIST notes that Historical modules can be found through the Validated Modules search by selecting Historical as the validation status.

That makes understanding the database itself increasingly important.

A module disappearing from an Active-only search does not necessarily mean its certificate disappeared.

It may simply have moved to the Historical list.

Words Matter in Compliance

The FIPS 140-2 transition is a good example of why terminology matters in cybersecurity and compliance.

Superseded does not necessarily mean prohibited.

Historical does not mean revoked.

And Revoked has a specific consequence within the CMVP that should not be casually applied to modules that merely transitioned off the Active list.

The safest way to understand the status of a cryptographic module is to look at the CMVP information itself rather than relying on assumptions created by a status label.

The Bottom Line

September 22, 2026 marks an important milestone in the transition from FIPS 140-2 to FIPS 140-3.

FIPS 140-3 is now the standard represented on the CMVP Active list, while FIPS 140-2 certificates have transitioned to Historical status.

But the key point is simple:

Historical is not Revoked.

NIST explicitly distinguishes between the two. Historical FIPS 140-2 modules may continue to have a role in existing systems, while a Revoked validation is no longer valid and cannot be referenced to demonstrate FIPS 140 compliance.

Understanding that distinction provides a much clearer picture of what actually changed on September 22, and what did not.

Sources & Further Reading

NIST: Cryptographic Module Validation Program FAQ
NIST: FIPS 140-3 Transition Effort
NIST: CMVP Validated Modules
DoD: CMMC Frequently Asked Questions, Version 5.0