CMVP
The joint US–Canadian programme that certifies cryptographic modules against FIPS 140, and the reason HSM datasheets list certificate numbers.
The Cryptographic Module Validation Program started in 1995 and is run jointly by NIST and Canada's Communications Security Establishment. The vendor hires an accredited test lab, which checks the module against FIPS 140 and forwards the report. If it passes, the module goes on a public list with a certificate number. The algorithms inside must first have passed the sister programme, CAVP.
US federal agencies may only use validated modules to protect sensitive data, so the whole market bends around it. The queue is notoriously long, often more than a year, and a validation covers one exact version. Change the firmware and you are more or less starting over, which is why many products deliberately ship an older, certified crypto module. FIPS 140-2 certificates moved to the historical list in September 2026, leaving 140-3.