FIPS 140-3 is a U.S. government standard for the hardware and software that performs encryption and related security functions. FIPS stands for Federal Information Processing Standards. Encryption protects information by making it unreadable without the appropriate key; this standard addresses how the components doing that work are designed and operated.

These components are called cryptographic modules. A module might be a reusable piece of encryption software within an application or a dedicated hardware device. To be FIPS-validated, a particular version of that component, used in a specified way, must complete independent testing and review against the standard's requirements.

You may encounter FIPS 140-3 in a security questionnaire, a procurement policy, or a government contract requirement. A request for FIPS-validated cryptography asks for formal evidence about the components performing the encryption. It is a more specific requirement than asking whether a provider encrypts information.

Files.com's Position

Files.com does not offer a FIPS edition or a FIPS mode. Our approach is to use established, widely reviewed cryptographic software and apply its security updates promptly. We believe this protects customers better than retaining an older software version solely to preserve its validation.

That is an intentional security decision for both commercial and federal use. We support the goal of verifying that encryption is implemented securely; we disagree with allowing the validation process to delay the fixes that keep it secure.

Why We Prioritize Updates

A validation covers the specific version and setup that were tested. When the software changes, validation of the earlier version does not automatically cover the updated code. A security fix can therefore be available before the updated version completes validation.

For example, suppose the maintainers of an encryption library correct a security problem. A service provider can install the updated library to address it, or remain on the older validated version while the new version goes through validation. We choose to install the fix.

The U.S. National Institute of Standards and Technology (NIST), which runs the validation program, has documented substantial backlogs and efforts to reduce them. NIST also recommends applying security patches promptly, even when the updated version has not yet completed validation.

How Files.com Uses Cryptography

Files.com uses OpenSSL and Bouncy Castle in its services, and Go's cryptographic libraries in the customer-installed Agent. These are established open-source software libraries whose code is available for public review. We do not operate them as FIPS-validated modules.

For customer files stored directly in Files.com (Native Storage), we use AWS Key Management Service, an Amazon service that manages encryption keys. Its hardware security modules are FIPS 140-3 validated. That validation covers the AWS component protecting stored files.

Our cryptographic-module inventory identifies each component, its use, and its validation status, including the level of the AWS hardware validation. Data Encryption & Key Management explains the encryption protections and options available to customers.

How This Fits with FedRAMP

FedRAMP is the U.S. government's program for assessing and certifying cloud services used by federal agencies. Its certification classes set different requirements for providers.

Files.com currently holds FedRAMP Class A Certification. We are working toward Class B and, later, Class C certification in 2027.

FedRAMP's rules allow providers at Classes A and B to use cryptography without FIPS validation. At Class C, FedRAMP recommends validated modules but permits a provider to document a justified alternative. We believe our decision to prioritize current, patched cryptography provides that justification.

Class D currently has a stricter requirement. FedRAMP has published a proposal, RFC-0035, to give Class D similar flexibility. The proposal recognizes that requiring separate cryptography for government customers can cause it to lag commercial security updates and perform worse than suitable alternatives. We agree with that reasoning.

Evaluating a FIPS Requirement

Identify the source of your FIPS requirement and whether it allows a documented exception supported by compensating controls. These are alternative safeguards that provide equivalent or comparable protection against the risk a requirement addresses. Many compliance frameworks provide a process for accepting such alternatives; the question is whether that path is available for your particular requirement.

Where it is, document the security rationale, the compensating controls and supporting evidence, and the approval required by your framework or policy. Our Information Security Program and cryptographic-module inventory provide evidence for that assessment.