What happens after 21 September

The FIPS 140-2 sunset is the biggest date on the calendar. It is not the last one. 48 more certificates lose standing between 22 September 2026 and the end of 2027 — including modules in laptops, firewalls, HSMs and SSDs that most estates are still buying today.

• 48certificates, cliff to end 2027
• 42on a two-year certificate
• 10with a submission in the CMVP queue

The calendar

Every active certificate whose standing ends after the 21 September 2026 cliff and before 31 December 2027, in date order. Certificate numbers link to NIST.

Filter by vendor, module or certificate number

September 2026 — 2 certificates

October 2026 — 4 certificates

November 2026 — 9 certificates

December 2026 — 12 certificates

January 2027 — 7 certificates

February 2027 — 4 certificates

March 2027 — 3 certificates

April 2027 — 1 certificate

December 2027 — 6 certificates

What the right-hand column means

in the CMVP queue The vendor has a submission for this module on the CMVP Modules In Process list, at the phase shown. That is a fix in process, and under 32 CFR 170.4 that distinction is the one that decides whether a gap can be carried as a temporary deficiency. NIST publishes no expected duration for any phase and directs enquiries to the vendor, so a queue position is not a delivery date.

successor #… A longer-dated certificate for the same module is already on the record. Worth knowing that a certificate is not a patch: when one issues it names versions, and machines already running a named version become covered without being touched. The question to put to the vendor is whether the successor names the exact version you run.

a similar module exists The vendor holds an active certificate whose name strictly contains, or is contained by, this one. That cannot be settled from a name in either direction — “Kernel Mode Cryptographic Primitives Library” contains every word of “Cryptographic Primitives Library” and is a different module, while a renamed product looks identical. So we do not decide it. Ask the vendor which one covers you.

nothing found at the snapshot date No successor and no queue entry matched at the date below. Read that as a question, not a verdict. It is the absence of a record in one snapshot — a certificate may have issued since, or been filed under a name this did not join to the retiring one. The honest action is to ask the vendor, in writing, whether a FIPS 140-3 submission exists for the product you own. That written answer is itself evidence, and it is worth more to an assessor than anything we could infer.

Why a one-off check is not enough

Take one row. AWS Key Management Service HSM standing ends on 17 November 2026 — fifty-seven days after the cliff, by which point the September assessments are filed and nobody is looking again. Nothing about that machine changes on the day. What changes is whether the evidence behind it still stands.

That is the shape of the whole list: the answer is not wrong when you get it, it goes stale afterwards, and there is no signal when it does. Which is why we sell a report you re-run rather than a document you file.

The tool reads inventory you already export. It has no networking code in it at all — see how that is checked.

Buying rather than checking?

The same record answers the procurement question: what is still validated when it arrives — 703 active FIPS 140-3 certificates across 311 vendors, with the sunset date on every row.