FIPS 140 Requirements

The National Institute of Standards and Technology (NIST) issues the Federal Information Processing Standard (FIPS) Publication Series 140 to coordinate the requirements and standards for cryptographic modules which include both hardware and software components for use by departments and agencies of the United States and Canadian governments to protect sensitive information.

FIPS 140 Compliance

Cloud Service Providers (CSPs) are required to implement FIPS security control to satisfy the requirements of Cloud computing for the US and Canadian governments as well as their contractors and vendors. The FIPS publication 140 stipulates that if encryption is employed as a mechanism to meet a security requirement, it must be FIPS validated under the Cryptographic Module Validation Program (CMVP). 

The most recent FIPS Publication Series 140 is a third revision, commonly referred to as FIPS 140-3. NIST has published a transition roadmap for migration from the FIPS 140-2 to 140-3 standard, and Google is committed to this transition. Since September 2022, all of Google's FIPS 140 submissions for new modules have been under the 140-3 standard. Under CMVP guidance, the scope of a FIPS 140 validation is a cryptographic module rather than an individual cloud service. Google Cloud services achieve compliance by relying on underlying FIPS 140–validated cryptographic modules.

Overview of FIPS 140 Cryptography in Google Cloud

Google Cloud secures customer data across its global infrastructure using FIPS-validated cryptographic modules for data at rest, data in transit across Google data centers, and external client-to-Google communication channels.

• BoringCrypto Module (BCM): Google's core open-source, FIPS 140–validated cryptographic module within BoringSSL, an open-source cryptographic library derived from OpenSSL. BoringCrypto serves as the primary software cryptographic engine powering encryption at rest and in transit across native Google Cloud services.
• Hardware Security Modules (HSMs): Dedicated physical cryptographic hardware validated up to FIPS 140-2 / FIPS 140-3 Level 3. Google Cloud Customers can utilize Cloud HSM to access clusters of Google HSMs.

NIST FIPS 140-2 Sunset Timeline

Under NIST's transition schedule, all active FIPS 140-2 certificates moved to the CMVP Historical List on September 21, 2026. Per NIST and CMVP policy:

• Moving to "Historical" status reflects the sunset of the standard version—it is not a revocation or a security vulnerability.
• Federal agencies and regulated customers are permitted to continue operating and leveraging existing systems that maintain historical FIPS 140-2 modules.

Google’s Rolling Validation Lifecycle for BoringCrypto

Google Cloud adheres to the FedRAMP Policy for Cryptographic Module Selection and Use, which mandates periodic re-validation and updating of cryptographic modules. Rather than binding all cloud-native services to a single static revision, Google maintains a rolling, continuous validation lifecycle for BoringCrypto under FIPS 140-3. As these services are updated, they may leverage different validated BoringCrypto builds over time or across different backend components. Google consistently implements this policy, applying the update stream model to other directives that require FIPS cryptographic certification, including CJIS, ITAR, DoD IL4 and IL5, IRS 1075, JISF, and Protected B.

• FIPS 140-2 (Certificate #4407): BoringCrypto — Historical (as of Sept. 21, 2026)
• FIPS 140-3 (Certificate #4735): BoringCrypto — Active (Validated July 2024)
• FIPS 140-3 (Certificate #5104): BoringCrypto — Active (Validated Dec. 2025)
• FIPS 140-3 (Certificate #5244): BoringCrypto — Active (Validated Apr. 2026)
• FIPS 140-3 (Certificate #5296): BoringCrypto — Active (Validated June 2026)

(To view the complete list of Google’s active CMVP-validated BoringCrypto builds, search the CMVP database, selecting Google as the Vendor and BoringCrypto as the Module Name.)

Google Cloud progressively updates internal baseline service binaries to these active FIPS 140-3 validated builds, ensuring continuous cryptographic protection across underlying platform services without introducing breaking changes or service disruptions.

Shared Responsibility Model for FIPS Cryptography

Cryptographic compliance under FIPS 140 is governed by a shared responsibility model between Google Cloud and the customer.

Google Cloud Responsibility ("Security of the Cloud")

• Physical & Inter-Datacenter Security: Encryption of data in transit across Google's private global fiber network.
• Native Managed Services: Platform encryption for FedRAMP-authorized products and services fully engineered, maintained, and operated by Google Cloud. 
• CMVP Lifecycle Management: Maintaining active FIPS 140-3 certifications for BoringCrypto and underlying HSMs.
• Zero Customer Disruption: Transitioning backend cryptography without requiring customer endpoint, tier, or URL modifications.

Customer Responsibility ("Security in the Cloud")

• Guest OS & Workloads: Enabling FIPS mode in guest operating systems (e.g., Ubuntu Advantage FIPS, RHEL FIPS mode) running on Compute Engine or GKE worker nodes.
• Client-Side TLS & API Connections: Ensuring client software, SDKs, and developer endpoints connecting to Google APIs use validated cryptographic libraries.
• Application Layer Data Encryption: Managing encryption keys (via Cloud KMS, Cloud HSM, CMEK, or Cloud EKM) and in-guest data protection policies.

Information for Regulated Customers

For SaaS providers, federal agencies, and enterprise customers documenting leveraged authorizations in their System Security Plan (SSP):

• Control SC-13 Inheritance: Customers leveraging Google Cloud native services can inherit Google’s cryptographic controls under the Google Services FedRAMP Authorization (FedRAMP ID: FR1805751477).
• SSP Cryptographic Modules Table: Because Google continuously validates builds of BoringCrypto under its rolling validation model, customers should document that their cryptographic protection inherits Google’s active FIPS 140-3 BoringCrypto certificates and cite Google Cloud's FedRAMP System Security Plan / Customer Implementation Summary.
• Auditor Assurance & Attestation: Official compliance packages, 3PAO security assessment reports (SAR), and continuous monitoring artifacts can be retrieved via the Google Cloud Compliance Reports Manager under NDA.