FIPS 140-3 has a more detailed set of submission scenarios than FIPS 140-2. It can be daunting to find the right scenario for your situation. The flow diagram below provides an overview and helps to explain the different scenarios. More information can be found in the FIPS 140-3 Management Manual. The Management Manual is currently in draft status, and we will update this diagram to reflect the applicable NIST fees once the new version is published. Please note that it is possible and quite common to combine submission scenarios (for example, 1OEM and 1OEA).
The CMVP is also working on an entropy (ENT) certification program that will allow vendors to receive a stand-alone certificate for their entropy source. If you would like to follow the current status of the program, we invite you to join the Cryptographic Module User Forum (CMUF) and follow the discussion in the Entropy Working Group there.
