Certifications

National Institute of Standards and Technology

FIPS OVERVIEW

NIST CMVP (Cryptographic Module Validation Program) is a joint initiative by NIST and the Canadian Centre for Cyber Security that validates cryptographic modules for compliance with FIPS 140-3, ensuring they meet federal security standards.

The Federal Information Processing Standards (FIPS), developed by NIST, set security benchmarks for protecting sensitive data—originally for U.S. government systems but now widely adopted across industries. A key part of FIPS compliance is the Security Policy, which outlines how cryptographic modules meet specific requirements. These policies are publicly available on the NIST website. FIPS 140-3, defines four levels of security for cryptographic modules, ranging from basic encryption to advanced physical protection.

F5 HSM/FIPS Platform Implementations

COMMON CRITERIA OVERVIEW

The Common Criteria for Information Technology Security Evaluation (CC) is an internationally recognized standard (ISO/IEC 15408) used to assess the security of IT products and systems. It provides a structured framework for:

• Defining security requirements
• Evaluating product implementations
• Ensuring consistent and repeatable assurance levels

Common Criteria is recognized by over 30 countries through the Common Criteria Recognition Arrangement (CCRA), allowing a product evaluated in one member country to be accepted by all others.

Department of Defense Information Network

DoDIN APL OVERVIEW

The Department of Defense Information Network Approved Products List (DoDIN APL) is the official list of technologies authorized for use across DoD networks. Managed by the Defense Information Systems Agency (DISA), the APL ensures that only products meeting strict Interoperability (IO) and Cybersecurity (CS) standards are deployed within the DoD environment.

*** The DoDIN APL program will end on September 30, 2025, and DISA will keep the APL repository available through FY 2026. As the program sunsets, cybersecurity requirements will shift to DISA’s Security Technical Implementation Guides (STIGs), which provide standardized security configuration requirements for DoD systems. STIGs are DoD‑approved configuration standards used to harden systems and reduce vulnerabilities.

Commercial Solutions for Classified

CSfC COMPONENT LIST OVERVIEW

The Commercial Solutions for Classified (CSfC) program, managed by the National Security Agency (NSA), enables the use of commercial IT products in layered solutions to protect classified National Security System (NSS) data. The CSfC Component List is a curated catalog of products that meet the security and interoperability requirements defined by NSA’s Capability Packages (CPs) and Protection Profiles (PPs). (Supports secure, layered solutions for classified communications).

National Information Assurance Partnership

NIAP COMPLIANCE LIST OVERVIEW

The National Information Assurance Partnership (NIAP) oversees the U.S. Common Criteria program and maintains the NIAP Product Compliant List (PCL), the official list of products that have completed evaluation against NIAP‑approved Protection Profiles and have received NIAPs approval to be placed on the PCL. Products on the PCL are recognized as meeting U.S. government security requirements for use in National Security Systems.

What are Protection Profiles? Protection Profiles are standardized sets of security requirements for specific types of technology, defining the baseline safeguards products must meet and the criteria used to evaluate them.

508 COMPLIANCE / VPAT OVERVIEW

Section 508 is a federal requirement under the Rehabilitation Act (29 U.S.C. § 794d) that ensures technology used by U.S. federal agencies is accessible to people with disabilities. A VPAT explains how a product meets these accessibility requirements. Together, Section 508 and VPATs help customers assess accessibility and show our commitment to compliant, inclusive products.

Additional Certifications

To get more information on the many other certifications F5 holds, contact F5 sales.