Federal agencies running RLC Pro Hardened prove FIPS 140-3 cryptography with active Cryptographic Module Validation Program (CMVP) certificates, the evidence a compliance review accepts. BOD 26-04 put agencies on a three-day remediation clock, and the systems they remediate still face the same cryptographic review they always did. The distinction that decides that review is the difference between running FIPS mode and holding FIPS validation.
FIPS mode enables approved algorithms. FIPS 140-3 validation is a NIST certificate for a specific module. A compliance review accepts the certificate.
FIPS 140-3 is the cryptographic half of a federal compliance review
BOD 26-04 raised the bar on how fast agencies remediate the highest-risk vulnerabilities. It did not lower the bar on anything else. The same Authorization to Operate (ATO) process that reviews remediation posture reviews the cryptography protecting the data on those systems, and for federal systems that cryptography must be FIPS 140-3 validated.
The two requirements land on the same team at the same time. An agency tightening its remediation cadence for BOD 26-04 is often the agency renewing an ATO, and a cryptographic finding stalls the package as surely as a remediation finding does. Treating FIPS as a solved problem is the mistake that surfaces late in a review.
FIPS 140-3 validation covers specific cryptographic modules, verified by CMVP
FIPS 140-3 is a NIST standard for cryptographic modules. Validation is the process by which NIST, through the CMVP, tests a specific module at a specific version and issues a certificate. The certificate names the module, the version, and the algorithms it implements. That certificate is the artifact a reviewer checks.
A FIPS 140-3 CMVP certificate validates a named cryptographic module at a named version. Change the module or the version without a covering certificate, and the validation no longer applies.
The scope matters as much as the existence of a certificate. A validated OpenSSL module does not validate the kernel's cryptography, and a certificate for one release does not carry forward to the next automatically. Reviewers read the boundary of each certificate, not just its presence.
FIPS mode enables algorithms; FIPS validation certifies the module
Most Enterprise Linux distributions offer a FIPS mode: a switch that restricts the system to FIPS-approved algorithms. Enabling that switch is necessary, and on its own it is not proof of anything a reviewer accepts. FIPS mode configures the system to use approved algorithms. FIPS 140-3 validation certifies that the specific module implementing those algorithms passed CMVP testing.
The consequence is concrete. A system can run in FIPS mode on a cryptographic module that carries no current CMVP certificate, and that system fails a rigorous review despite the switch being on. The industry has often sold the mode as the outcome. The outcome a federal agency needs is the certificate.
Document the module, the version, and the certificate for review
A compliance package needs three things for each cryptographic component in scope: the module name, the exact version deployed, and the CMVP certificate that covers that version. A reviewer traces each algorithm in use back to a certificate. Gaps in that chain become findings.
Agencies that assemble this evidence after deployment spend weeks reconciling installed versions against certificate boundaries. Agencies that start from a distribution built around active certificates assemble the package from artifacts the vendor already publishes.
RLC Pro Hardened ships active CMVP certificates and pre-applied STIG
RLC Pro Hardened ships with five active FIPS 140-3 CMVP certificates covering the Rocky Linux cryptographic stack: the kernel cryptographic module, OpenSSL, NSS, libgcrypt, and GnuTLS. Its post-quantum algorithms, ML-KEM and ML-DSA, are certified through the Cryptographic Algorithm Validation Program (CAVP). The distribution also arrives with up to 95 percent DISA Security Technical Implementation Guide (STIG) applied out of the box, plus CIQ-engineered lockdown playbooks for DISA STIG, CIS, and NIST 800-171.
Agencies deploying RLC Pro Hardened meet the cryptographic and hardening requirements of a federal review from first boot, without rebuilding their Linux infrastructure.
The certificates and STIG profiles arrive as artifacts, not as a configuration project. That turns the cryptographic half of an ATO from a multi-week reconciliation into a documentation step.
