About

Federal Information Processing Standards (FIPS) Publication 140-2 specifies security requirements for cryptographic modules. The Federal government requires that all encryption is performed by FIPS validated cryptographic modules. This requirement is also typically required by State and Local governments, government contractors, and government services providers. FIPS validation is specifically required by FedRAMP, CJIS, NIST SP 800-171, and other compliance programs.

The rest of this article provides more specific detail about FIPS 140-2 compliance as it pertains to Virtru products. 

FIPS 140-2 and Virtru

All of Virtru’s encryption algorithms comply with FIPS 140-2, however, not all Virtru clients leverage FIPS validated encryption modules. Of those that do leverage FIPS validated modules, not all clients are enabled in FIPS mode by default.

In most clients, we use 3rd-party encryption libraries that have been certified by, or for, companies such as Google, Microsoft, and Apple (more details below). As such, Virtru has not been required to go through a validation directly.

On certain Virtru plan levels, some Virtru clients support FIPS by default and others require additional configuration. If you need to ensure FIPS 140-2 compliance across Virtru clients in use, please refer to the chart below and contact support to confirm FIPS is enabled for your account. If you are not sure if your current Virtru plan includes FIPS compliance, please contact Virtru Sales. 

The FIPS validation certificates used by each Virtru client:

Clients not on this list do not currently leverage FIPS validated modules.