FIPS Standard

12. Interpretation. Questions concerning the content and specifications of this standard should be
addressed to: Director, Information Technology Laboratory, ATTN: FIPS 140-2 Interpretation, National
Institute of Standards and Technology, 100 Bureau Drive, Stop 8900, Gaithersburg, MD 20899-8900.
Resolution of questions regarding this standard will be provided by the validation authorities at NIST and
CSE.
13. Export Control. Certain cryptographic devices and technical data regarding them are subject to
Federal export controls and exports of cryptographic modules implementing this standard and technical
data regarding them must comply with these Federal regulations and be licensed by the Bureau of Export
Administration of the U.S. Department of Commerce. Applicable Federal government export controls are
specified in Title 15, Code of Federal Regulations (CFR) Part 740.17; Title 15, CFR Part 742; and Title 15,
CFR Part 774, Category 5, Part 2.
14. Implementation Schedule. This standard becomes effective six months after approval by the
Secretary of Commerce.
A transition period from November 25, 2001 until six months after the effective
date is provided to enable all agencies to develop plans for the acquisition of products that are compliant
with FIPS 140-2. Agencies may retain and use FIPS 140-1 validated products that have been purchased
before the end of the transition period. After the transition period, modules will no longer be tested against
the FIPS 140-1 requirements. After the transition period, all previous validations against FIPS 140-1 will
still be recognized. Figure 1 summarizes the FIPS 140-2 implementation schedule.
FIPS 140-1 FIPS 140-2
APPROVAL DATE OF FIPS 140-2
EFFECTIVE DATE OF FIPS 140-2
(6 months after approval date)
TRANSITION PERIOD TO FIPS 140-2
(6 months after effective date)
FUTURE
Figure 1. FIPS 140-2 Implementation Schedule
15. Qualifications. The security requirements specified in this standard are based upon information
provided by many sources within the Federal government and private industry. The requirements are
designed to protect against adversaries mounting cost-effective attacks on sensitive government or
commercial data (e.g., hackers, organized crime, and economic competitors). The primary goal in
designing an effective security system is to make the cost of any attack greater than the possible payoff.
v