Common Criteria vs FIPS 140-3: What's the Difference?

If you work in IT security procurement or compliance, you have almost certainly encountered two standards: Common Criteria (ISO/IEC 15408) and FIPS 140-3. Both are used to evaluate the security of IT products, both are required in government procurement, and both involve accredited labs, but they solve different problems.

This guide explains the differences, when each applies, and how they work together.

The short answer

• Common Criteria evaluates the overall security design of a product: access controls, audit logging, data protection, secure communications, and more. It asks: “Does this product do what it claims to do, securely?”
• FIPS 140-3 evaluates cryptographic modules specifically: encryption algorithms, key management, random number generation, and physical tamper resistance. It asks: “Does this product implement cryptography correctly?”

They are complementary. A firewall might need a Common Criteria certification to prove its security architecture is sound, and a FIPS 140-3 validation to prove its cryptographic engine meets federal standards.

Scope and focus

How Common Criteria evaluations work

In a CC evaluation, the vendor writes a Security Target (ST) document that describes what the product does and what security claims it makes. Optionally, the ST conforms to a Protection Profile (PP), a standardized set of requirements for a product category.

An accredited evaluation lab (ITSEF) then tests the product against the ST at a specified Evaluation Assurance Level (EAL1-EAL7). Higher EALs require more rigorous analysis: EAL1 is a basic functional test, while EAL4 involves source code review and vulnerability analysis. EAL5 and EAL6 introduce semiformal methods, EAL7 requires formal verification, and all three are rare outside government/military contexts. For how the high-assurance end of the scale compares to FIPS specifically, see EAL 6+ vs FIPS 140-3.

Once the evaluation passes, a national scheme body (like BSI in Germany, ANSSI in France, or NIAP in the USA) issues a certificate. Through the CCRA, certificates are recognised across all 36 CCRA member nations (18 certificate-authorising members plus 18 consuming members).

For more detail, see our wiki article on Common Criteria.

How FIPS 140-3 validations work

FIPS 140-3 focuses specifically on the cryptographic boundary of a product: the module that performs encryption, decryption, hashing, signing, and key management.

The vendor submits the module to an accredited Cryptographic and Security Testing (CST) laboratory. The lab tests against 11 requirement areas defined by NIST, including:

• Cryptographic algorithm correctness (using CAVP, the Cryptographic Algorithm Validation Program)
• Key management lifecycle
• Physical security (for hardware modules)
• Self-tests and error handling
• Roles, services, and authentication

The module is validated at one of four levels:

• Level 1: Basic requirements, software-only modules
• Level 2: Adds tamper evidence (physical coatings or seals) and role-based authentication
• Level 3: Adds tamper resistance (active zeroization of keys when tampered) and identity-based authentication
• Level 4: Adds environmental failure protection and the highest physical security requirements

Certificates are issued jointly by NIST (USA) and CCCS (Canada) through the Cryptographic Module Validation Program (CMVP).

When each is required

Common Criteria is typically required when:

• A government agency procures IT products under regulations that reference CC or ISO 15408
• A Protection Profile is mandated for a product category (e.g., NIAP requires PP conformance for US government network devices)
• EU regulations like the Cybersecurity Act or sector-specific rules reference EUCC (the EU’s CC-based scheme)
• Procurement RFPs specify EAL requirements

FIPS 140-3 is typically required when:

• US federal agencies procure products that handle sensitive (non-classified) information, mandated by FISMA and OMB policy
• Canadian federal agencies procure cryptographic products
• Financial, healthcare, or other regulated industries adopt FIPS as a baseline for cryptographic assurance
• DoD systems require FIPS-validated encryption for data at rest and in transit

Both are required when:

• A product has broad security functionality (warranting CC) and performs cryptography (warranting FIPS)
• Example: A VPN appliance might hold a CC certificate for its overall security architecture and a FIPS 140-3 validation for its IPsec/TLS cryptographic engine
• Example: A hardware security module (HSM) might carry both certifications

Key differences in practice

Flexibility vs. prescription. Common Criteria is flexible: the vendor defines their own security claims in the Security Target, and evaluations are scoped accordingly. FIPS 140-3 is prescriptive: every cryptographic module is tested against the same NIST-defined requirements.

Timeline. CC evaluations typically take 6-18 months depending on EAL level and product complexity. FIPS 140-3 validations have historically taken 12-24 months due to CMVP queue backlogs, though NIST has been working to reduce this.

Cost. Both are expensive. CC evaluations at EAL2-EAL4 typically range from $150K-$500K+. FIPS validations range from $50K-$300K+ depending on module complexity and testing scope.

International recognition. CC certificates are recognised across all CCRA member nations. FIPS validations are primarily recognized in the US and Canada, though many other countries accept FIPS-validated cryptography as a baseline.

How they work together

In practice, many products carry both certifications. The certifications are independent; passing one does not grant or imply the other. However:

• A CC evaluation might reference FIPS validation as evidence that the cryptographic implementation is sound
• A Protection Profile might require that the TOE’s cryptographic module be FIPS-validated
• NIAP Protection Profiles for US government products frequently include FIPS 140 as a prerequisite

Tracking both

NenkinTracker currently focuses on Common Criteria certification tracking across all CCRA member schemes. If you need to monitor CC certifications across BSI, ANSSI, NIAP, and other schemes (with change detection and alerts) you can start tracking for free.

For FIPS 140-3, the authoritative source is the CMVP validated modules list maintained by NIST.