Skip to main content
Official source: Cryptographic Module Use (CMU), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

​
In short

You must document every cryptographic module you use to protect federal customer data, and say whether each one is validated under the NIST Cryptographic Module Validation Program (CMVP) or is an update stream of a validated module. Whether you must actually use validated modules depends on your class: Class D MUST, Class C SHOULD, and Class A and B MAY. You SHOULD also configure agency tenants to use validated modules by default where they are available.

​
Who it applies to

The subset applicability lists Class B, C and D. The statement for CMU-CSO-UVM also includes a Class A variant, which is shown below as published.

​
Key dates

​
What you need to do

Key terms: federal customer data and validation.

​
Cloud service provider responsibilities

Update streams don’t cover new algorithms. The official note on CMU-CSO-UVM says a cryptographic module includes specific algorithms. If an update stream adds algorithms that were never validated, those new algorithms are not covered as update stream usage under these rules.

​
Differences by class

CMU-CSO-UVM (Using Validated Cryptographic Modules):

​
What FedRAMP staff have said

New algorithms in an upstream release are not covered. On 2026-09-24, pete-gov said that when a module is validated, its algorithms are validated. You can use an upstream release’s updated versions of the algorithms that were validated, but new algorithms added in that release are not upstream versions of a validated module. His example: in Bouncy Castle 2.2, AES-KWP (validated in 2.0) counts, while CRYSTALS-Kyber (not in the 2.0 validation) does not. He also noted that the legacy crypto policy has been replaced by this ruleset. Discussion #174 comment
Post-quantum cryptography. On 2026-09-16, pete-gov said FedRAMP does not currently treat quantum-vulnerable cryptography as a vulnerability and will follow CISA guidance. He said Class D offerings are required to use only CMVP-validated modules or their upstream versions to protect federal customer data. No agency had yet asked FedRAMP for waivers to use non-validated PQC libraries, but FedRAMP would be open to that after consulting CISA and NIST. He expected the next big update to be to some CMU rules, to align with upcoming CISA guidance on cryptographic bills of materials. Discussion #174 comment