# FIPS 140

FIPS 140 is the US government standard for validating cryptographic modules, with security levels from 1 to 4 covering tamper evidence, tamper resistance, and environmental protections. FIPS 140-2 Level 3 and FIPS 140-3 Level 3 are the benchmarks banks require for custody HSMs.

## Reading FIPS levels in custody due diligence

Level 3 adds physical tamper resistance and identity-based authentication; Level 4 adds environmental attack protection. The certificate must cover the module actually deployed and the algorithms actually used, a detail worth verifying in vendor claims.

Taurus-PROTECT uses FIPS 140-2 Level 3 HSMs as its root of trust, with FIPS 140-3 Level 3 and 4 hardware in air-gapped cold storage deployments, and FIPS-certified encrypted USB media in the physical air gap transfer process.

FAQ:

- Is FIPS certification enough by itself? No, it certifies the module, not the system. It must combine with audited key ceremonies, quorum governance, and deployment controls; but without certified hardware at the root, the rest cannot compensate.

Related: https://www.taurushq.com/glossary/hardware-security-module-hsm/ https://www.taurushq.com/security/air-gapped-custody/ https://www.taurushq.com/protect/

Learn more: https://www.taurushq.com/glossary/fips-140/