# How long does a FIPS 140-3 validation take?

As of February 8, 2024, fourteen (14) FIPS 140-3 modules are posted on the CMVP validated modules list.

**The average time for a FIPS 140-3 validation is 1.59 years (579 days or 1 year, 7 months and 4 days).** This marks the time the CMVP receives the FIPS 140-3 validation report to the issuance of a FIPS 140-3 certificate.

The average time for the initial CMVP review is 1 year (366 days). This is the total of the days the module shows a status of “Review Pending” or “In Review” on the [NIST Modules in Process List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List). This is represented by the blue portion of the bars in the graph below.

The time spent responding to CMVP comments (“Coordination” or “Finalization”) varies significantly with an average of 7 months and 3 days (213 days). This is represented by the green portion of the bars in the graph below.

## Notes:

- Cert. #4650 not included in the totals due to insufficient data from the NIST Modules In Process List. (Inclusion on the MIP List is optional.)
- The CMVP began accepting FIPS 140-3 submissions on September 22, 2020.
- Recently posted Cert. #4676 is the first submission to complete the FIPS 140-3 validation review process in less than 1 year.

* * *

_[KeyPair Consulting](/content/site-root.html) – FIPS 140 open-source rebrands & testing_