U.S. flag   An unofficial archive of your favorite United States government website
Dot gov

Official websites do not use .rip
We are an unofficial archive, replace .rip by .gov in the URL to access the official website. Access our document index here.

Https

We are building a provable archive!
A lock (Dot gov) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)

Projects Cryptographic Module Validation Program

Cryptographic Module Validation Program CMVP

NIST Cost Recovery Fees

[Updated 12-6-2021]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 3, 3B, 4, and 5; the CR fee is not applicable for IG G.8 Scenario's 1 and 3A. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all scenarios). Scenarios 5 and 3 submissions will be accepted through March 31, 2022 for those that received prior approval. Scenarios 1B and 2 have been discontinued.

For FIPS 140-3

Currently the CR fee is applicable for Scenarios UP, FS, ENT, and EU; the CR fee is not applicable for Scenario VU. The ECR fee may be applied to test reports received by NIST CMVP under FIPS 140-3 (all scenarios). As the scenarios are not finalized, the scenario structure may change this year. However, the fees should remain the same as the current scope.

For Entropy Validation

Currently there is no CR or ECR fee. This is expected to change with next year's update. The entropy validation table is provided below.

The following fee structure is effective Dec 20, 2021 and is subject to change to reflect actual operating costs. 

Updated Feb 17, 2022
FIPS 140 Scenarios: Cost Recovery fee: Extended Cost Recovery fee:

FIPS 140-2 IG G.8 Scenarios 1 or 3A 

FIPS 140-3 Scenarios VU

$0

 $1,000

 

FIPS 140-2 IG G.8 Scenarios 1A, 3B, or 4

FIPS140-3 Scenario OE, QU, or OEM

$2,000

$1,000

FIPS 140-2 IG G.8 Scenario 3 

FIPS 140-3 Scenario UP (except OEM)

$4,000

$1,500

FIPS 140-2 IG G.8 Scenario 5

FIPS 140-3 Scenario FS

    

      Security Level 1:

$10,000

$3,000

      Security Level 2:

$11,000

$4,000

      Security Level 3:

$12,000

$4,000

      Security Level 4:

$14,000

$4,000
Updated Feb 17, 2022
Entropy Scenario: Cost Recovery fee: Extended Cost Recovery fee:

Entropy Validation

$0

 $0

Back to Top

[Updated 08-10-2021]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 3, and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 3A, 3B, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all scenarios). Scenarios 5 and 3 submissions will be accepted if approved through March 31, 2022. Scenarios 1B and 2 have been discontinued.

For FIPS 140-3

Currently the CR fee is applicable for Scenarios UP, FS, ENT, and EU; the CR fee is not applicable for Scenario's VU, OE & QU. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-3 (all scenarios).

The following fee structure is effective October 1, 2021 and is subject to change to reflect actual operating costs. Any change in rates for FY2021 will be reflected in the table below.

Scenarios: Cost Recovery fee: Extended Cost Recovery fee:

FIPS 140-2 IG G.8 Scenarios 1 & 3A 

FIPS 140-3 Scenarios VU

 N/A $1,000

FIPS 140-2 IG G.8 Scenarios 3B and 4

FIPS140-3 Scenario OE & QU

 N/A $1,000

FIPS 140-2 IG G.8 Scenarios 1A

FIPS 140-3 Scenario UP-OEM & EU

$2,000

$1,000

FIPS 140-2 IG G.8 Scenario 3

FIPS 140-3 Scenario UP (except OEM) & ENT

 $4,000 $1,500

FIPS 140-2 IG G.8 Scenario 5

FIPS 140-3 Scenario FS

    

 Security Level 1:

 $8,000 $3,000

 Security Level 2:

 $10,000 $4,000

 Security Level 3:

 $10,000 $4,000

 Security Level 4:

 $10,000 $4,000

Back to Top

[Updated 09-15-2020]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP FIPS 140-2 Management Manual or CMVP FIPS 140-3 Management Manual for further information.

For FIPS 140-2

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 1B, 3 and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 2, 3A, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all five scenarios).

For FIPS 140-3

Currently the CR fee is applicable for Scenarios 1OEM, 3MC and 5FS; the CR fee is not applicable for Scenario's 1VI, 1OEA, 1VA, 1UP, 1AU, 2SC, 1MU, 3CVE and 4PSC. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-3 (all scenarios).

The following fee structure is effective October 1, 2020:

Scenarios: Base fee: Extended fee:

FIPS 140-2 IG G.8 Scenarios 1, 2, 3A and 4

FIPS 140-3 Scenarios 1VI, 1OEA, 1VA, 1UP, 1AU, 2SC, 1MU, 3CVE and 4PSC

 N/A $1,000

FIPS 140-2 IG G.8 Scenarios 1A and 1B

FIPS140-3 Scenario 1OEM

 $2,000 $1,000

FIPS 140-2 IG G.8 Scenario 3

FIPS 140-3 Scenario 3MC

 $4,000 $1,500

FIPS 140-2 IG G.8 Scenario 5

FIPS 140-3 Scenario 5FS

    

 Security Level 1:

 $8,000 $3,000

 Security Level 2:

 $10,000 $4,000

 Security Level 3:

 $10,000 $4,000

 Security Level 4:

 $10,000 $4,000

Back to Top

[Updated 10-01-2019]

Cost recovery fees are collected for NIST CMVP report review of new module submissions, modified module submissions, and for report reviews that require additional time due to complexity or quality. These fees are referred to as Cost Recovery (CR) and Extended Cost Recovery (ECR). Modules are not validated unless all applicable fees have been collected by NIST Billing. Please see the CMVP Management Manual for further information.

Currently the CR fee is applicable for IG G.8 Scenarios 1A, 1B, 3 and 5; the CR fee is not applicable for IG G.8 Scenario's 1, 2, 3A, and 4. The ECR fee is applicable per the overall Security Level to all test reports received by NIST CMVP under FIPS 140-2 IG G.8 (all five scenarios).

The following fee structure is effective October 1, 2019:

  • IG G.8 Scenario's 1, 2, 3A, and 4: CR fee N/A, ECR fee: $1000
  • IG G.8 scenario's 1A and 1B: CR fee $2000, ECR fee: $1000
  • IG G.8 Scenario 3: CR fee $4000, ECR fee: $1500
  • IG G.8 Scenario 5:
    • Security Level 1: CR fee: $8000, ECR fee: $3000
    • Security Level 2: CR fee: $10000, ECR fee: $4000
    • Security Level 3: CR fee: $10000, ECR fee: $4000
    • Security Level 4: CR fee: $10000, ECR fee: $4000

 

Back to Top

Contacts

Beverly Trapnell - NIST CMVP Program Manager
cmvp@nist.gov

Carolyn French - CCCS CMVP Program Manager
CMVP@cyber.gc.ca

Topics

Security and Privacy: cryptography, testing & validation

Technologies: hardware, software & firmware

Created October 11, 2016, Updated July 28, 2022