FIPS 140-3 Mode: How DefectDojo Pro Clears the Cryptography Bar for FedRAMP

If you’re a federal agency, you already know that "we are FedRAMP compliant" isn't good enough on its own. Assessors want to see a specific, validated cryptographic module behind every encrypted connection and every password hash. That requirement has a name: FIPS 140-3.

DefectDojo Pro now ships FIPS 140-3 mode, giving teams a documented, verifiable path to the cryptography control that underpins FedRAMP authorization.

What FIPS 140-3 actually is

FIPS 140-3 (Federal Information Processing Standard 140-3) is the current NIST benchmark for validating cryptographic modules, the software or hardware components that perform encryption, hashing, and key management. It replaced FIPS 140-2 as the standard for new validations, and existing FIPS 140-2 certificates move to the CMVP Historical List on September 21, 2026, after which they stop supporting new deployments.

A module doesn't get to claim FIPS 140-3 compliance on its own say-so. It has to be tested by an accredited lab and validated by NIST's Cryptographic Module Validation Program (CMVP), which issues a certificate and a certificate number that assessors can look up directly.

For FedRAMP purposes, this maps to control SC-13 (Cryptographic Protection), which requires that cryptographic operations run through a FIPS-validated module. It's one of the most commonly checked, and most commonly failed, controls in a federal assessment, because "we use encryption" and "we use a validated module" are two very different claims.

What changes in FIPS mode

DefectDojo Pro's FIPS mode runs all cryptographic operations through a validated provider and restricts the platform to FIPS-approved algorithms. That restriction changes a handful of behaviors worth planning for:

• Password hashing. PBKDF2-SHA256 becomes the default, since Argon2, bcrypt, and scrypt aren't FIPS-approved key-derivation functions. Existing users aren't locked out: passwords re-hash automatically to PBKDF2 on the next successful login, with a forced reset available for teams that want a hard cutover instead.
• TLS cipher suites. ChaCha20-Poly1305 is removed from the nginx cipher list. TLS 1.2 and 1.3 remain available through AES-GCM suites, so any client relying solely on ChaCha20 will need to support AES-GCM to connect.
• Metrics authentication. When nginx metrics basic authentication is enabled, password hashes use SHA-256 crypt instead of Apache's MD5-based format, which the validated module refuses.
• Scan parsers. Some parsers use MD5 to build deduplication keys, which is a non-security use of the algorithm and is explicitly treated as such. Those parsers continue to work exactly as they do today.
  
  

See it in your environment

FIPS 140-3 mode is one piece of what it takes to bring a unified vulnerability management platform into a FedRAMP boundary.

Book a demo to see how DefectDojo Pro meets FedRAMP compliance requirements, FIPS 140-3 included.