As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ensure that my Access application complies with FIPS 140-2. The deployment and maintenance of this application will be handled by another partner company, they are the ones asking for FIPS compliancy.
I have read the documentation for FIPS 140-2 and I understand its purpose. Level 1 FIPS compliance is all that is required in our situation. I have written a module in VBA to hash the passwords with SHA-1 used for logging into the application. SHA-1 is on the list of FIPS 140-2 approved algorithms.
My question is, what else does a software developer have to do to ensure FIPS 140-2 compliance, and how much falls in the shoulders of the contractor deploying the application on their systems?
The Access application is split, so the back-end file will live on a network share and regular users will only have access to the front-end file. I suppose both the back-end and front-end files could be encrypted, but that seems to be part of the deployment process.