What is the open source equivalent to FIPS 140-2?. There are businesses that use it when doing business with government. Since a lot of us wont be doing business with the government, is there a similar standard open to the rest of us that can give corporate customers the peace of mind that their data is safe?.

  • 2
    Why do you think that FIPS 140-2 can not be applied to open source? From my understanding nothing requires closed source for FIPS 140-2. – Steffen Ullrich Jun 4 at 11:12
  • 2
    The only certification that matters is the one that your business partners/regulators/industry bodies have asked you to do. Doing any other certifications adds zero value to your business/software. – Lie Ryan Jun 4 at 11:36
  • 3
    If it doesn't cost much, it probably isn't very valuable. Not that FIPS 140-2 is valuable for reassuring customers their data is safe either...That isn't what it is for. The cost of any certification generally is going to be in the work that's required to obtain it; both the cost of the work you must do to prepare, and the work the auditor must do to validate it. The better the certification, the more work required, thus the more expensive it will be. – Xander Jun 4 at 12:15
  • 1
    "peace of mind that their data is safe?" - there are literally hundreds of different ways to do that. You need to narrow down your use case and your business case. what does ISO have to do with FIPS? – schroeder Jun 4 at 13:34
  • 2
    "The certification i imagine costs a fortune that's why i am asking if there is one that wouldn't cost too much." - this has nothing to do with open source. You essentially ask for something which is cheap and not for something which is open source. Or in other words: you assume that "open source" means that somebody did the work which you can cheaply reuse and now expect that somebody did the same for FIPS or similar certification. In some cases somebody actually did this - see for example openssl.org/docs/fips.html. Still, it costs much because there is actual work to be done – Steffen Ullrich Jun 4 at 13:59

There is no open source equivalent and there doesn't need to be one since FIPS 140-2 is not restricted to closed source software. For example there is a FIPS 140-2 certification for selected versions and configurations of OpenSSL - see https://www.openssl.org/docs/fips.html.

The certification i imagine costs a fortune that's why i am asking if there is one that wouldn't cost too much.

A certificate costs something since there is actual work involved in certification - both from the one applying for the certificate and from the agency which does the certification. Such a certificate stands for some level of (kind of) verified security and such security and verification does not come magically from just handing over some money.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.