I have a HSM that is an asset within a information security management system and the help desk team tells me that the device is displaying a critical failure alert. So my questions are: Must I replace the HSM with a new one or can I request that it be repaired? In a repair scenario, what are the criteria that I have to consider for receiving the repaired device and continue to rely on it?

  • 3
    We're not the ones doing the interview. May 9, 2015 at 23:58
  • what kind of maintenance? What do you want to change on your HSM? Physically nothing will go because they need to be tamper-resistant IIRC.
    – SEJPM
    May 10, 2015 at 13:37
  • I don't sure but I think that there is a problem with a cooler or a fan. The repair or replacement of these parts could be considered as tampering? Is it permitted (to manufacturer or other specialized technical support) the performing of corrective maintenance without loss the FIPS certification? May 10, 2015 at 17:20
  • I do believe this is on topic. The question here is not if the HSM will lose its certification, certification is done by a lab on behalf of the manufacturer. The question is whether your manipulations will trigger the anti tamper mechanisms or not. This question is best answered by the manufacturer, but the anti-tampering counter measures are to prevent you to access the keys. As long as you don't interfere with the shielding of the cryptographic module, and don't leave the equipment without electricity for too long, you should be fine. May 11, 2015 at 5:25
  • 3
    @AlvaroCuno I'm happy to start a re-opening vote but you must first properly reword the question, by giving more details on the HSM you use, the issue that causes you to perform "maintenance", and the type of "maintenance" you have in mind. Also, please ask a single question at a time as much as possible. See the How to Ask page. May 12, 2015 at 4:39

2 Answers 2


The following is a possible series of steps you could take. I'm considering that you have a secondary, online HSM for the period during which the affected HSM is removed from service for repair.

  1. Destroy all key material on the HSM
  2. Notify vendor of device problem and serial number
  3. Return device in tamper evident packaging to vendor address using secure courier
  4. Vendor should inform you once device is repaired
  5. Vendor should inform you once device is sent, delivery time, location, courier ID etc
  6. Receive device, verify integrity of tamper evident packaging, verify serial number
  7. Configure per device Security Policy to ensure you are maintaining per FIPS
  8. Export your keys from other HSM to repaired HSM or reload keys from key components
  9. Maintain auditable logs of all of the above
  • thank you for your kind answer. Please, could you explain in more detail the step 7.? May 16, 2015 at 16:42
  • 1
    HSMs come with a Security Policy from the vendor. This will provide guidance on how to securely deploy, operate and maintain the system such that the security is intact. Without following the vendor security policy, you'll likely be running the HSM in a non-FIPS mode of operation. i.e. you'll have a secure device you're operating insecurely! For reference, here's a security policy available on NIST for some Thales HSMs: csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/…
    – AndyMac
    May 17, 2015 at 10:51

The point to be noted here is that there are 2 components of a HSM - appliance and Crypto module. Its only the Crypto module which is FIPS compliant and stores the keys. The appliance part is the chassis and the other components such as cooling fans. If the problem is the fan and the HSM allows hot swap of these fans then all you need to do is order a new fan and replace it. If you are not sure of the fault then raise a support call with the vendor. Vendor would be able to suggest a course of action, in any case do take care of the following:

  • take backup of your keys

  • make sure the other HSMs in cluster / pool / high availability mode are operational, to avoid service outage

  • if you are going to send the broken device to the vendor - DESTROY all key material on it by factory resetting the device, to avoid compromising your keys

  • depending on your contract with the vendor, the device can be repaired or a new one sent to replace the broken one

  • upon receipt of the new HSM, configure it as per your internal deployment instructions

  • then load the keys from the backup

  • add new device back in the cluster / pool / HA group

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.