FIPS 140-3

Microsoft has not published an estimated FIPS 140-3 validation date for current Windows 11 releases such as versions 24H2 or 25H2.

Microsoft’s current validation matrix lists completed validations only for:

• Windows 11 version 22H2, build 10.0.22621.1, covering Home, Pro, Enterprise, Education, and IoT Enterprise.
• Windows 11 version 21H2, build 10.0.22000.

For 22H2, the validated components include Boot Manager, Windows OS Loader, Code Integrity, the kernel-mode and user-mode cryptographic libraries, and the BitLocker Dump Filter, under CMVP certificates 5404–5410.^1^

The broader Windows validation index likewise lists only 21H2 and 22H2 under Windows 11; it does not list completed validations for 23H2, 24H2, or 25H2.^2^

What this means

FIPS validation applies to specific cryptographic modules and their documented configurations, not to Windows 11 as a single product-wide certification. A validation for a module in 22H2 therefore cannot automatically be treated as validation for the corresponding module in 24H2 or 25H2.

Microsoft states that it submits new Windows versions for cryptographic-module validation on an ongoing basis and recommends checking NIST’s public Modules in Process List for submission status. However, the public Microsoft material does not identify a completion date for the newer Windows 11 releases.^3^

For compliance planning:

1. Use the Microsoft Windows 11 validation page to obtain the exact CMVP certificate and Security Policy for the required module.
2. Confirm that the certificate covers the precise Windows version, build, edition, and operating mode being deployed.
3. Check NIST’s Modules in Process List periodically for a newer Microsoft submission.
4. For a procurement deadline or formal roadmap question, contact the Microsoft FIPS team at the address shown in the Windows validation documentation. Microsoft does not publish an ETA on that page.

Enabling the Windows “FIPS” security policy does not make an unlisted Windows release validated. Operating in an approved mode also requires following the applicable module’s Security Policy. Starting with the April 2024 quality updates, Windows cryptographic libraries automatically run required self-tests; the legacy FIPS policy generally remains relevant only for the documented BitLocker PIN or password-protector scenarios.^2^

References

1. FIPS 140 validated modules for Windows 11 | Microsoft Learn
2. Windows FIPS 140 validation | Microsoft Learn
3. Federal Information Processing Standard (FIPS) 140