Validation covers the module's approved algorithms (each tested under CAVP, for example ML-KEM and ML-DSA certificates since 2024), self-tests, key management, physical security (levels 2–4 add tamper evidence, tamper response and environmental protection) and roles and services. A validated module lists its approved services in a security policy; using an unapproved algorithm or mode means the operation is not FIPS-compliant even inside a validated module.
FIPS 140-2 testing ended in 2021, and the remaining FIPS 140-2 certificates moved to the CMVP historical list in September 2026, so new US federal procurements need FIPS 140-3 modules. Validation queues are long (often more than a year), which shapes product release plans.