Cryptographic Module Testing Laboratory


A Cryptographic Module Testing Laboratory is an information technology computer security testing laboratory that is accredited to conduct cryptographic module evaluations for conformance to the FIPS 140-2 U.S. Government standard.
The National Institute of Standards and Technology National Voluntary Laboratory Accreditation Program accredits CMTLs to meet Cryptographic Module Validation Program standards and procedures.
This has been replaced by .

CMTL requirements

These laboratories must meet the following requirements:
A CMTL can also be a Common Criteria Testing Laboratory. The CC and FIPS 140-2 are different in the abstractness and focus of tests. FIPS 140-2 testing is against a defined cryptographic module and provides a suite of conformance tests to four FIPS 140 security levels. FIPS 140-2 describes the requirements for cryptographic modules and includes such areas as physical security, key management, self tests, roles and services, etc. The standard was initially developed in 1994 - prior to the development of the CC. The CC is an evaluation against a Protection Profile, usually created by the user, or security target. Typically, a PP covers a broad range of products.
If the operational environment is a modifiable operational environment, the operating system requirements of the Common Criteria are applicable at FIPS Security Levels 2 and above.