Vista resources / Government reference
How to verify a government PQC approval claim
For a defense procurement review, first identify the program and intended use. Look up the exact module or product in the relevant official registry and read its scope. An algorithm test, a module validation and a component listing answer different questions.
The working edition / Excel workbook
Review the record behind the claim.
Capture exact versions, algorithm scope, official status and review dates. Generate a NIST certificate link from a CMVP number.
Evidence register · Official checks · Review flags · Dashboard · Field guide
Download Excel workbook ↓What’s inside & how to use it
Start on the “Start here” tab. Blue input cells are editable; gray columns calculate automatically. Filterable tables, frozen headings, dropdowns and date-based review flags help you work through the records. Examples are kept separate from your working data.
On “Official checks,” enter a CMVP certificate number to generate a link to the official NIST record, or use an HTTPS evidence URL. Open the source, review the actual scope and status, then record the result and review date. Status is not fetched automatically. No macros or automatic network requests are included.
Open in Excel or LibreOffice for formula recalculation. The prepared ranges contain up to 100 rows; extend formulas, validation and dashboard ranges for larger inventories. CSV alternatives below are plain data files without formatting or formulas.
Begin with the approval question
“Approved for PQC” is incomplete without a program, product or module version, cryptographic use, configuration, and official record. For defense procurement, establish the applicable system requirements first. This guide routes you to official evidence sources rather than assigning blanket approval to vendors.
Choose the evidence type below, open the authoritative registry or guidance, and record the exact scope in the review worksheet. An algorithm standard, tested implementation, validated module, eligible component, and authorized solution describe different things.
On a narrow screen, scroll the table horizontally to read every column.
| Evidence type | Program / source | What it addresses | What to verify |
|---|---|---|---|
| Algorithm standards | NIST FIPS 203 / 204 / 205 ↗ | Defines algorithms and parameter sets. | Does not certify a vendor or an entire product. |
| Algorithm implementation | CAVP ↗ | Tests an algorithm implementation in a stated environment. | Algorithm validation is not module validation. |
| Cryptographic module | CMVP / FIPS 140-3 ↗ | Validates a specified module with a security policy and conditions. | Check the exact version, environment, approved mode, algorithms and status. |
| Evaluated product | NIAP / Common Criteria ↗ | Evaluates specified security claims against the applicable profile and target. | Read the Security Target and configuration guidance; do not infer PQC support from listing alone. |
| Eligible component | NSA CSfC Components List ↗ | Identifies components eligible for applicable composed solutions. | Check the exact component, capability package and configuration; component eligibility is not a blanket deployment authorization. |
| NSS transition guidance | CNSA 2.0 ↗ | Specifies algorithm and transition expectations in its applicable context. | A claim of alignment needs a requirement-by-requirement mapping. |
| Solution context | CSfC registration / authorization ↗ | Addresses the composed architecture and its applicable approval context. | Review capability-package compliance, registration and authorizing-official requirements. |
How to verify a supplier’s claim
- Request the exact official record identifier and link.
- Match the supplied product or module version and operating environment.
- Check current status and read the security policy, target, or capability package.
- Locate the specific PQC algorithm and use case in the evidence; a nearby vendor announcement is insufficient.
- Record caveats, configuration requirements, exclusions, and a review date.
- Have the responsible procurement or authorization team decide applicability.
A concrete record-reading example
NIST CMVP certificate 4816 identifies an AWS-LC cryptographic module. Treat it as a record about that module and its listed scope. Do not attach an ML-KEM validation claim simply because vendor material discussing PQC also links to a module certificate. Check the approved algorithms and security policy directly.
Open certificate 4816 at NIST ↗. This example demonstrates how to review evidence; it is not a recommendation or a claim that this certificate validates PQC.
Sources and further reading
Continue in Vista
Connect procurement evidence to deployment evidence
Record the exact module, version, approved mode and reviewed source in this worksheet. In Vista, identify the deployed assets and relevant observations, then create follow-up work for mismatches or unknowns. Keep the official record and your procurement decision available to the reviewer.
Observed cryptography and official validation answer different questions. A Vista finding or CBOM does not confer government approval, and a certificate listing does not prove the installed system uses that validated configuration.