Security Certifications and Standards

Security certifications and standards help buyers evaluate whether a technology, system, or security program meets defined requirements. But not all forms of assurance cover the same thing.

The key is to understand what was evaluated, which requirements were used, and whether the resulting evidence applies to your product, configuration, and deployment. This page acts as a guide to explain the major types of security standards, certifications, and validations, and how to assess their scope.

A security standard defines requirements, specifications, or practices for a particular area of security. Standards may apply to technologies, security programs, operational environments, or industry processes.

Certifications provide independent confirmation that a defined product, system, service, or management system has been assessed against specified requirements. Some programs use the term validation. For example, cryptographic modules that successfully complete the Cryptographic Module Validation Program (CMVP) are validated against FIPS 140-3 requirements.

Regulations and industry frameworks may reference standards, audits, certifications, or validated technologies. However, certification or validation of one product, configuration, or system does not automatically establish compliance across an organization. Buyers should always confirm the precise scope of the evidence.

The requirements that matter depend on what needs securing and the type of assurance a buyer or regulator expects.

These requirements are complementary rather than interchangeable: Some assess defined technologies, some address organizational or operational controls, and others establish legal or sector-specific obligations.

A certification or validation is most useful when its scope matches the buyer’s actual requirement. Before relying on one during procurement or a compliance review, consider:

• What was evaluated? Determine whether the evidence applies to a specific product, cryptographic module, service, management system, or operating environment.
• Which version applies? Standards change. Confirm that the certification or validation addresses the version required by your customer, regulator, procurement policy, or use case.
• What does the scope include? Assurance may apply only to particular models, firmware versions, operating modes, locations, or business processes.
• Does an assurance level or profile matter? Common Criteria evaluations, for example, can differ by Evaluation Assurance Level, Protection Profile, and other evaluation claims.
• Who performed the assessment? Look for the recognized laboratory, certification body, assessor, or validation program behind the evidence.
• Can the result be verified? Where possible, check official certificates, registries, and validation listings to confirm current status.
• Does it address the requirement you need to meet? FIPS validation of a cryptographic module can support a cryptographic requirement, for example, but it does not establish PCI DSS compliance for the buyer’s payment environment.

This review helps teams determine whether the available evidence applies to their intended deployment.

Finally, emerging technologies such as AI and quantum computing are influencing future security standards and compliance strategies. Organizations may need to assess both identity trust controls and post-quantum cryptography readiness as requirements evolve.

View Product Certification and Validation Evidence

Security buyers may need formal evidence to support procurement decisions, audits, or internal reviews. Entrust makes product-specific certification, validation, and compliance information available so teams can determine whether a product or configuration aligns with their requirements.

Entrust’s broader Compliance Hub connects these technology certifications and standards with regulatory requirements spanning data security, identity, payments, and digital trust.

Cryptography and public key infrastructure (PKI) rely on multiple layers of standards. Some define requirements for cryptographic algorithms or modules. Others govern digital certificates, certificate authorities, trust relationships, or interoperability.

There are no PKI certifications or standards that cover the infrastructure completely. Additionally, as organizations adopt cloud-native architectures, connected devices, automated workloads, and AI-enabled systems, managing machine identities through certificates and cryptographic controls has become a growing security and compliance priority.

Cryptographic Standards and Validation

Cryptographic standards can define how algorithms operate, which algorithms and key sizes are approved for particular environments, and how to protect cryptographic implementations.

FIPS 140-3 focuses on the cryptographic module itself. Its requirements cover areas including interfaces, authentication, software and firmware security, physical security, sensitive security parameter management, self-tests, and lifecycle assurance.

That distinction can be important during procurement. A product may use a standardized cryptographic algorithm without the cryptographic module itself having undergone FIPS validation. Where FIPS 140-3 validation is required, buyers should confirm that the applicable module, firmware, configuration, and operating mode are covered by a current validation.

PKI Standards and Trust Requirements

PKI standards address certificate formats, issuance, revocation, cryptographic policy, and interoperability.

X.509 and related specifications provide a foundation for digital certificates and certificate profiles. Publicly trusted Web PKI introduces additional requirements, including CA/Browser Forum standards and applicable audit or trust-program requirements.

Other environments add their own rules. European trust services may need to address eIDAS and relevant ETSI standards, while government and industry PKIs can have their own certificate profiles, assurance requirements, and interoperability rules.

For a deeper look at current PKI standards, Federal PKI, regional and industry requirements, and Web PKI, see PKI Standards Compliance.

Entrust helps organizations establish and maintain trusted cryptographic foundations across their most critical systems. Our technologies combine validated nShield hardware security modules, hardware-protected roots of trust, enterprise PKI, certificate lifecycle management, and cryptographic key and policy controls to help protect sensitive keys, govern digital certificates, and support secure identities and transactions.

Across on-premises, cloud, hybrid, and managed environments, Entrust provides the technology, services, and product-specific evidence organizations need to help meet security and compliance requirements. This includes independently validated cryptographic modules, standards-based PKI, audited trust services, and documentation that helps buyers verify the applicable product, configuration, and deployment scope.

Validated, Hardware-Rooted Cryptographic Security

Entrust nShield hardware security modules (HSMs) provide a hardware-based root of trust for protecting high-value cryptographic keys and performing sensitive cryptographic operations. They help organizations establish strong cryptographic boundaries for use cases such as PKI, digital signing, key management, code signing, and other high-assurance applications.

Entrust nShield 5s is validated to FIPS 140-3 Level 3 and certified to Common Criteria EAL4+ using the EN 419 221-5 Protection Profile. It has also achieved Qualified Signature Creation Device (QSCD) status relevant to eIDAS.

Certification and validation apply to defined products and configurations. Use the evaluation criteria above when reviewing evidence for a specific deployment.

Learn more about FIPS and Common Criteria.

Standards-Based PKI and Digital Trust

Entrust PKI solutions establish, operate, and scale trusted digital ecosystems through certificate issuance, lifecycle management, validation, and cryptographic governance. Built on hardware-protected roots of trust, Entrust technologies support secure identities for people, devices, applications, and infrastructure across enterprise, cloud, hybrid, and regulated environments. Entrust offers on-premises, managed, and cloud-delivered PKI solutions, allowing organizations to align their deployment model with security, operational, and compliance requirements.

Entrust Certificate Manager provides centralized visibility and lifecycle management across Entrust and third-party certificate authorities, helping organizations automate certificate issuance, renewal, revocation, and policy enforcement. Additional offerings such as Entrust Certificate Authority, PKI as a Service, Managed PKI, and Managed Root CA services support a range of trust architectures, from private enterprise PKI deployments to large-scale machine identity and device authentication environments.

Digital trust environments often introduce additional governance and assurance requirements. Thus, Entrust solutions help support standards-based certificate management and trust frameworks, including deployments aligned with Web PKI, eIDAS requirements, and industry-specific trust models. For organizations requiring independently audited PKI operations, Entrust offers designated services supported by audit frameworks such as WebTrust.

Explore Entrust PKI solutions.