Cryptographic and Security Testing LAP

The Cryptographic and Security Testing (CST) Laboratory Accreditation Program (LAP), initially named Cryptographic Module Testing (CMT), was established by NVLAP to accredit laboratories that perform cryptographic modules validation conformance testing under the Cryptographic Module Validation Program (CMVP). In response to other mandates and requests, additional testing has been added to the program to include algorithm testing for the Cryptographic Algorithm Validation Program (CAVP), testing to improving the identification and authentication of Federal employees and contractors for access to Federal facilities and information systems for the NIST Personal Identification Verification Program (NPIVP), test methods for the GSA FIPS 201 Evaluation Program which build upon NPIVP test methods as the GSA Precursor (GSAP), testing to validate the implementation of the Security Content Automation Protocol (SCAP) standards within security software modules, and conformance testing to methods supportive of the Department of Homeland Security's Identity and Privilege Credential Management; e.g, Transportation Worker Identification Credential (TWIC).

Proficiency Testing Requirements

At the present time, there is no ongoing established program for proficiency testing of laboratories accredited for cryptographic and security testing beyond the initial artifact testing that is completed by an initial applicant to the program.

Requirements Documents

• NIST Handbook 150:2020, NVLAP Procedures and General Requirements
• NIST Handbook 150-17:2022, NVLAP Cryptographic and Security Testing
• NIST Handbook 150-17 Checklist (Word version)
   

• Lab Bulletin LB-149-2023: Change in application of the requirement in NIST Handbook 150-17:2022 Annex B.3.5.2

• Lab Bulletin LB-147-2022: Release of NIST Handbook 150-17, 2022 Edition

• Lab Bulletin LB-116-2020: Update to NVLAP accreditation documents for laboratories accredited to ISO/IEC 17025:2017 under the ILAC MRA

References and Information

• Cryptographic Module Validation Program
• Cryptographic Algorithm Validation Program
• PIV - Personal Identity Verification Program
• SCAP - Security Content Automation Protocol