FIPS 140-2 Non-Proprietary Security Policy: IBM Security XGS 3100, XGS 4100, XGS 5100, and XGS 7100
Document Version 0.9
© IBM Security
Page 4 of 50
1 Introduction
1.1 About FIPS 140-2
Federal Information Processing Standards Publication 140-2 -- Security Requirements for Cryptographic
Modules specifies requirements for cryptographic modules to be deployed in a Sensitive but
Unclassified environment. The National Institute of Standards and Technology (NIST) and
Communications Security Establishment (CSE) Cryptographic Module Validation Program (CMVP) runs
the FIPS 140-2 program. The CMVP accredits independent testing labs to perform FIPS 140-2 testing; the
CMVP also validates test reports for products meeting FIPS 140-2 validation. Validated is the term given
to a product that is documented and tested against the FIPS 140-2 criteria.
More information is available on the CMVP website at
1.2 About this Document
This non-proprietary Cryptographic Module Security Policy for the XGS 3100, XGS 4100, XGS 5100, and
XGS 7100 from IBM Security provides an overview of the product and a high-level description of how it
meets the security requirements of FIPS 140-2. This document contains details on the module's
cryptographic keys and critical security parameters. This Security Policy concludes with instructions and
guidance on running the module in a FIPS-approved mode of operation.
The IBM Security XGS 3100, XGS 4100, XGS 5100, and XGS 7100 may also be referred to as the
"modules" in this document.
1.3 External Resources
The IBM Security website (http://www.ibm.com) contains information on the full line of products from
IBM Security, including a detailed overview of the XGS 3100, XGS 4100, XGS 5100, and XGS 7100
solution. The Cryptographic Module Validation Program website
IBM Security contact information.
1.4 Notices
This document may be freely reproduced and distributed in its entirety without modification.