NIST CMVP Validated Cryptographic Modules Actor

What does NIST CMVP Validated Modules Actor do?

This Actor scrapes the NIST Cryptographic Module Validation Program (CMVP) database — the official U.S./Canadian government registry of cryptographic modules validated against the FIPS 140-2 and FIPS 140-3 security standards. It pulls certificate number, vendor, module name, module type, and validation date for every listed module, with an optional deeper pass that fetches each certificate's detail page for standard, status, sunset date, security level, embodiment, description, and the vendor's public company website/address.

Run it on the Apify platform to get scheduled monitoring, API access, and export in JSON/CSV/Excel without writing or maintaining any scraper code yourself.

Why use NIST CMVP Validated Modules Actor?

• Federal & defense procurement compliance — confirm a vendor's cryptographic module is actively FIPS 140 validated before procurement or an RFP response.
• Vendor/competitor research — see which vendors have modules in the pipeline, historical, or revoked, and track certificate counts over time.
• Security & compliance monitoring — schedule recurring runs to catch new validations, status changes (Active → Historical/Revoked), or approaching sunset dates for modules your organization depends on.
• Sales & lead generation — the certificate list resolves to real vendor companies actively investing in FIPS 140 compliance, a strong signal for security/compliance tooling vendors.

How to use NIST CMVP Validated Modules Actor

1. Click Try for free or Run on the Apify platform.
2. Leave Start URLs on the default "Show All" listing, or paste in a filtered CMVP search URL (e.g. a specific Standard/CertificateStatus/ModuleType combination from CMVP's own advanced search form) for a narrower export.
3. Set Max items to however many certificate rows you want.
4. Optionally enable Fetch certificate detail pages for the fuller field set (standard, status, sunset date, level, vendor website/address) — leave it off for a fast listing-only export.
5. Click Start and download results from the Output tab in JSON, CSV, or Excel.

Input

Field	Type	Description
startUrls	array	CMVP search-result page(s) to scrape. Defaults to the unfiltered "Show All" listing.
maxItems	integer	Maximum certificate rows to scrape. Default 200.
fetchDetails	boolean	Also visit each certificate's detail page for the extended field set. Default false.
delaySeconds	number	Polite delay before each detail-page fetch. Default 1.0s.
concurrency	integer	How many detail pages to fetch at once. Default 5.

Output

{
  "certificateNumber": "5465",
  "certificateUrl": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5465",
  "vendorName": "Communication Devices Inc.",
  "moduleName": "Port Authority Series",
  "moduleType": "Hardware",
  "validationDate": "08/05/2026",
  "standard": "FIPS 140-3",
  "status": "Active",
  "sunsetDate": "9/10/2029",
  "overallLevel": "2",
  "embodiment": "MultiChipStand",
  "moduleDescription": "Secure Out of Band Management appliance providing the means to securely manage and power cycle remote equipment via cellular network, analog modem and network access.",
  "vendorWebsite": "http://commdevices.com",
  "vendorAddress": "85 Fulton Street, Boonton, NJ 07005, USA",
  "scrapedAt": "2026-08-06T08:22:43.587535+00:00"
}

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

Data table

Field	Description
certificateNumber	CMVP certificate number
certificateUrl	Link to the certificate's detail page
vendorName	Vendor/company name
moduleName	Cryptographic module name
moduleType	Hardware / Software / Firmware / Software-hybrid / Firmware-hybrid
validationDate	Most recent validation date
standard	FIPS 140-2 or FIPS 140-3 (detail page)
status	Active / Historical / Revoked (detail page)
sunsetDate	Certificate sunset date (detail page)
overallLevel	Overall FIPS 140 security level (detail page)
embodiment	Module embodiment type (detail page)
moduleDescription	Module description (detail page)
vendorWebsite	Vendor's public company website (detail page)
vendorAddress	Vendor's public business address (detail page)

Note: individual vendor contact names, emails, and phone numbers shown on some detail pages are intentionally not extracted — this Actor only exports company-level and module-level data.

Pricing / Cost estimation

Recommended rate: $5 per 1,000 results. Listing-only runs (fetchDetails: false) are close to free compute — a single static-HTML page fetch regardless of row count, no proxy required. Detail-page runs cost more compute proportional to rows fetched but are still lightweight (plain HTML, no JavaScript rendering).

Example costs at $5/1,000:

• 100 results: $0.50
• 500 results: $2.50
• 1,000 results: $5.00
• 5,000 results: $25.00

Tips

• Leave fetchDetails off for a fast export of the core 6 fields; turn it on only when you need standard/status/level/description — it multiplies request count by row count.
• The CMVP database currently has 1,000+ active and 5,000+ total validated modules across its history — set maxItems deliberately if you only need a recent slice (e.g. combine with a ValidationYear filter in your start URL).
• Use a filtered CMVP advanced-search URL as a start URL to scope results to one Standard, CertificateStatus, ModuleType, or Embodiment value.

FAQ, disclaimers, and support

This Actor scrapes publicly available U.S. government certification data from csrc.nist.gov; no login or authentication is required or used. It is not affiliated with or endorsed by NIST. Government page templates can change without notice — if you notice missing or malformed fields, please open an issue on this Actor's Issues tab. A custom version tailored to a specific filter set or additional fields is available on request.