# NIST CMVP Validated Cryptographic Modules Actor (`tehsnarf/nist-cmvp-validated-modules`) Actor

Scrapes NIST's Cryptographic Module Validation Program (CMVP) database of FIPS 140-2/140-3 validated cryptographic modules, with optional per-certificate detail enrichment.

- **URL**: https://apify.com/tehsnarf/nist-cmvp-validated-modules.md
- **Developed by:** [Chris Hoover](https://apify.com/tehsnarf) (community)
- **Categories:** Lead generation, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $5.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

### What does NIST CMVP Validated Modules Actor do?

This Actor scrapes the [NIST Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search/all) database — the official U.S./Canadian government registry of cryptographic modules validated against the FIPS 140-2 and FIPS 140-3 security standards. It pulls certificate number, vendor, module name, module type, and validation date for every listed module, with an optional deeper pass that fetches each certificate's detail page for standard, status, sunset date, security level, embodiment, description, and the vendor's public company website/address.

Run it on the Apify platform to get scheduled monitoring, API access, and export in JSON/CSV/Excel without writing or maintaining any scraper code yourself.

### Why use NIST CMVP Validated Modules Actor?

- **Federal & defense procurement compliance** — confirm a vendor's cryptographic module is actively FIPS 140 validated before procurement or an RFP response.
- **Vendor/competitor research** — see which vendors have modules in the pipeline, historical, or revoked, and track certificate counts over time.
- **Security & compliance monitoring** — schedule recurring runs to catch new validations, status changes (Active → Historical/Revoked), or approaching sunset dates for modules your organization depends on.
- **Sales & lead generation** — the certificate list resolves to real vendor companies actively investing in FIPS 140 compliance, a strong signal for security/compliance tooling vendors.

### How to use NIST CMVP Validated Modules Actor

1. Click **Try for free** or **Run** on the Apify platform.
2. Leave **Start URLs** on the default "Show All" listing, or paste in a filtered CMVP search URL (e.g. a specific `Standard`/`CertificateStatus`/`ModuleType` combination from CMVP's own advanced search form) for a narrower export.
3. Set **Max items** to however many certificate rows you want.
4. Optionally enable **Fetch certificate detail pages** for the fuller field set (standard, status, sunset date, level, vendor website/address) — leave it off for a fast listing-only export.
5. Click **Start** and download results from the **Output** tab in JSON, CSV, or Excel.

### Input

| Field | Type | Description |
|---|---|---|
| `startUrls` | array | CMVP search-result page(s) to scrape. Defaults to the unfiltered "Show All" listing. |
| `maxItems` | integer | Maximum certificate rows to scrape. Default 200. |
| `fetchDetails` | boolean | Also visit each certificate's detail page for the extended field set. Default false. |
| `delaySeconds` | number | Polite delay before each detail-page fetch. Default 1.0s. |
| `concurrency` | integer | How many detail pages to fetch at once. Default 5. |

### Output

```json
{
  "certificateNumber": "5465",
  "certificateUrl": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5465",
  "vendorName": "Communication Devices Inc.",
  "moduleName": "Port Authority Series",
  "moduleType": "Hardware",
  "validationDate": "08/05/2026",
  "standard": "FIPS 140-3",
  "status": "Active",
  "sunsetDate": "9/10/2029",
  "overallLevel": "2",
  "embodiment": "MultiChipStand",
  "moduleDescription": "Secure Out of Band Management appliance providing the means to securely manage and power cycle remote equipment via cellular network, analog modem and network access.",
  "vendorWebsite": "http://commdevices.com",
  "vendorAddress": "85 Fulton Street, Boonton, NJ 07005, USA",
  "scrapedAt": "2026-08-06T08:22:43.587535+00:00"
}
```

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

### Data table

| Field | Description |
|---|---|
| certificateNumber | CMVP certificate number |
| certificateUrl | Link to the certificate's detail page |
| vendorName | Vendor/company name |
| moduleName | Cryptographic module name |
| moduleType | Hardware / Software / Firmware / Software-hybrid / Firmware-hybrid |
| validationDate | Most recent validation date |
| standard | FIPS 140-2 or FIPS 140-3 *(detail page)* |
| status | Active / Historical / Revoked *(detail page)* |
| sunsetDate | Certificate sunset date *(detail page)* |
| overallLevel | Overall FIPS 140 security level *(detail page)* |
| embodiment | Module embodiment type *(detail page)* |
| moduleDescription | Module description *(detail page)* |
| vendorWebsite | Vendor's public company website *(detail page)* |
| vendorAddress | Vendor's public business address *(detail page)* |

Note: individual vendor contact names, emails, and phone numbers shown on some detail pages are intentionally **not** extracted — this Actor only exports company-level and module-level data.

### Pricing / Cost estimation

Recommended rate: **$5 per 1,000 results**. Listing-only runs (`fetchDetails: false`) are close to free compute — a single static-HTML page fetch regardless of row count, no proxy required. Detail-page runs cost more compute proportional to rows fetched but are still lightweight (plain HTML, no JavaScript rendering).

Example costs at $5/1,000:

- 100 results: $0.50
- 500 results: $2.50
- 1,000 results: $5.00
- 5,000 results: $25.00

### Tips

- Leave `fetchDetails` off for a fast export of the core 6 fields; turn it on only when you need standard/status/level/description — it multiplies request count by row count.
- The CMVP database currently has 1,000+ active and 5,000+ total validated modules across its history — set `maxItems` deliberately if you only need a recent slice (e.g. combine with a `ValidationYear` filter in your start URL).
- Use a filtered CMVP advanced-search URL as a start URL to scope results to one `Standard`, `CertificateStatus`, `ModuleType`, or `Embodiment` value.

### FAQ, disclaimers, and support

This Actor scrapes publicly available U.S. government certification data from csrc.nist.gov; no login or authentication is required or used. It is not affiliated with or endorsed by NIST. Government page templates can change without notice — if you notice missing or malformed fields, please open an issue on this Actor's Issues tab. A custom version tailored to a specific filter set or additional fields is available on request.

# Actor input Schema

## `startUrls` (type: `array`):

CMVP search-result page(s) to scrape. Defaults to the unfiltered 'Show All' listing (1,000+ rows, single page, no pagination). You can substitute a filtered search URL from CMVP's own advanced search form for a narrower export.

## `maxItems` (type: `integer`):

Maximum number of certificate rows to scrape across all start URLs

## `fetchDetails` (type: `boolean`):

When enabled, also visits each certificate's detail page to pull Standard, Status, Sunset Date, Overall Level, Embodiment, Description, vendor website, and vendor address. Off by default — this multiplies request count by the number of rows scraped.

## `delaySeconds` (type: `number`):

Polite delay each detail-page fetch waits before requesting. Only applies when fetchDetails is enabled.

## `concurrency` (type: `integer`):

How many detail pages to fetch at once (each still waits delaySeconds before requesting). Only applies when fetchDetails is enabled.

## Actor input object example

```json
{
  "startUrls": [
    {
      "url": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search/all"
    }
  ],
  "maxItems": 200,
  "fetchDetails": false,
  "delaySeconds": 1,
  "concurrency": 5
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("tehsnarf/nist-cmvp-validated-modules").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("tehsnarf/nist-cmvp-validated-modules").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call tehsnarf/nist-cmvp-validated-modules --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tehsnarf/nist-cmvp-validated-modules"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/KYF4eCPjgogNxeFuR/builds/CB1pY12i0yf4xdB2m/openapi.json