Blog | Lightship Security

NIAP’s Accelerated PQC Transition (Policy Letter 33)

Lachlan Turner and Milad Torabi September 21, 2026Common Criteria

NIAP has published Policy Letter #33, setting certification deadlines for the transition to post-quantum cryptography (PQC). The policy affects products entering NIAP evaluation, products seeking placement on the Product Compliant List (PCL), and products already certified by NIAP or a CCRA partner.

For vendors, the practical effect is clear: PQC adoption is now on the critical path, and timelines are tightening. NIAP is introducing certification and market-access gates ahead of some of NSA’s broader operational transition dates. These gates apply not only to products entering NIAP evaluation, but also to internationally certified CCRA products seeking placement on the NIAP PCL. Existing listings are also affected. NIAP intends to archive noncompliant products on a date yet to be determined, regardless of how much time remains on their certifications. At the same time, Protection Profiles and supporting requirements still need to be updated to provide a viable path to demonstrating CNSA 2.0 compliance through NIAP evaluation.

The rest of this post looks at what Policy Letter 33 changes, how its deadlines compare with NSA’s broader CNSA 2.0 transition schedule, and the implementation gaps vendors still need to navigate.

FIPS Revalidation Scenarios: Mapping the Right Path for Your Module Changes

Vanshika July 28, 2026Certifications, FIPS 140-3

Why the Revalidation Path You Choose Determines Your Cost, Effort and Timeline!

Achieving an initial FIPS validation is a major milestone, but it may not be a one-time exercise! As products evolve through patches, new platforms, or branding updates, your cryptographic module must be revalidated to stay on the CMVP Active List.

The challenge is not the update itself but choosing the correct revalidation scenario from the FIPS 140-3 Management Manual (Section 7.1.1). Misclassification/Incomplete scope leads to rejected submissions, extended timelines, and unnecessary cost.

FIPS Validation Pitfalls—and How to Avoid Costly Delays

James Ramage and Vanshika April 15, 2026Certifications, FIPS 140-3

A Practical Guide for Security, Engineering, and Compliance Teams

Achieving FIPS validation is often viewed as a final checkpoint—something to address once development is complete. In practice, this mindset is one of the most common reasons organizations encounter delays, rework, and unexpected certification challenges.

FIPS validation is not simply a test passed at the end of development. It is a rigorous evaluation of cryptographic design, implementation, architecture, and documentation. Understanding how the process really works—and where projects often go wrong—can make the difference between a smooth validation and months of delay.

Jitter Entropy in OpenSSL 3.x

Greg McLearn November 2, 2025Common Criteria, Entropy, FIPS 140-3

OpenSSL 3.4.0 introduced the jitter‑based entropy source (JITTER) as an optional RNG seed, accessible when compiled with enable‑jitter. In OpenSSL 3.5.0 – the new long‑term stable (LTS) release – the jitter entropy provider remains available and gains further significance: notably, the FIPS provider can optionally utilize it via a new configuration flag, enable‑fips‑jitter. This makes OpenSSL 3.5.0 particularly compelling for users seeking stablity and flexibility across both standard and FIPS and Common Criteria use cases.

NDcPP v4.0 vs. v3.0e: What’s Changing and How to Prepare

Lachlan Turner September 2, 2025Common Criteria

If you ship network devices into environments that care about Common Criteria, the Network Device Collaborative Protection Profile (NDcPP) is the baseline you live with. NDcPP v3.0e has been the approved version since December 2023; the ND iTC is now iterating on a NDcPP v4.0 draft. This post offers a practitioner’s comparison of v3.0e and the v4.0 draft, the NIAP acceptance window you need to plan around, and concrete steps to de‑risk your roadmap.

[Update Feb 2026: NDcPP v4.0 has now been published.]

Accelerate Your EU Common Criteria Certification with Lightship Security & Applus+ Laboratories

Lachlan Turner July 22, 2025Certifications, Common Criteria, Lightship News

At Lightship Security, we help leading security product vendors achieve NIAP and EUCC Common Criteria certification quickly and efficiently. As part of Applus+ Labororatories, a global leader in testing, inspection, and certification, we offer a powerful combination of deep technical expertise, automated evaluation tools, and global certification reach.

Why Lightship and Applus+?

Key Update in NIAP Policy Letter #12: Vendors, Take Note of Core Functionality Requirement

Lachlan Turner April 14, 2025Certifications, Common Criteria

The latest update to NIAP Policy Letter #12 (Update 5) brings a significant change that vendors should be aware of: the inclusion of core functionality as a critical requirement for products undergoing evaluation under NIAP. This new addition places an important responsibility on vendors to ensure that their products’ core functionality is explicitly included in the scope of evaluation. Let’s dive into why this change is so crucial for vendors and how they can prepare.

Post-Quantum Crypto – FIPS Standards Announced

James Ramage September 13, 2024Common Criteria, FIPS 140-3

[Update Sept 2024: These Standards have been published.]

In our last article on Post Quantum Crypto (PQC) titled “Introduction to the Quantum Computing Impact on Cryptography”, we introduced quantum computing concepts and the potential impact on computer security and cryptography. The article also introduced CNSA 1.0 and CNSA 2.0 as initial suites of PQC algorithms developed by the National Security Agency (NSA). The thrust of PQC development has focused on the replacement of public key cryptography given quantum computing’s ability to conduct complex calculations quickly and potentially decrypt data encrypted with legacy algorithms in hours or days, versus the years it would have normally taken.

ESV for Common Criteria

Marina Ibrishimova and Lachlan Turner July 10, 2024Certifications, Common Criteria, Entropy

NIAP recently released Labgram #118 – Entropy Source Validation Certificates. It mandates that ESV certificates must be included as part of the Entropy Assessment Report (EAR) for all products that enter evaluation with NIAP from January 1^st, 2025. Effective immediately, vendors may submit EARs that refer to an ESV certificate. This blog post discusses what ESV is, how it relates to Common Criteria under NIAP and the impact of this policy on vendors undertaking evaluations outside of NIAP (e.g. Canada etc.) but seeking NIAP PCL entry.

EUCC Perspectives

Lachlan Turner January 8, 2024Common Criteria

In this post we examine the proposed European Cybersecurity Certification Scheme (EUCC). We’ll cover:

What is EUCC?
What is the status of EUCC?
What has changed since the draft EUCC regulation was published?
What impact will EUCC have on vendors?
What impact will EUCC have on the certification industry?
How is Lightship Security preparing for EUCC to support our clients?