FIPS 140-3: What it is and how IT Glue supports it

FIPS 140-3 is the security standard the U.S. and Canadian governments use to confirm that the encryption inside IT systems has been properly tested and approved. That makes it critical for MSPs and corporate IT teams that support government agencies and the providers and contractors who work with them. If your clients handle sensitive government data, the encryption protecting it must meet this bar.

As a Kaseya solution, IT Glue treats data security as an utmost priority, and the use of FIPS 140-3-validated cryptographic modules is the latest step in protecting your IT documentation. It aligns with the encryption expectations of key frameworks across the public sector and other compliance-driven industries, including Criminal Justice Information Services (CJIS), Cybersecurity Maturity Model Certification (CMMC), the Federal Information Security Modernization Act (FISMA) and NIST SP 800-171.

Let’s look at what FIPS 140-3 is, why it matters to you and how IT Glue supports your FIPS 140-3 compliance.

What is FIPS 140-3?

FIPS 140-3 is the third version of the Federal Information Processing Standard that defines security requirements for cryptographic modules protecting sensitive data. The National Institute of Standards and Technology (NIST) published it to keep pace with evolving cyberthreats. It also aligns more closely with international standards, particularly ISO/IEC 19790.

FIPS 140-3 validation confirms that cryptographic modules, whether in hardware, software or firmware, are designed to meet strict security requirements. That is why FIPS-validated modules are often required under federal mandates and industry frameworks, including NIST SP 800-171, CMMC, FISMA and CJIS.

Why FIPS 140-3 matters to you

FIPS 140-3 is required for any system that stores, processes or transmits federal agency data needing cryptographic protection. The same expectation applies to organizations handling Controlled Unclassified Information (CUI), including the contractors and vendors who support federal programs. It often reaches further down the chain, too. State and local government agencies frequently require or strongly recommend it from their vendors, especially when public safety or citizen data is involved. Beyond government, health care, finance and energy and utilities organizations turn to FIPS-validated encryption to satisfy their own compliance frameworks.

How IT Glue supports FIPS 140-3 compliance

IT Glue has implemented security-hardening enhancements across its cloud infrastructure, including expanded use of FIPS 140-3-validated cryptographic modules to protect data at rest and in transit. It has also broadened its adoption of security best-practice configurations across the environment.

These enhancements strengthen the protection of customer data and support IT Glue’s ongoing CMMC Level 2 readiness efforts and broader security and compliance objectives.

IT Glue security beyond FIPS 140-3

FIPS 140-3-validated cryptographic modules are one layer of IT Glue’s security. These controls work alongside them:

• Password encryption: Passwords are encrypted with AES-256-bit encryption, including a 2048-bit RSA public key. Each customer has unique keys, and each password has its own secure random key. These are kept separate from each other, so a breach in one system will not allow decryption of any passwords.
• Host-proof hosting: IT Glue Vault is designed so users decrypt passwords only at the endpoint, in their browser, with a user-specific passphrase that isn’t synced to IT Glue. Only the user has the passphrase. If it’s lost, IT Glue cannot retrieve the password.
• Enforced multifactor authentication (MFA): MFA is enforced on all user accounts. Users enter their username and password plus a one-time password from an authenticator app, which mitigates the risk of a compromised login.
• SSO Access Control: You can make SSO the only authentication channel into your IT Glue instance. Enforcing SSO helps prevent unauthorized access.
• Permissions and audit trail: Administrators and managers can add layers of control and restrict access to specific groups and users. Password changes are version-controlled, and viewed passwords are automatically tracked in an audit trail entry within the activity logs. Administrators can also generate an At-Risk Password Report that shows which passwords a user could access and which need changing during offboarding.
• SOC 2 Type II: IT Glue holds a Service Organization Control 2 (SOC 2) Type II report. It is an internal controls report that captures how well data is protected and how closely those controls operate to industry best practices.

Secure, automate and streamline service delivery at scale

IT Glue has security at its core, which is why tens of thousands of MSPs and IT professionals trust it with their documentation.

However, security is only part of the story. IT Glue integrates with Autotask PSA and Datto RMM to form a powerful trio that unifies your entire service workflow. Together, they create a connected system that removes friction from every stage of service delivery. When customers combine them, 92% report greater efficiency and productivity, 73% report more technician peace of mind and 65% note less frustration.

Want to explore how the trio could work for your team? Download the eBook, The MSP service delivery playbook: Real results with RMM, PSA and IT documentation, to see how you can achieve complete control and scalable growth with a unified platform.