Determining FIPS 140-2 compliance in a medical device

[tlombardo]

Background: Medical startup (first product) - device is a point of care x-ray system which interfaces with PACS/DICOM storage through Wi-Fi. The Veterans Health Administration when initiating an enterprise risk assessment asks for a FIPS 140-2 certification number for any wireless networked devices.

Question: It could very well be that our device is not FIPS 140-2 compliant, but if it is, how would we demonstrate compliance? For the purpose of the VHA ERA this information is submitted through the form on the VA Directive 6550 Appendix A simply asking for the certification number. Would this need to be a custom certification for our (software) system? Or just a reference to the underlying cryptographic module that has a certification number already on file with the NIST database?

Details: Device is running a java application that manages all network traffic - contains OpenSSL 3.0 using AES 256 algorithm - running on a Debian 10 OS on an Intel NUC with an Intel network adapter.

Thanks for any assistance,
Tom

 

[Junn1992]

Check with a certification company? from a brief read of the standard it seems to apply only to the module. for system wide specifics...not sure!
NIST.gov - Computer Security Division - Computer Security Resource Center

 

[Tidge]

Question: It could very well be that our device is not FIPS 140-2 compliant, but if it is, how would we demonstrate compliance?
...
Details: Device is running a java application that manages all network traffic - contains OpenSSL 3.0 using AES 256 algorithm - running on a Debian 10 OS on an Intel NUC with an Intel network adapter.

So... it sounds like the design has an architecture where you allocated elements of the interface to identified implementation details. This is good!

To demonstrate compliance, it is best that you have dedicated system level requirements that trace to this architecture (and implemented solution), with appropriate verification that the system level requirements are satisfied. I have no specific familiarity with "FIPS 140-2" certification, so it is possible that your solution is compliant (by accident?), but it is best to design it for compliance. For legacy solutions, the only recourse is to start with the requirements and analyze the solution for conformity... this is likely what a 3rd-party assessor will do... although I can imagine them "kicking the tires" as well. Please let us know how you proceed and what you learn!