Buyer’s guide
Best FIPS 140-3 RMM and remote support for MSPs
If a rule points you at FIPS 140-3, the tools that reach into your machines are where it lands. Here is what actually satisfies the requirement, the questions to ask a vendor, and an honest look at where the major platforms stand.
The short answer: a FIPS 140-3 RMM is one where the remote session that reaches a regulated machine runs through a FIPS 140-3 validated cryptographic module, with a certificate number you can hand an assessor, where logins can be restricted to FIPS 140-3 validated keys, and where that posture does not require a separate product from your patching and GRC. Several tools have a real FIPS story; fewer have a current 140-3 one, and fewer still enforce the login side too.
Why this is a buying decision now
FIPS 140-3 is the current US federal standard for cryptographic modules, aligned with the international standard ISO/IEC 19790, and it is validated jointly by the US National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS) under the Cryptographic Module Validation Program. A rule such as CJIS control SC-13 does not ask whether your tool uses strong encryption; it asks whether that encryption is performed by a module on the CMVP validated list.
The date on the calendar is what makes this urgent. On 21 September 2026, NIST moves every FIPS 140-2 validation to its historical list. A tool whose only validated module is 140-2 is not suddenly insecure, but it is no longer resting on a current validation, and a careful assessor will notice. New work should specify FIPS 140-3.
What to look for
Six criteria that separate a tool that can stand behind a FIPS 140-3 requirement from one that cannot.
A validated module for data in transit
The remote session should run through a FIPS 140-3 validated cryptographic module, with a CMVP certificate number you can cite, not just “strong encryption” or a FIPS mode you have to take on faith.
A current 140-3 certificate, not 140-2
Ask which standard the validation is against. FIPS 140-2 validations move to NIST’s historical list on 21 September 2026.
Enforced FIPS 140-3 validated login keys
Can the tool refuse a login that is not on a FIPS 140-3 validated key, checked against the CMVP list at every sign-in? Most offer MFA; few enforce a validated-only policy.
One platform, not a separate FIPS edition
If the validated cryptography lives in a separate FIPS-configured product, you are buying and running two things. Look for the FIPS posture and the RMM, patching, and GRC in one place.
Patch evidence for flaw remediation
FIPS is the cryptography control; patching is the separate flaw-remediation control in the same policy. The tool should record patch status as timestamped evidence.
Data residency you can choose
Canadian public-sector buyers in particular need to know where the data and its processing sit. A tool that can place them in-country is a real differentiator.
How the major platforms compare
Based on each vendor’s own published documentation, as of September 2026. FIPS validations change and editions differ; confirm the current CMVP certificate and configuration for any product before you rely on it. “Not published” means we did not find a vendor statement, not that a capability is impossible.
| Platform | Validated module for data in transit | Enforces FIPS 140-3 validated login keys | FIPS posture and RMM in one platform |
|---|---|---|---|
| Lavawall® | Yes, FIPS 140-3 validated module for the remote session, CMVP #5247 | Yes, checked against the CMVP list at every login | Yes, one platform: remote support, patching, and GRC |
| BeyondTrust (Bomgar) | FIPS 140-2 validated (Level 1); its 140-3 statement describes FIPS-compliant OpenSSL rather than a 140-3 certificate | Not published | Separate FIPS-configured deployment; privileged-access focus |
| ConnectWise ScreenConnect | FIPS mode using the operating system’s cryptography; no product 140-3 certificate published | Not published | Remote tool; RMM and GRC are separate products |
| Kaseya VSA | FIPS 140-2 validated module historically (VSA Cryptographic Module); 140-3 status in progress, verify | Not published | RMM; FIPS scope varies by component |
| N-able (Take Control) | FIPS 140-2 validated components (N-able Cryptographic Module) | Not published | Remote tool within the N-able range |
| NinjaOne | Not published for its own agent or remote session; general FIPS guidance only | Not published | RMM; cloud-hosted |
| Datto RMM | Not published for the RMM path; Datto BCDR appliances offer a FIPS mode | Not published | RMM |
| Atera | Not published; cloud-hosted RMM | Not published | RMM |
| Splashtop | FIPS-compliant mode in the On-Prem / government edition | Not published | Remote tool |
Sources: vendor FIPS documentation and NIST CMVP listings, accessed September 2026, including BeyondTrust’s FIPS 140-3 compliance statement, ConnectWise ScreenConnect’s security guide, Kaseya’s VSA FIPS documentation, N-able’s FIPS 140-2 components letter, Splashtop’s FIPS support notes, and the NIST CMVP validated-modules list.
Where Lavawall® fits
Lavawall is built for the buyer this guide is written for: an MSP or a lean public-sector IT team that has to satisfy a FIPS 140-3 requirement without standing up a separate enterprise programme. The remote desktop session runs through a FIPS 140-3 validated module (CMVP #5247), logins can be restricted to FIPS 140-3 validated keys and checked against the CMVP list at every sign-in, and patching, remote support, and GRC run in the same console, so the evidence lands in one place. Data and its AI processing can sit in Canada by default. See FIPS 140-3 RMM and patching for the detail, and FIPS 140-3 support for exactly what is and is not claimed.
The YubiKey 5C NFC FIPS (140-3) is US$95 on Amazon, or US$88 direct from Yubico. Prices last checked: Amazon 2026-09-03, Yubico 2026-09-03. Check the retailer for the current figure.
Frequently asked
- What makes an RMM FIPS 140-3 compliant?
- There is no single “FIPS 140-3 compliant RMM” checkbox. What a rule such as CJIS SC-13 actually requires is that the cryptography protecting data in transit be performed by a FIPS 140-3 validated cryptographic module, listed on the NIST CMVP. So the questions that matter are: does the remote session run through a validated module, can you cite its certificate number, and is that certificate a current 140-3 validation rather than a 140-2 one that moves to NIST’s historical list on 21 September 2026?
- Is FIPS 140-2 still acceptable?
- For now, but it is on a clock. On 21 September 2026 NIST moves FIPS 140-2 validations to its historical list. New procurements should specify FIPS 140-3, and a tool whose only validated module is 140-2 is a question worth raising with the vendor.
- Which RMMs enforce FIPS 140-3 validated login keys?
- Most RMMs support multi-factor authentication and some support passkeys, but enforcing that every login use a FIPS 140-3 validated key, checked against the NIST CMVP list, is uncommon. Lavawall does this: you set the minimum authenticator standard to FIPS 140-3 validated, and non-compliant keys are refused. Verify the current capability with any vendor before relying on it.
- Do I need a separate FIPS edition?
- With several enterprise remote-access products, the FIPS-validated cryptography lives in a specific FIPS-configured deployment or edition, often at enterprise pricing and separate from your RMM and GRC. Lavawall runs the FIPS-mode cryptography, patching, remote support, and GRC in one platform, so the FIPS posture is not a separate purchase.