What is validated in the Lavawall Viewer?

The cryptographic module. The viewer's cryptography runs in the Go Cryptographic Module v1.0.0, which holds FIPS 140-3 certificate #5247 from NIST's Cryptographic Module Validation Program. Windows, the Windows key store, the TPM, code signing, the system browser and the passkey you sign in with are outside that module. Lavawall does not claim that the viewer or the product is FIPS certified or CJIS certified.

Can we use it for CJIS requirements?

Yes. The Lavawall Viewer is built for agencies and service providers that must meet the CJIS Security Policy's encryption requirements for remote access. Its cryptography runs in a module validated to FIPS 140-3 (NIST CMVP certificate #5247), and sessions are protected in transit by that module. CJIS compliance is determined by your agency's overall deployment, so we provide the documentation to support your assessment and your state's CJIS review.

What evidence can Lavawall provide to an assessor?

The validation certificate reference, this overview, an architecture and data-flow description, the licence and credits list, and a contact for vulnerability reports. Ask through the contact page.

Documentation for assessors

Lavawall Viewer: security and validation overview

What the Lavawall® Viewer for Windows runs inside a FIPS 140-3 validated module, what it does not, who is responsible for what, and the evidence we can give your assessor.

Last reviewed: 2026-10-30

What runs inside the validated module

The viewer’s cryptography for the session runs in the Go Cryptographic Module v1.0.0, validated to FIPS 140-3 under NIST CMVP certificate #5247.

The same module protects the other end of the session, at the computer being supported and in the Lavawall relay. The Windows viewer is FIPS 140-3 only. A session viewed in a web browser is different: the browser uses its own cryptography, which is not a validated module. The FIPS 140-3 page draws that line in more detail.

What does not run inside it

The certificate covers the module. It does not cover the product around it. These sit outside the module:

Windows, the Windows key store and the data-protection services that go with it.
The computer’s TPM.
Code signing of the program.
The system browser you use to sign in to the console.
The passkey you sign in with, which has its own certification, if any.
The technician’s computer, its network and its physical surroundings.

Lavawall does not say that the viewer, the product or any TPM is FIPS certified, CJIS certified or CJIS compliant. What has been validated is the cryptographic module, and CJIS compliance is determined by your agency’s overall deployment.

Shared responsibility

Where the viewer is involved, this is who does what.

Area	Lavawall	Your agency
Validated cryptography for the session	Runs the session’s cryptography in the validated module, in the viewer and at the other end of the session.	Keeps the viewer current and records certificate #5247 in your assessment.
Session encryption	Protects the session in transit through the validated module, and offers end-to-end encryption of remote sessions as an organization setting.	Chooses the setting, confirms it is on for your organization, and decides what your policy requires.
Sign-in with a FIPS 140-3 passkey	Can require FIPS 140-3 validated security keys at sign-in, checked against NIST’s list at registration and at every login.	Issues the keys, turns the requirement on, and manages who has access.
Updates and versions	Signs viewer updates and tracks which versions are in use.	Lets the viewer update and reviews the versions shown in the console.
Audit logging	Records pairing and launch events in the activity log.	Reviews the log and keeps it for as long as your policy says.
The technician’s computer	On Windows computers, reads the TPM’s make and firmware and compares them with NIST’s validated-modules lists. The result is shown in the device’s hardware details and is information only.	Hardens and patches the computer, manages its TPM and the Windows key store, and confirms the TPM’s firmware against the certificate.
Overall CJIS compliance	Provides documentation that supports your assessment and your state’s CJIS review.	Determines compliance for the whole deployment, including policy, personnel, networks and facilities.

Evidence we can provide on request

The validation certificate: NIST CMVP certificate #5247.
This overview.
An architecture and data-flow description of the viewer and a remote session.
The licence and credits list, also published on the open source and credits page.
A contact for vulnerability reports and how we handle them.

Ask through the contact page and say which assessment it is for.

CJIS Security Policy mapping

We list only the requirements the viewer clearly supports, named as on our CJIS Security Policy page. Confirm numbering against the version your state audits to.

Requirement	What the viewer supports	What stays with your agency
SC-13	Criminal justice information in a remote session is protected in transit by a FIPS 140-3 validated cryptographic module, certificate #5247.	Criminal justice information moving across your own infrastructure, and whether the overall deployment meets SC-13.
Advanced authentication	Sign-in can require a FIPS 140-3 validated security key, checked against NIST’s list at registration and at every login.	Issuing the keys, enforcing the requirement and managing access.

Controls for networks, personnel, physical security and policy belong to your agency’s deployment and are not listed here.