PE and FIPS compliance

Beginning with version 2019.2.0, Puppet Enterprise (PE) complies with Federal Information Processing Standard (FIPS) 140-2 standards and is fully operable on select FIPS platforms.

Federal Information Processing Standard (FIPS) 140-2 is a standard defined by the U.S. government that defines the security requirements for cryptographic modules. The standard is published and maintained by the National Institute of Standards and Technology (NIST) and is mandated by the White House Office of Management and Budget (OMB) in Circular A-130 and pursuant to FISMA (44 U.S.C Chapter 35). NIST operates the Cryptographic Module Validation Program (CMVP), which validates cryptographic modules per the requirements defined by the standard. All federal information systems that transmit and store sensitive information must utilize FIPS 140-2-validated cryptography.

As of version 2019.2.0, the cryptographic modules included in Puppet Enterprise are compliant with FIPS 140-2 and fully operable on the FIPS-compliant platforms listed below.

For information on installing a FIPS-compliant PE master and agents, see Installing FIPS-compliant Puppet Enterprise.