CHAINGUARD FIPS COMMITMENT

This Chainguard Federal Information Processing Standards Commitment (“FIPS Commitment”) describes certain services of Chainguard, Inc. (“Chainguard”) in connection with Chainguard’s Products known as (“Chainguard FIPS Containers”), as applicable under a given order (“Order”)  by and between a customer (“Customer”) and Chainguard.  Capitalized terms used, but not defined in this FIPS Commitment, have the meanings ascribed in the Agreement (as defined in such Order). 

FIPS are publicly announced standards developed by the National Institute of Standards and Technology (“NIST”) in accordance with the Federal Information Security Management Act (“FISMA”) and approved by the United States Secretary of Commerce. FIPS compliance ensures that cryptographic security services within applications meet strict security and integrity standards, and are implemented and configured correctly. In furtherance thereof, Chainguard FIPS Containers may be used by Customer in fulfillment of its FIPS cryptography requirements under various industry-standard compliance frameworks, including but not limited to, CMVP, NIST SP 800-53, NIST SP 800-171, FISMA, DoD CMMC, DoD CC SRG, FedRAMP, Common Criteria, FBI CJIS, NSA CNSA, IRS Publication 1075, HIPAA, PCI DSS, IETF RFC, German BSI, Australian ACSC IRAP, and UK NCSC, subject to Customer preserving such compliance through its implementation and customization activities.

‍

1. Commitment for Chainguard FIPS Containers.

1.1. Chainguard warrants the following with respect to Chainguard FIPS Containers:

1.1.1. The Chainguard FIPS Containers available to be delivered in compliance with FIPS specifications are listed here. Chainguard FIPS Containers indicated on Customer’s Order will be made available in compliance with applicable FIPS specifications.

1.1.2. The Chainguard FIPS Containers contain FIPS-validated software cryptographic modules and SP 800-90B compliant entropy sources as validated by NIST; provided that use of certain specified functions or services, which constitute “non-approved services” may result in the module operating outside of the FIPS-validated state for those specific operations.

1.2. Below are lists of current, anticipated, and historical validated modules shipped in Chainguard FIPS Containers. The Software Bill of Materials indicator (“SBOM Indicator”) set forth below is a differentiator to uniquely identify the primary module location. Within Chainguard FIPS Containers, tags and hashes may be used to identify different modules. 

1.2.1. Current (in-use) validated modules of Chainguard FIPS Containers include the following:

Cryptographic Module Validation Programme (CMVP):

Entropy Validation:

1.2.2. Anticipated validated modules of Chainguard FIPS Containers (subject to change) include the following:

1.2.3. Historical (previously used) validated modules of Chainguard FIPS Containers include the following:

For clarity, the information set forth in Sections 1.2.1. Through 1.2.3. may be updated from time to time; for the most up-to-date information, please contact fips-contact@chainguard.dev.

2. Remediation for Chainguard FIPS Containers. Chainguard will use commercially reasonable efforts to ensure that applications for Chainguard FIPS Containers utilize FIPS-validated cryptographic modules for any applicable cryptographic operations, provided that the parties acknowledge and agree that certain behaviors or functionalities within such applications, which are beyond the direct control of Chainguard, may not fully adhere to FIPS requirements. To the extent common vulnerabilities and exposures (“CVEs”) are identified in such Chainguard FIPS Containers, the terms of the CVE Policy will apply as expressly set forth therein.

3. Order of Precedence. In the event of any conflict between the terms of this FIPS Commitment, the Agreement, and the applicable Order, the following order of precedence shall govern: (i) first, this FIPS Commitment (only with respect to the subject matter hereof); (ii) second, the Agreement; and (iii) third, the applicable Order (unless the the applicable Order clearly specifies that it modifies the Agreement).