LinkedIn
FIPS-Validated Encryption with automated reporting
Buoyant Enterprise for Linkerd (BEL) accelerates your path to FedRAMP compliance without changing your application code. Our hardened FIPS build include
- FIPS 140-3 validated encryption modules
- Real-time compliance dashboard
- Machine-readable OSCAL API (for FedRAMP 20x)
FedRAMP 20x is here. Is your compliance automated yet?
BEL offers native FIPS dashboard and industry-first OSCAL API that can be integrated with your GRC platform, as required by FedRAMP 20x.
Show me the evidence
We’ve helped companies of all sizes accelerate their path to FedRAMP Authorization To Operate (ATO)
How IntelliGRC expedited FedRAMP Moderate with Linkerd, leading to increased revenue by 4X
How Zscaler navigated their journey to achieve Rev. 5 FedRAMP authorization on Kubernetes
Buoyant Enterprise for Linkerd is dramatically reducing our time to FIPS certification, allowing us to ensure security and compliance of our customers' sensitive data.
Chris Armstrong
CIO, Medwatchers
A Practical Guide to FIPS Compliance for Kubernetes Engineers
Three Questions to Ask before Choosing a Service Mesh for FIPS
Read the blog ↗A Practical Guide to Accelerating Compliance and Security CI with SBOMs
Why FIPS for Kubernetes is challenging
FIPS 140-2 and 140-3 are the US government standards for cryptographic modules, defined by the National Institute of Standards and Technology (NIST). FedRAMP is one compliance framework that requires FIPS-validated encryption.
FIPS requires that all data transported in an application use FIPS-validated cryptographic code; it's not just a matter of flipping a configuration switch. Since most Kubernetes environments are a complex mix of open-source technologies, ensuring that the core platform, the network proxies, and every third-party add-on are all using these certified libraries is a significant challenge: if even one minor component slips through with standard commercial encryption, the entire cluster fails an audit.
Months
SC-13 requires FIPS 140-validated modules for every pod-to-pod connection inside the authorization boundary, including traffic that never leaves the cluster. Adding them service by service, by hand, stalls most authorization timelines.
FedRAMP SC-13, NIST SP 800-53
0
Inject the proxy. Every east-west connection in the cluster runs FIPS 140-validated mTLS, with both the control plane and data plane covered by BEL's FIPS-validated builds.
BEL FIPS guide, docs.buoyant.io
BEL takes care of all application communications without changing application code, taking care of one of the more challenging aspects of FedRAMP for a Kubernetes environment and allowing you to expedite your path to FedRAMP. Read the full analysis ↗
Frequently asked questions
What's the difference between FIPS 140-2 and 140-3?
Both are NIST standards for cryptographic modules; 140-2 is the current successor. BEL provides validated builds referencing both.
Does FIPS in BEL require code changes?
No. The validated builds cover the control plane and data plane, and your application is unchanged.