Cryptographic assurance, compliance readiness and governance support
Full Entropy provides independent assessment and documentation support to organizations preparing cryptographic modules, RBG implementations and KMS/HSM environments for evaluation under FIPS 140-3, Common Criteria, PCI and related schemes. Services are delivered under a documented methodology, subject to internal quality review and independence controls.
Engagements are accepted by referral. See Engagement acceptance.
Services
Service lines may be engaged individually or combined within a single statement of work, subject to scoping and independence review.
Pre-validation readiness assessment
Gap assessment of cryptographic modules against FIPS 140-3 and ISO/IEC 19790 requirements, including review of the security policy, SSP tables, approved and non-approved service indicators, and supporting design documentation prior to CST lab submission.
Entropy source and RBG documentation support
Review of entropy source documentation, health-test justification and conditioning rationale for consistency with SP 800-90A/B/C, and preparation of supporting material for ESV submissions.
Key management governance review
Assessment of CKMS policy, key hierarchy documentation, CSP/SSP handling procedures and HSM/KMS operational controls against SP 800-57, SP 800-130 and applicable PCI requirements.
Cryptographic transition planning
Development of CBOM-based inventories, deprecation registers and PQC transition roadmaps aligned with SP 800-131A, NIST IR 8547 and CNSA 2.0 timelines, for presentation to risk and audit committees.
Frameworks and schemes
Assessments are performed with reference to the current published revision of each applicable standard or program requirement.
| Domain | Reference frameworks |
|---|---|
| Cryptographic modules | FIPS 140-3; ISO/IEC 19790; ISO/IEC 24759; SP 800-140 series |
| Random bit generation | NIST SP 800-90A; SP 800-90B; SP 800-90C |
| Product evaluation | Common Criteria (ISO/IEC 15408); CEM (ISO/IEC 18045); applicable Protection Profiles |
| Key management | NIST SP 800-57; SP 800-130; SP 800-152 |
| Payment security | PCI PIN Security; PCI PTS HSM |
| Algorithm transition | SP 800-131A; FIPS 203; FIPS 204; FIPS 205; NIST IR 8547; CNSA 2.0 |
Formal validation and certification decisions remain with the relevant program authorities and accredited laboratories.
Methodology
Each engagement follows a standard lifecycle maintained under document control.
- Scoping and acceptance. Definition of the assessment boundary, applicable requirements and deliverables, followed by conflict-of-interest screening and engagement approval.
- Evidence collection. Receipt and indexing of design documentation, source extracts, test records and operational procedures under an agreed data-handling protocol.
- Assessment. Requirement-by-requirement review with findings recorded in a traceability matrix and classified by severity and evaluation impact.
- Quality review. Independent technical review of findings and draft deliverables prior to issue.
- Reporting. Issue of the assessment report and remediation register to the client's designated point of contact.
- Closure and retest. Verification of remediation evidence, reissue of the register and formal engagement closure.
Governance
Oversight of methodology, independence and engagement quality is exercised through the following standing committees.
Assurance Oversight Committee
Meets quarterly to review engagement acceptance decisions, quality metrics and escalated findings.
Independence and Impartiality Panel
Reviews conflict-of-interest declarations and approves any engagement where a prior advisory relationship exists.
Methodology Review Board
Approves revisions to assessment procedures and templates following changes to referenced standards.
- Engagement personnel complete annual independence and confidentiality attestations.
- Assessment procedures are maintained under document control with defined review and approval workflows.
- Client materials are retained only for the period specified in the engagement terms.
Publications
Internal guidance notes issued to clients under engagement.
| Reference | Title | Revision |
|---|---|---|
| FE-GN-031 | Documentation expectations for entropy source health-test justification | Rev. 3 |
| FE-GN-029 | Preparing SSP tables and service indicators for FIPS 140-3 security policies | Rev. 2 |
| FE-GN-026 | Recordkeeping considerations for DRBG reseed and error-state behavior | Rev. 4 |
| FE-GN-022 | Structuring key hierarchy documentation for CKMS policy review | Rev. 2 |
| FE-GN-019 | Evidence of zeroization for SSPs held in managed non-volatile storage | Rev. 1 |
| FE-GN-017 | Maintaining a cryptographic deprecation register for audit committee reporting | Rev. 3 |
Client sectors
Hardware manufacturers
Module vendors, HSM and secure element suppliers preparing for validation.
Financial services
Institutions operating HSM and KMS environments within PCI scope.
Public sector and contractors
Organizations subject to FIPS 140-3 procurement requirements.
Software and infrastructure providers
Vendors of cryptographic libraries, operating systems and firmware.
Engagement acceptance
Full Entropy accepts a limited number of engagements each year, primarily through referrals from existing clients and partner organizations. All prospective engagements are subject to scoping, independence review and committee approval.
We are not accepting new inquiries at this time. Referred organizations will be contacted through the referring party.
Unsolicited proposals, vendor submissions and recruitment inquiries are not accepted.