The 542-Day Wait to Sell to the Government

Somewhere in a validation database today, a whole generation of certificates quietly became history. As of 21 September 2026, the Cryptographic Module Validation Program declares every remaining active FIPS 140-2 certificate historical. From today, a vendor cannot use one to support a new acquisition by a US federal organisation.

No product broke. No code changed. The cryptography inside those modules is exactly as sound as it was yesterday. What expired was permission.

The paperwork is load bearing

FIPS 140-2 is not one checkbox among many. It is the cryptography baseline that Common Criteria, FedRAMP, DoDIN APL, CMMC, CSfC, FISMA, NIST SP 800-53 and NIST SP 800-171 all quietly reference. Think of it as the electrical code that a dozen separate building inspections point back to. Change the code once, and every inspection downstream changes with it, whether or not the inspectors mention it by name.

So the interesting number is not the deadline. It is the queue behind it. Average validation time under FIPS 140-2 ran about 367 days. Under FIPS 140-3 it has risen to 542 days, a 42 percent increase. A vendor who starts the process today is realistically looking at October 2027 before it can support new federal business again.

One honesty note, because it matters. The loudest write-up of this deadline comes from SafeLogic, a company that sells a product solving exactly this problem. The transition date itself is long published CMVP policy and I would treat it as solid. The no time left urgency around it is interested commentary, and I could not pull the CMVP notice independently.

And in the same month, a gate opened

Here is the part that makes September strange. While the cryptography gate was closing, the cybersecurity assessment gate swung open.

The Department of Defense suspended CMMC Phase 2 on 13 July 2026, ahead of its scheduled 10 November start, pending a review. That was a memo. On 3 September, John Tenaglia, the Department's Principal Director for Defense Pricing, Contracting and Acquisition Policy, signed Revision 3 of DARS class deviation 2026-O0025, which turns that suspension into binding acquisition regulation. Contracting officers are now instructed to strip CMMC third party assessment requirements out of contracts and to look to the Revolutionary FAR Overhaul instead.

The distinction is the whole story. A suspension memo is policy and can be reversed by announcement. A class deviation is regulation, and undoing it requires regulatory action. Third party cybersecurity assessment was the single largest fixed cost between a small software company and a defense subcontract. Right now it is not required.

Put the two together and the picture is oddly precise. The assessment gate opened. The cryptography gate closed. Anyone treating either as permanent is making a bet on paperwork, which is the one thing in this industry that reliably changes without a press release.

Capability has become the cheap half of the problem. Permission is the expensive half, and it is priced in months.

Being better is not the same as being allowed

If you want proof that the barrier has moved from engineering to procedure, look at what happened at the Department of Homeland Security last week.

DHS finalised Anduril's addition to track one of its 1.5 billion dollar counter drone contract vehicle on 16 September. Anduril had originally won only track two in the August award. It protested the track one evaluation, DHS agreed to re-evaluate, and GAO dismissed the protest three weeks after filing. Anduril, BAE Systems' US subsidiary and Leidos are now the only three companies holding positions on both halves of the five year vehicle.

DHS received 57 proposals for the product portion and 47 for services. That is not an emerging market with room to wander into. And notice how the last position was won: not by a better demo, but by having the legal capacity and the patience to force a re-evaluation. In the same week, Oasis filed a protest over the Army's counter drone award to Parsons, alleging conflicts. Protest capability is now a competency, and it is one a ten person team does not have.

One door, and the list that moved out of it

The front door has also narrowed. A memorandum from Secretary of Defense Pete Hegseth on 29 June 2026 designated the Defense Innovation Unit as the Pentagon's primary liaison with commercial companies across all unmanned and autonomous systems programs, reportedly a portfolio in the region of 75 billion dollars. Meanwhile the Blue UAS Cleared List, which DIU created in 2020, moved to the Defense Contract Management Agency in December 2025 with 39 certified systems and 165 certified components at handoff. DIU still shapes the standards.

Standards setting and list administration are now deliberately separate organisations. One writes what good means, the other checks whether you meet it. One door genuinely lowers discovery cost for a small company. It also removes the second opinion: one door is one place to be rejected, with nowhere to shop the same product afterward.

The 165 components number is the encouraging one. The list is not only about complete aircraft. Certification at the component level is a real path for a team that builds one piece well.

Why this matters even if you never touch defense

Every regulated market has a version of this clock. Capability is compressing fast. Certification is not compressing at all, and in this case it got 42 percent slower. When those two run at different speeds, the winner is rarely the team with the best technology. It is the team that designed around the calendar: shipping as a component inside somebody else's already accredited environment, rather than as a standalone product waiting 542 days for its own stamp.

The second lesson is about windows. The CMMC suspension is real, binding and temporary by construction. Building a business model on it is the same mistake as pricing your margins off a promotional API rate. Use the window. Do not depend on it.

None of this will trend. A certificate quietly going historical is not a launch. But it decides who is allowed to sell, which is a more durable fact than most of what did trend this week.