Veeam and FIPS 140-2 Compliance Clarification

[tim_829]

So, I need some clarification of Veeam and FIPS 140-2 Compliance.

Are all versions from Veeam Backup & Replication 9.5 Update 4 and newer compliant or is there a "special" Federal version you have to download and install? The https://www.veeam.com/federal.html page almost makes it sound like there's different version.

If anything on or above 9.5 Update 4 is, what makes it compliant? Does it just mean that algorithms used for the network traffic encryption and the "at rest" encryption now meet the standards to make it FIPS 140-2 Compliant?

Any clarification would be appreciated! Thanks

[Gostev]

Yes, there's in fact a special U.S. Federal build, particularly because there are performance implications of using FIPS-certified modules... from what I remember, they perform a bunch of extra checks which slow things down, for example validating its own integrity etc.

This build is not available for public download, so you should contact your Veeam sales rep for delivery.

Thanks.

[tim_829]

Thanks for the response, I'll contact our Veeam Rep.

[squebel]

This post is obviously 3.5 years old at this point and we're all the way up to version 12.1 now but is there still any truth to this that there is some special build that we need to obtain?

[Gostev]

Starting from V11, we use our FIPS-certified modules also for the standard product build.