The NIST Cryptographic Module Validation Program (CMVP) is the official U.S. Government program that validates cryptographic modules to Federal Information Processing Standards (FIPS). It maintains a public, searchable database of all modules that have been tested and validated as conforming to FIPS 140-2 or FIPS 140-3. Assessors must use this authoritative source to verify an OSC's claim that their encryption module is FIPS-validated. The presence of a FIPS-approved algorithm (like AES-256) within a module is insufficient; the entire module implementation must have a current, active validation certificate listed by the CMVP.

B. FedRAMP Marketplace: This lists cloud service offerings authorized for federal government use, not the validation status of individual cryptographic modules.
C. NIST CSRC: The Computer Security Resource Center (CSRC) is a repository for NIST publications, standards, and guidelines, but it is not the database for validated modules.
D. FIPS 140-2 documentation: This is the standard document itself, which specifies the requirements for validation but does not contain a list of validated products. ---

1. NIST Special Publication 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, December 2020. Section 3.13.11, Discussion: "The FIPS 140-2 and FIPS 140-3 validated cryptographic module lists are available from NIST." This points directly to the CMVP as the source for the lists.

2. NIST Computer Security Resource Center (CSRC) Glossary, Cryptographic Module Validation Program (CMVP). The definition explicitly states the CMVP "maintains the FIPS 140-1 and FIPS 140-2 validated modules list." (Available at: https://csrc.nist.gov/glossary/term/cmvp)

3. NIST CMVP Official Website, Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules. The program's main page provides access to the searchable database of validated modules. (Available at: https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search)