Federal agencies and cloud service providers in the federal systems space are required to use FIPS-validated cryptography to protect sensitive data. This mandate is codified through federal laws, regulations, and frameworks for protecting data at rest and in transit. In practice, this means that any encryption employed to secure federal information must be performed by cryptographic modules that have been tested and validated under NIST’s Cryptographic Module Validation Program (CMVP). Simply using strong algorithms like AES or SHA-256 is not sufficient as the implementation of the underlying cryptographic module which provides those algorithms must be formally validated.

The purpose of the AFIPS Model is to provide a clear and repeatable structure for mapping Federal Information Processing Standards (FIPS) 140 validated cryptography to real systems. AFIPS focuses on how cryptography is selected, enforced, and evidenced across operating systems, validated modules, runtimes, applications, data services, networks, and key management. It is meant for architects, practitioners, and assessors who must align modern delivery practices with FIPS 140 requirements.