Standards & Regulations

How the OCM CLI and OCM controller relate to security standards and regulations, starting with FIPS 140-3 cryptography.

This section describes how the OCM CLI and the OCM controller relate to security standards and regulations. OCM does not give compliance guarantees: whether a deployment meets a standard depends on more than OCM.

  • FIPS 140-3: the Go Cryptographic Module in the OCM binaries, runtime modes, digest algorithms, and external signing binaries (cosign, gpg).
FIPS 140-3
Reference for FIPS 140-3 support in the OCM CLI and OCM controller: support policy, Go FIPS module, runtime modes, artifacts, and known limitations.