FIPS 140-3 support for Elastic Agent #681

Value proposition

Organizations in regulated and public-sector environments must run workloads that use FIPS-validated cryptography. As the ecosystem moves from FIPS 140-2 toward FIPS 140-3, customers need a clear, supported path on the Elastic Agent and related artifacts so they can stay compliant and reduce reliance on exceptions.

Expected outcome

• Broader eligibility for Elastic in government, defense, finance, healthcare, and other sectors with strict cryptographic baselines.
• Reduced friction for security, platform, and compliance stakeholders: alignment with industry timelines for 140-2 sunset and 140-3 adoption.

Key user stories / use cases

• As a security or compliance lead, I need our Fleet deployment to operate with FIPS 140-3-validated cryptography so our assessors and authorizing officials accept the stack under current and upcoming requirements.
• As a platform architect, I need first-class FIPS 140-3 support in Elastic Agent so I can standardize on Elastic in a FIPS-enforced environment without unsupported workarounds.
• As a federal or regulated program, I need the stack to align with FIPS 140-3 expectations so we can renew authorizations, pass crypto reviews, and de-risk dependency on sunsetting 140-2 modules and programs.