Notifications
Clear all
Topic starter
10/07/2026 9:20 pm
TL;DR: AlmaLinux’s certification work shows how FIPS 140-3 and Common Criteria are becoming procurement signals for enterprise Linux, especially where public sector, defence, finance, and healthcare buyers require stronger assurance, according to Cybertrust Japan. Security teams should treat OS certification as part of supply chain trust and deployment governance, not as a substitute for hardening or lifecycle controls.
NHIMG editorial — based on content published by Cybertrust Japan: AlmaLinux's FIPS 140-3 and Common Criteria certification value for enterprise trust
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams use certified operating systems in regulated environments?
A: Use certification as evidence that a platform meets a defined assurance baseline, then test whether the live deployment preserves that baseline.
Q: Why do FIPS and Common Criteria matter to identity and access teams?
A: They matter because the operating system underpins privileged administration, certificate handling, and workload execution.
Q: What do organisations get wrong about platform certification?
A: The most common mistake is treating certification as a universal security guarantee.
Practitioner guidance
- Separate certification from deployment assurance Document exactly which security properties FIPS 140-3 or Common Criteria cover, then map the remaining risks to patching, hardening, logging, and access control.
- Tie OS trust to privileged access policy Require platform teams to show how certified systems support administrative access, certificate handling, and workload identity boundaries.
- Use certification claims in supplier due diligence Ask vendors and internal platform owners for the exact version, evaluation scope, and operating conditions tied to the certification.
What's in the full article
Cybertrust Japan's full blog post covers the operational detail this post intentionally leaves for the source:
- A breakdown of what FIPS 140-3 and Common Criteria mean in practice for Linux distribution evaluation.
- The specific certification milestones AlmaLinux is pursuing and how they relate to enterprise procurement needs.
- Discussion of why buyers in government, defence, finance, and healthcare weigh certification in platform selection.
- Context from the AlmaLinux community event and the trust arguments presented by the speakers.
👉 Read Cybertrust Japan's analysis of AlmaLinux, FIPS 140-3, and Common Criteria →
FIPS 140-3 and common criteria on Linux: what changes for trust?
Explore further
10/07/2026 9:42 pm
Certification is a trust signal, not a security outcome. FIPS 140-3 and Common Criteria can improve buyer confidence, especially in regulated environments, but they do not prove that a deployed system is hardened, monitored, or resilient. Procurement teams sometimes collapse assurance into security, which creates a governance gap between formal validation and actual operating risk. The practical conclusion is that certification should support, not replace, security architecture decisions.
A question worth separating out:
Q: Who should decide whether a certified Linux distribution is enough?
A: Procurement, security architecture, and platform owners should decide together, because the answer depends on the workload. Regulated systems, identity services, and high-value automation often need certification plus compensating controls. The decision should be based on evidence of control coverage, not on the certification label alone.
👉 Read our full editorial: FIPS 140-3 and common criteria reshape Linux trust signals
