Skip to main content
Comply Defense
Category: Cryptography & Encryption

National Voluntary Laboratory Accreditation Program

Also known as:
Simply put

NVLAP is a program run by NIST that reviews testing and calibration laboratories and, when they meet the required standards, grants them formal accreditation. This accreditation is a third-party confirmation that a laboratory is competent to perform specific types of tests. It helps organizations trust that results from an accredited lab meet recognized quality standards.

Formal definition

The National Voluntary Laboratory Accreditation Program (NVLAP) is a NIST-administered program that provides third-party accreditation to testing and calibration laboratories. According to the evidence, NVLAP accreditation is based on ISO/IEC 17025 and demonstrates that a laboratory is technically competent to perform specific tests within a defined scope of accreditation. Accreditation is granted per defined scope rather than as a blanket approval, and it is subject to ongoing status changes, as NVLAP maintains listings of laboratories with suspended or terminated accreditation. Readers should note that laboratory accreditation attests to technical competence for specified test methods and does not, by itself, satisfy any particular federal, defense, or CUI-related security or compliance requirement; applicability to a given program should be verified against current authoritative NIST sources and the relevant governing requirements.

Why it matters

For compliance officers and security managers in the defense and public sector space, NVLAP accreditation provides a recognized, third-party basis for trusting that a laboratory is technically competent to perform specific test methods. Because accreditation is granted by NIST against the ISO/IEC 17025 standard, it offers an independent signal of laboratory competence rather than relying solely on a laboratory's self-assertion. This matters when program requirements or acquisition decisions depend on results produced by an accredited testing or calibration laboratory.

A critical distinction is that laboratory accreditation attests to technical competence for specified test methods within a defined scope, and does not by itself satisfy any particular federal, defense, or CUI-related security or compliance requirement. Treating NVLAP accreditation as though it establishes broader compliance, or as a blanket approval covering tests outside a laboratory's listed scope, is a common error. Accreditation is scope-specific: a laboratory accredited for one type of test is not thereby competent or authorized for others.

Accreditation status is also not permanent. NVLAP maintains listings of laboratories with suspended or terminated accreditation, so relying on a prior credential without confirming current status can lead to accepting results from a laboratory that is no longer accredited. Organizations should verify a laboratory's current accreditation and applicable scope against authoritative NIST sources, and confirm how, if at all, that accreditation maps to the specific governing requirements of their program.

Who it's relevant to

Compliance officers and auditors
Those who must evaluate whether test or calibration results come from a competent, independently accredited source. They should confirm that a laboratory's accreditation covers the specific test method at issue and verify current accreditation status, recognizing that NVLAP accreditation does not by itself satisfy a particular federal, defense, or CUI-related requirement.
Government contractors and acquisition personnel
Contractors and buyers who rely on laboratory-produced results in support of products or services. They should check that a laboratory holds current NVLAP accreditation within the applicable scope, and separately verify how that accreditation maps to the governing requirements of their specific program.
Information system security managers and authorizing officials
Personnel who may encounter NVLAP-accredited laboratory results as inputs to broader assurance activities. They should treat accreditation as evidence of technical competence for specified test methods, not as a substitute for the security or compliance authorizations their systems require.

Inside NVLAP

NVLAP (National Voluntary Laboratory Accreditation Program)
A laboratory accreditation program administered by the National Institute of Standards and Technology (NIST) that provides third-party assessment of the competence of testing and calibration laboratories against established criteria. Participation is generally voluntary, though specific programs may require it as a condition of performing certain testing.
Accreditation Criteria
NVLAP accreditation is generally based on internationally recognized standards for laboratory competence, such as ISO/IEC 17025, supplemented by program-specific technical requirements. Readers should verify the current criteria against official NIST NVLAP documentation, as specific requirements vary by program and revision.
Laboratory Accreditation Programs (LAPs)
NVLAP organizes its work into distinct laboratory accreditation programs, each covering a particular field of testing or calibration. Accreditation is granted for a defined scope rather than as a blanket endorsement of the laboratory.
Scope of Accreditation
Each accredited laboratory receives a defined scope specifying the tests, methods, or calibrations it is competent to perform. Accreditation does not extend beyond the stated scope, and readers should confirm a laboratory's specific scope before relying on its results.
Relationship to Cryptographic and Security Testing
NVLAP accredits laboratories that perform certain security-related testing, including laboratories that participate in NIST-associated validation activities. The precise programs and their current requirements should be verified against official NIST sources, as they change across revisions.

Common questions

Answers to the questions practitioners most commonly ask about NVLAP.

Does NVLAP accreditation mean a laboratory is authorized to issue CMMC certifications?
No. NVLAP accreditation and CMMC certification authority are distinct and should not be conflated. NVLAP is the National Voluntary Laboratory Accreditation Program administered by NIST, which accredits laboratories against recognized standards for testing and calibration competence. Authorization to conduct CMMC assessments and issue certifications flows through the CMMC accreditation ecosystem overseen by its Accreditation Body, not through NVLAP. Readers should verify current CMMC assessment authorization requirements against official DoD and CMMC Accreditation Body sources, as these are separate from NVLAP scope.
Is NVLAP accreditation a one-time approval that remains valid indefinitely?
No. NVLAP accreditation is generally time-bound and subject to periodic reassessment and renewal, in most implementations involving continued conformance to the applicable accreditation criteria. It should not be treated as a permanent status. A laboratory must typically maintain its competence and undergo continued oversight to retain accreditation. Confirm the current renewal cycle, scope, and any conditions against the official NVLAP program documentation.
How can I confirm that a laboratory currently holds NVLAP accreditation for a specific scope?
NVLAP accreditation is generally granted for a defined scope, so a laboratory accredited for one type of testing is not necessarily accredited for another. Verify both the accreditation status and the specific scope through NIST's official NVLAP directory or the laboratory's current accreditation documentation. Do not assume that accreditation in one area extends to unrelated testing or evaluation activities.
What is the relationship between NVLAP accreditation and cryptographic module validation programs?
NVLAP accredits laboratories that may perform testing under certain NIST-administered programs; the validation of a product or module itself is a separate outcome from the accreditation of the testing laboratory. In other words, laboratory accreditation attests to the lab's competence, while product validation is issued through the applicable validation program. Readers should confirm the current structure, participating laboratories, and validation processes against official NIST program sources rather than assuming accreditation equals product validation.
Does using an NVLAP-accredited laboratory satisfy my organization's compliance obligations?
Not by itself. Engaging an NVLAP-accredited laboratory addresses the competence of the testing entity, but it does not automatically satisfy broader compliance obligations under frameworks such as FISMA, the RMF, FedRAMP, or DFARS-based requirements. Accreditation should be understood as one component within a larger compliance and authorization picture. Confirm your specific contractual and regulatory obligations against current authoritative sources, as accreditation is not a substitute for meeting those distinct requirements.
Where should I look to confirm the current criteria and standards NVLAP applies?
NVLAP is administered by NIST, so the authoritative source for its current criteria, applicable standards, and program handbooks is NIST's official NVLAP documentation. Because program criteria and referenced standards can change across revisions, verify the applicable version at the time of engagement rather than relying on prior editions. This entry does not cover implementation specifics or agency-tailored requirements, which readers must confirm independently.

Common misconceptions

NVLAP accreditation means a laboratory's test results are automatically accepted for all compliance and authorization purposes.
NVLAP accreditation attests to a laboratory's demonstrated competence within a defined scope; it is not itself an authorization or a guarantee that results satisfy any particular agency's compliance, contractual, or authorization requirements. Acceptance depends on the specific program, scope, and the accepting authority's rules, which the reader must confirm against current official sources.
NVLAP is a mandatory, government-wide requirement for all laboratories.
NVLAP is generally a voluntary accreditation program administered by NIST. While participation may be required as a condition of certain specific testing programs, it is not a universal mandate, and obligations can differ by program and by agency.
Accreditation and validation are the same thing.
Accreditation assesses a laboratory's competence to perform testing within a defined scope, whereas validation refers to a determination about a specific product, module, or algorithm. A laboratory being accredited does not by itself mean any given product it tests is validated or approved; these are distinct outcomes.

Best practices

Verify a laboratory's current accreditation status and defined scope directly against official NIST NVLAP records before relying on its testing for any compliance purpose.
Confirm the specific accreditation criteria and program requirements applicable to your testing need against current official NIST documentation, since criteria and program details change across revisions.
Distinguish accreditation of a laboratory from validation or authorization of a product or system, and do not assume one confers the other.
Confirm with the accepting authority (for example, the relevant agency, program office, or authorizing official) whether NVLAP-accredited test results satisfy your particular compliance, contractual, or authorization obligations.
Document the exact scope of accreditation relied upon so that reliance is limited to the tests and methods the laboratory is actually accredited to perform.
Treat NVLAP accreditation as a point-in-time status subject to change, and periodically re-verify current status rather than assuming continued accreditation.