Workiva offers an Organization-level option to force the connectors to use FIPS 140-3 validated cryptography, thereby making the connection compliant with U.S. FedRAMP and Canadian Centre for Cyber Security (CCCS) requirements. This option can be toggled on and off by Organization Administrators. When enabled, it forces all connectors in all chains in the organization to use FIPS 140-3 validated cryptography for the connection.
Compliance responsibility: Workiva is responsible for providing FIPS 140-3 validated cryptography on its side of the connection; whether a given third-party system can negotiate a FIPS-compliant handshake is outside Workiva's control and is the customer's responsibility.
Changing the FIPS mode
Only a Workiva Organization Administrator can alter the FIPS mode setting, as it applies to the entire organization across all workspaces.
FIPS mode is disabled by default, and changing its status does not require editing or republishing any chains.
Enabling FIPS mode
Enabling FIPS mode applies it immediately to all chains and to any unrun commands in chains that are currently running.
To enable FIPS mode:
- Log in as an Org Admin.
- Click Chains in the left nav menu.
-
In the Chains tab, click the Profile icon in the upper right corner of the Workiva screen, and select Organization admin.
- Click the General tab.
Under Execution, the FIPS mode pulldown shows the current FIPS state. - Click the FIPS mode pulldown and select Enabled.
- In the Enable FIPS Mode? dialog, click Enable FIPS.
FIPS is immediately active.
Disabling FIPS mode
To disable FIPS mode, follow the steps provided above for enabling FIPS mode, but select Disabled instead. When you select Disabled, the change is active immediately. There is no confirmation dialog.
Note: The dropdown is disabled while the change saves. If the change is rejected, the message "Failed to update FIPS setting." is displayed.
How commands run with FIPS mode enabled
When FIPS mode is enabled, commands use the FIPS executable for the command. This occurs each time a command is prepared for a runner, so if the setting is changed while a chain is running, that change applies to any commands in the chain that have not started yet.
- Go-based connectors use separate Linux, Windows, and macOS FIPS-enabled binaries.
- Java-based connectors use a separate FIPS-enabled jar file as well as a FIPS-enabled library jar file.
How commands run with FIPS mode disabled
When FIPS mode is disabled, commands use the standard binaries or jar files.
What the Audit Log shows
Enabling or disabling FIPS mode is recorded in the standard Workiva Audit log location, accessible in Workiva by clicking the Profile icon and selecting Admin > Organization admin > Activities > Audit logs. An Audit log entry has the following values, and is written only when the value actually changes; re-selecting the current value records nothing.
| Field | Value |
|---|---|
| Summary | "Chains company FIPS mode enabled" or "Chains company FIPS mode disabled" |
| Performed By | NAME (The name of the Admin who changed the setting.) |
| Applied To (Type) | COMPANY NAME |
| Applied To (Name) | ORGANIZATION NAME |
| Action | UPDATE |
| Time | Timestamp of when the change was made. |
| IP Address | The admin's IP address in standard IP format. |
Note: You need to be a Chains Organization admin to enable FIPS in Chains and a Workiva Organization admin to access the audit logs. These are two separate roles.
Troubleshooting
- When a connection is running in FIPS mode,
(FIPS)appears next to the Connector name in the Command run log. - The command output header includes the FIPS builds, for example “(FIPS) 2.7.45”
- If a connection fails, the Command run log records the error and fails the command. Failing a command does not inherently cause the chain to fail.
- If you cannot get a FIPS connection, you have three options:
- Fix the source system.
- Connect another way.
- Leave FIPS off (the connection will still be encrypted, but not to the FIPS 140-3 standard).