Depending on your environment and installation choices, ePO - On-prem operates in FIPS mode or Mixed mode.
The mode that a ePO - On-prem server runs in is determined during installation or upgrade and can't be changed.
FIPS mode
A ePO - On-prem server runs in FIPS mode after a clean installation with FIPS mode enabled.
In FIPS mode, ePO - On-prem:
Places extra constraints on the types of security methods allowed
Performs additional tests on startup
Allows connections only from a FIPS-compliant version of the Trellix Agent
Your organization might need to use ePO - On-prem in FIPS mode if you fall into one of these categories:
You are a US Government organization required to operate FIPS 140-2 compliant cryptographic models per FISMA or other Federal, State, or local regulations.
Your organization requires the use of standardized and independently evaluated cryptographic modules per Company policy.
Don't use ePO - On-prem in FIPS mode if you fall into one of these categories:
You integrate with legacy systems or products that do not support ePO - On-prem in FIPS mode.
Your organizational polices allow you to choose which products or cryptographic modules to operate in FIPS mode. For example, an organization might elect not to operate ePO - On-prem in FIPS mode, and only operate Trellix on mobile computers in FIPS mode.
Mixed mode
For detailed instructions on configuring or recovering these modes
This mode is a standard ePO - On-prem installation not running in FIPS mode.
In Mixed mode, ePO - On-prem does not follow the constraints and tests described for FIPS mode, and is not compliant with FIPS levels of security.
Note
Your managed systems are still secure, but the certificates and Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols are different.
For specific steps on installation, upgrades, and disaster recovery in FIPS mode, see:
Installation: Install ePO - On-prem in FIPS mode
Upgrading: Upgrade from an earlier FIPS-compliant ePO - On-prem server
Disaster recovery: Restoring ePO - On-prem server in FIPS mode
To confirm that your components are correctly enforcing FIPS 140-2 mode, see FIPS 140-2 operational status in ePO.