A cryptographic implementation can keep working while its validation status changes. That is what the September 2026 FIPS 140-2 transition makes visible: the code and the certificate answer different questions.
NIST's transition schedule moved the remaining FIPS 140-2 certificates to the Historical List on September 22. Historical does not mean revoked. Existing federal deployments require their own risk decision; a historical certificate should not be used to justify a new federal procurement.
A claim such as “we use AES-256” leaves important information out. Validation concerns a particular module and its tested environments, with the caveats shown on its certificate.
OpenSSL illustrates the detail. Certificate 4282 lists provider versions 3.0.8 and 3.0.9, with configurations including Debian 11.5 on a Dell Inspiron 7591 and macOS 11.5.2 on an M1 Mac Mini. It is now historical. Certificate 4985 is a separate FIPS 140-3 validation. One certificate does not automatically cover whichever binary a team happens to ship.
For the next security questionnaire, record three things together: the module version actually deployed, its operating environment, and the certificate's current status. Check the relevant security policy and vendor instructions as well. A flag in a configuration file cannot answer that whole question.
The useful check is small. Take the last claim your team made and trace it to the installed module and its validation entry. If that trail stops at the name of a cipher, the claim needs more work.