Oracle joins open cloud security push to help standardize integrated hardware security modules for regulated workloads

Oracle is participating in a new industry effort to standardize how cloud systems implement hardware-based cryptography for regulated security and compliance needs. The effort, organized through the Open Compute Project, brings together Marvell Technology, Microsoft, and Oracle to establish an open working group focused on cloud security and testing.

The group is intended to define open specifications for integrated hardware security modules (HSMs), specifically targeting NIST FIPS 140-3 Level 3. HSMs are devices or components designed to securely generate, store, and manage cryptographic keys. Level 3 is a certification tier under the U.S. National Institute of Standards and Technology (NIST) framework that is generally associated with stronger tamper resistance than lower levels, which matters for workloads that require higher assurance.

In practical terms, the working group is expected to focus on “integrated” HSM designs, meaning security functions embedded into broader systems rather than delivered only as standalone security hardware. That distinction matters for cloud deployments because integrated designs can affect performance, availability, and how consistently security controls can be tested across hardware and software stacks.

The announcement also highlights a “security working group” with a testing orientation, suggesting the participants are aiming not only for a specification, but also for common ways to validate whether cloud implementations meet the intended security requirements. For vendors and cloud operators, consistent testing artifacts and requirements can reduce integration friction and speed up qualification cycles for enterprise and government customers.

Oracle’s involvement indicates its continued push to participate in open infrastructure efforts that define standards across the data center ecosystem. As cloud security requirements become more explicit in procurement and compliance frameworks, vendors often benefit from participating in the interoperability and certification conversations early rather than later, when customers have already selected architectures.

Industry-wide, the effort sits at the intersection of three trends: accelerating adoption of cloud infrastructure, a growing emphasis on auditable security controls, and the move toward hardware-backed security that can be verified against recognized standards. By tying its working group to NIST FIPS 140-3 Level 3, the participants appear to be anchoring the work in a widely referenced compliance reference point.

What remains unclear is how quickly a final set of specifications will emerge, and whether the group will translate the initial work into widely used test suites and certification pathways across multiple hardware platforms. The public report characterizes the initiative at the level of forming a working group and setting the target scope, but it does not provide a detailed timeline, membership roster, or specific deliverables beyond the goal of defining open integrated HSM specifications aligned with FIPS 140-3 Level 3.