MARVELL , Microsoft and Oracle have formed a working group within the Open Compute Project (OCP) to develop an open specification for a NIST FIPS 140-3 Level 3 integrated hardware security module (HSM) for cloud and hyperscale data centres. The proposed design would put a hardware security boundary, key vault and attestation chain inside servers, allowing cryptographic operations to run where data is processed. The companies say this could reduce latency, improve scalability and enable cryptographic checks of workload integrity.
The announcement, dated 13 October 2026, says many cloud and enterprise servers currently use network-connected HSMs or software-only key management. In those arrangements, keys may have to cross a network or be held in memory that is not protected to FIPS 140-3 Level 3, potentially exposing them to attack. The planned approach is intended to keep keys within a certified hardware boundary. These are stated aims of a specification effort, not evidence that a new system is already deployed or that attacks have occurred.
Marvell, Microsoft and Oracle will work with the wider OCP community on a joint technical specification. An initial draft was targeted for release around the 2026 OCP Global Summit, with version 1.0 to follow. The companies also planned demonstrations at the summit, held in San Jose from 12 to 15 October 2026, and invited other organisations to join the working group through OCP.