A financial services company is migrating a payment processing application to a public cloud IaaS provider. Regulatory requirements mandate that the cryptographic modules used to protect and store encryption keys be independently certified to a U.S. government standard for physical and logical security of cryptographic hardware. Which certification should the security architect require the cloud provider's key management hardware to hold?