If you need it, then you need it, but having the certification is a mildly bad sign in my opinion.
I’m not the only one with this opinion. For instance, the Microsoft Windows team seems to agree:
https://techcommunity.microsoft.com/t5/microsoft-security-ba...
Thanks for the link.
However, the whole FIPS and USG compliance in general mindset is not that; the goal instead is "be aware of ways in which your system is known to not be secure". The idea that a known flaw is better than an less-known fix is infuriating to devs, but from a business standpoint it makes some sense.
I’ve only seen them force changes were ones that weaken or remove defenses against known attacks.
I’ve never seen them require additional standard defenses, or identity and propose fixes against attacks that were not already considered and addressed by the existing system.