NIST SP 800-79r3 ipd: Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Analyze & explore related research in Conceptio
Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.
1 2
3 4 5
NIST Special Publication NIST SP 800-79r3 ipd
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
6 7
Initial Public Draft
8 9 10 11
Hildegard Ferraiolo Andrew Regenscheid Sarbari Gupta Nabil Ghadiali
12 13 14 15
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-79r3.ipd
16 17
18 19 20 21 22 23 24 25 26 27 28 29 30 31
NIST Special Publication NIST SP 800-79r3 ipd
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers Initial Public Draft Hildegard Ferraiolo Andrew Regenscheid
Computer Security Division Information Technology Laboratory
Sarbari Gupta Nabil Ghadiali
Electrosoft Services, Inc.
32 33
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-79r3.ipd
34
December 2023
35 36 37
U.S. Department of Commerce Gina M. Raimondo, Secretary
38 39
National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
40 41 42 43
Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose.
44 45 46 47 48 49
There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
50 51 52
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
53 54 55 56 57 58 59 60 61 62 63 64 65
Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.
66 67 68
NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax
69 70 71
Publication History Approved by the NIST Editorial Review Board on YYYY-MM-DD [Will be added to final publication.] Supersedes NIST Series XXX (Month Year) DOI [Will be added to final publication.]
72 73 74 75
How to Cite this NIST Technical Series Publication: Ferraiolo H, Regenscheid A, Gupta S, Ghadiali N (2023) Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-79r3 ipd. https://doi.org/10.6028/NIST.SP.800-79r3.ipd
76 77 78 79 80
NIST Author ORCID iDs Hildegard Ferraiolo: 0000-0002-7719-5999 Andrew Regenscheid: 0000-0002-3930-527X Sarbari Gupta: 0000-0003-1101-0856 Nabil Ghadiali: 0009-0008-0874-3817
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
81 82
Public Comment Period December 13, 2023 - January 29, 2024
83 84 85 86 87 88
Submit Comments piv_comments@nist.gov
89
All comments are subject to release under the Freedom of Information Act (FOIA).
National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
90
Abstract
91 92 93 94 95 96 97
The document provides appropriate and useful guidelines for assessing the reliability of issuers of PIV Cards and derived PIV credentials. These issuers store personal information and issue credentials based on OMB policies and the standards published in response to HSPD-12. The reliability of an issuer is of utmost importance when an organization (e.g., a federal agency) is required to trust identity credentials that were created and issued by another organization. This trust relies on having the necessary level of assurance that the reliability of the issuing organization has been established through a formal authorization process.
98
Keywords
99 100
assessment; authorization; compliance; derived PIV credentials; HSPD-12; issuer controls; personal identity verification; PIV Card.
101
Reports on Computer Systems Technology
102 103 104 105 106 107 108 109 110 111
The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
112
i
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
113
Note to Reviewers
114 115 116 117 118 119
NIST SP 800-79r3 ipd, Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers, expands the set of issuer controls to include new and updated requirements from FIPS 201-3, its supporting updated publications (e.g., SP 800-157r1, SP 800-76r2, etc.) and newly-issued OMB Memoranda aimed at achieving compliance with federal requirements with regard to identity proofing and the issuance of a common and reliable form of a primary and derived identity credential.
120
NIST is specifically interested in comments on and recommendations for the following topics:
121 122
1. Are the new and updated controls for identity proofing and the issuance and maintenance of PIV Cards and derived PIV credentials clear and practical to implement?
123 124
2. Is it easy to determine where the updated controls need to be implemented (i.e., at the enterprise level, issuing facility level, or both)?
125 126
3. Are the new controls for derived PIV credentials sufficient to provide comparable assurance for PIV Cards?
127 128 129 130 131
NIST requests that all comments be submitted by 11:59 p.m. Eastern Standard Time (EST) on January 29, 2024. Please submit comments to piv_comments@nist.gov. NIST will review all comments and make them available on the NIST Computer Security Resource Center (CSRC) website. Commenters are encouraged to use the comment template provided on the NIST CSRC website.
132
Trademark Information
133
All registered trademarks or trademarks belong to their respective organizations.
134
ii
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
135
Call for Patent Claims
136 137 138 139 140 141
This public review includes a call for information on essential patent claims (claims whose use would be required for compliance with the guidance or requirements in this Information Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be directly stated in this ITL Publication or by reference to another publication. This call also includes disclosure, where known, of the existence of pending U.S. or foreign patent applications relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.
142 143
ITL may require from the patent holder, or a party authorized to make assurances on its behalf, in written or electronic form, either:
144 145
assurance in the form of a general disclaimer to the effect that such party does not hold and does not currently intend holding any essential patent claim(s); or
146 147 148
assurance that a license to such essential patent claim(s) will be made available to applicants desiring to utilize the license for the purpose of complying with the guidance or requirements in this ITL draft publication either:
149
under reasonable terms and conditions that are demonstrably free of any unfair discrimination; or
150 151
without compensation and under reasonable terms and conditions that are demonstrably free of any unfair discrimination.
152 153 154 155 156
Such assurance shall indicate that the patent holder (or third party authorized to make assurances on its behalf) will include in any documents transferring ownership of patents subject to the assurance, provisions sufficient to ensure that the commitments in the assurance are binding on the transferee, and that the transferee will similarly include appropriate provisions in the event of future transfers with the goal of binding each successor-in-interest.
157 158
The assurance shall also indicate that it is intended to be binding on successors-in-interest regardless of whether such provisions are included in the relevant transfer documents.
159
Such statements should be addressed to: piv_comments@nist.gov.
160
iii
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Table of Contents Executive Summary ............................................................................................................1 Introduction ..................................................................................................................3 Applicability, Intended Audience, and Usage ........................................................... 5 Requirements, Notations, and Conventions ............................................................. 5 Organization of This Publication ...............................................................................5 Preparation for Assessment and Authorization ........................................................ 7 Organization ............................................................................................................7 Issuer .......................................................................................................................7 Issuing Facilities.......................................................................................................8 Outsourcing Issuing Facilities...................................................................................8 Assessment and Authorization .................................................................................9 Authorization Boundary of the Issuer ..................................................................... 10 Issuer Roles and Responsibilities........................................................................... 11 2.7.1. Senior Authorizing Official (SAO) ..................................................................... 11 2.7.2. Designated Authorizing Official (DAO).............................................................. 12 2.7.3. Enterprise Identity Management Official (EIMO)............................................... 12 2.7.4. Issuing Facility Manager ................................................................................... 12 2.7.5. Operator ...........................................................................................................12 2.7.6. Assessor ..........................................................................................................13 2.7.7. Applicant Representative (AR) ......................................................................... 13 2.7.8. Privacy Official (PO) ......................................................................................... 13 2.7.9. Role Assignment Policies ................................................................................. 13 2.7.10. Assessment and Authorization Roles ............................................................... 14 Relationship Between SP 800-79 and SP 800-37 .................................................. 14 Preparing for the Assessment of an Issuer............................................................. 15 2.9.1. Issuer Duties .................................................................................................... 15 2.9.2. Assessment Team Duties ................................................................................ 16 Authorization Decision ........................................................................................... 16 2.10.1. Authorization to Operate (ATO) ........................................................................ 17 2.10.2. Interim Authorization to Operate (IATO) ........................................................... 18 2.10.3. Denial of Authorization to Operate (DATO) ...................................................... 18 2.10.4. Authorization Impact of Information Systems Under SP 800-37 ....................... 19 Use of Risk in the Authorization Decision ............................................................... 19 Authorization Submission Package and Supporting Documentation ...................... 20 Taxonomy of Issuer Controls.................................................................................... 22
iv
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Introducing Issuer Controls .................................................................................... 22 Implementing Issuer Controls................................................................................. 24 3.2.1. Issuer Controls Implemented at the Organizational or Facility Level................. 25 Issuer Controls Assessment and the Authorization Decision Process ................. 26 Assessment Methods ............................................................................................. 27 Issuer Assessment Report ..................................................................................... 29 Assessment and Authorization Life Cycle ............................................................... 31 Initiation Phase ...................................................................................................... 31 Assessment Phase ................................................................................................ 34 Authorization Phase ............................................................................................... 37 Monitoring Phase ................................................................................................... 39 References ........................................................................................................................41 Appendix A.
Acronyms.................................................................................................. 44
Appendix B.
Glossary .................................................................................................... 46
Appendix C.
Issuer Readiness Review Checklist ........................................................ 50
Appendix D.
Operations Plan Templates ..................................................................... 52
D.1. Operations Plan Template for PIV Card Issuers ..................................................... 52 D.2. Operations Plan Template for Derived PIV Credential Issuers ............................... 55 Appendix E.
Assessment Report Template ................................................................. 58
Appendix F.
Sample Transmittal and Decision Letters............................................... 59
Appendix G.
Issuer Controls and Assessment Procedures ....................................... 63
G.1. Controls and Assessment Procedures for PCIs...................................................... 63 G.2. Controls and Assessment Procedures for DPCIs ................................................... 90 Appendix H.
Assessment and Authorization Tasks .................................................. 108
Appendix I.
Revision History ..................................................................................... 111
222
List of Tables
223 224 225 226 227 228 229 230 231 232 233 234 235
Table 1. IATs and associated authorization focus areas ...........................................................23 Table 2. Sample IAT, authorization focus area, and issuer controls (PCI).................................24 Table 3. Sample IAT, authorization focus area, issuer control, and applicability (DPCI)............24 Table 4. Sample issuer controls with assessment procedures (DPCI) ......................................28 Table 5. Issuer readiness review checklist ................................................................................50 Table 6. Preparation and Maintenance of Documentation for PCIs ...........................................63 Table 7. Assignment of Roles and Responsibilities for PCIs .....................................................65 Table 8. Facility and Personnel Readiness for PCIs .................................................................66 Table 9. Protection of Stored and Transmitted Data for PCIs....................................................68 Table 10. Enforcement of Privacy Requirements for PCIs ........................................................69 Table 11. Deployed Products and Information Systems for PCIs ..............................................71 Table 12. Implementation of Credentialing Infrastructures for PCIs ..........................................71 Table 13. Sponsorship Process for PCIs ..................................................................................74 v
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260
Table 14. Identity Proofing/Registration Process for PCIs .........................................................75 Table 15. Adjudication Process for PCIs ...................................................................................78 Table 16. Card Production Process for PCIs ............................................................................79 Table 17. Activation/Issuance Process for PCIs........................................................................81 Table 18. Maintenance Process for PCIs ..................................................................................83 Table 19. Preparation and Maintenance of Documentation for DPCIs ......................................90 Table 20. Assignment of Roles and Responsibilities for DPCIs ................................................91 Table 21. Facility and Personnel Readiness for DPCIs .............................................................92 Table 22. Protection of Stored and Transmitted Data for DPCIs ...............................................94 Table 23. Enforcement of Privacy Requirements for DPCIs ......................................................95 Table 24. Deployed Products and Information Systems for DPCIs ...........................................97 Table 25. Implementation of Credentialing Infrastructures for DPCIs ........................................99 Table 26. Sponsorship Process for DPCIs ..............................................................................101 Table 27. Identity Proofing/Registration Process for DPCIs ....................................................101 Table 28. Activation/Issuance Process for DPCIs ...................................................................101 Table 29. Maintenance Process for DPCIs .............................................................................104 Table 30. Initiation Phase, Task 1: Preparation.......................................................................108 Table 31. Initiation Phase, Task 2: Resource identification .....................................................108 Table 32. Initiation Phase, Task 3: Operations plan analysis and acceptance ........................108 Table 33. Assessment Phase, Task 4: Issuer control assessment ..........................................109 Table 34. Assessment Phase, Task 5: Assessment documentation .......................................109 Table 35. Authorization Phase, Task 6: Authorization decision ...............................................109 Table 36. Authorization Phase, Task 7: Authorization documentation .....................................109 Table 37. Monitoring Phase, Task 8: Operations plan update .................................................110 Table 38. Monitoring Phase, Task 9: Annual life cycle walkthrough ........................................110
261
List of Figures
262 263 264 265 266
Fig. 1. Outsourcing issuer functions ........................................................................................... 9 Fig. 2. Issuer assessment and authorization roles ....................................................................14 Fig. 3. Authorization submission package .................................................................................21 Fig. 4. Sample issuer control assessment result (PCI) ..............................................................30 Fig. 5. Assessment and authorization life cycle phases ............................................................31
267
vi
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
268
Acknowledgments
269 270 271 272 273 274 275
The authors — Hildegard Ferraiolo and Andrew Regenscheid of NIST and Sarbari Gupta and Nabil Ghadiali of Electrosoft Services, Inc. — gratefully acknowledge the contributions of Dennis Branstad, Alicia Clay, Joan Hash, Ramaswamy Chandramouli, Jason Mohler, Dennis Bailey, and Scott Shorter, who co-authored prior versions of this publication. The authors also gratefully acknowledge and appreciate the many contributions from the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication.
vii
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
276
Executive Summary
277 278 279 280 281 282 283 284 285 286
Homeland Security Presidential Directive 12 [HSPD-12] established a policy for the creation, issuance, and use of personal identification credentials to identify federal employees and contractors securely and reliably. In response, NIST developed and published FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS201], as well as several NIST Special Publications (SPs) to provide additional specifications and supporting information. Together, these documents provide a foundation for standardizing the processes related to the adoption and use of government-wide personal identification credentials as a means to verify the identities of credential holders. The implementation of PIV specifications involves the collection, protection, and dissemination of personal information, which itself requires privacy protection.
287 288 289 290 291 292 293
In light of the requirements for both improved security and the protection of personal privacy, [HSPD-12] established four control objectives, one of which includes the call for forms of identification that are “issued by providers whose reliability has been established by an official accreditation process.” In response, Appendix A.1 of [FIPS201] specifies that NIST “…develop a new accreditation methodology that is objective, efficient, and will result in consistent and repeatable accreditation decisions…” This led to the development of SP 800-79, Guidelines for the Accreditation of Personal Identity Verification Card Issuers. 1
294 295 296 297 298 299 300
This update to SP 800-79 reflects the third revision of [FIPS201], which was published in 2022. It provides appropriate and useful guidelines for assessing the reliability of PIV Card issuers and derived PIV credential issuers, which is of utmost importance when an organization (e.g., a federal agency) is required to trust identity credentials that were created and issued by another organization (i.e., another federal agency). This trust only exists if the relying organization has the necessary level of assurance that the credential is established via a formal and reliable authorization process.
301 302 303
This SP provides an assessment and authorization methodology for verifying that issuers are adhering to the standards and implementation directives developed under [HSPD-12]. The salient features of the methodology are:
304 305
•
Controls derived from specific requirements in [FIPS201] and relevant documents for a PIV Card issuer (PCI) and a derived PIV credential issuer (DPCI)
306 307
•
Procedures for verifying and monitoring adherence to the requirements through an assessment of the implementation of the controls (i.e., control assessment)
308 309
•
Guidance for evaluating the result of an assessment in order to arrive at the authorization decision
310 311 312 313 314
Authorizing an issuer based on the assessment and authorization methodology in this document establishes the reliability of the issuer. Authorization is the basis for establishing trust in an issuer and requires that the assessment be thorough and comprehensive. Careful planning, preparation, and the commitment of time, energy, and resources are required. These guidelines are designed to assist the organization in creating the needed roles, assigning responsibilities, 1 SP 800-37-2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy [SP800-37], has deprecated the use of the term “accreditation” in favor of the term “authorization.” This is reflected in the title of the present revision.
1
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
315 316
developing an acceptable operations plan, drawing the issuer’s authorization boundary, evaluating the findings of all control assessments, and making a proper authorization decision.
317 318 319 320 321 322 323
Since organizations may vary significantly in how they choose to structure their operations, these guidelines have been developed to support organizational flexibility and minimize the effort needed to assess, authorize, and monitor the reliability of issuers. The authorization methodology also generates assessment findings and resulting authorization decisions that are consistent and repeatable. These characteristics provide assurance to an organization’s management that an issuer who has been authorized based on these guidelines can be trusted as a provider of secure and reliable identification credentials, as required by [HSPD-12].
324 325
This document shall be used by both small and large organizations (i.e., federal departments and agencies) and can be applied whether their issuance processes are:
326
•
Centrally located,
327
•
Geographically dispersed, or
328
•
Outsourced in varying degrees to other organizations or service providers.
2
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
329 330 331 332 333 334 335
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Introduction Homeland Security Presidential Directive 12 [HSPD-12], Policy for a Common Identification Standard for Federal Employees and Contractors, was issued on August 27, 2004, to enhance security, increase Federal Government efficiency, reduce identity fraud, and protect personal privacy. This Directive established a federal policy to create and use secure and reliable forms of identification for federal employees and contractors. It further defined secure and reliable forms of identification as those that:
336
•
Are issued based on sound criteria for verifying an individual’s identity;
337 338
•
Are strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation;
339
•
Can be rapidly authenticated electronically; and
340 341
•
Are only issued by providers whose reliability has been established by an official accreditation process.
342 343 344 345 346
NIST developed and published Federal Information Processing Standard (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS201], and several Special Publications that provide additional specifications in response to [HSPD-12]. These documents provide the foundation for personal identification, verification, and access control systems across the Federal Government.
347 348 349 350 351 352 353 354 355 356 357 358
To standardize the operations of PIV Card issuers, NIST developed a set of attributes to assess reliability and published the first version of SP 800-79 in July of 2005. Lessons learned through various implementation approaches, experience in credential management and PIV Card issuance, and the introduction of mobile device-integrated PIV credentials (i.e., derived PIV credentials) motivated NIST to update the set of issuer controls and associated methodology to ensure that they were objective and efficient and would result in consistent and repeatable authorization decisions. With advancements in technology and the need for flexibility, [FIPS201] expanded the set of derived credentials beyond those that are PKI-based and broadened their use to other types of devices in addition to mobile devices. The technical details for the expanded set of derived PIV credentials is specified in SP 800-157r1, Guidelines for Derived Personal Identity Verification (PIV) Credentials [SP800-157]. This revision of SP 800-79 (i.e., SP 800-79r3) reflects the updates to [FIPS201], [SP800-157], and other supporting publications.
359 360 361 362 363 364 365 366 367 368 369 370
This document uses the common term “issuer” to refer to issuers of both PIV Cards and derived PIV credentials unless it is necessary to differentiate them. An issuer is considered to be owned, managed, or outsourced (in part or as a whole) by an organization that is a federal department or agency. Ensuring the reliability of an issuer is of critical importance to establishing secure and reliable forms of identification and protecting the privacy of millions of government employees and contractors. Controlling access to physical and logical resources through the use of standard credentials provides assurance that certain predefined levels of security can be achieved. All relying-party organizations must also have confidence in the credentials that it issues to its own employees and contractors as well as those issued by other organizations. This confidence can only be established if the issuer’s functions in those other organizations are assessed and authorized. Thus, authorization of the issuer plays a key role in meeting the objectives of [HSPD-12].
3
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
371 372 373 374 375 376 377 378 379 380 381
NIST has considerable experience in developing assessment and authorization methodologies, most significantly with the widely accepted approach to authorization in SP 800-37r2 [SP80037] and its family of related documents. While [SP800-37] focuses on the authorization of the security of information systems rather than the authorization of the reliability of an issuer, it offers a practical foundation for the authorization programs envisioned by [HSPD-12]. This document utilizes the various aspects of [SP800-37] and applies them to authorizing the reliability of an issuer. The authorization of an issuer by a federal organization requires prior assessment of the security of all information systems used by that issuer in accordance with [SP800-37]. Since PIV Cards and derived PIV credentials are typically issued through the use of information systems, an assessment of their security (through the methodology in [SP800-37]) is critical for determining the ability to comply with [FIPS201] requirements.
382 383 384 385 386 387 388 389 390 391 392
One difference between the authorization of the security of information systems and the authorization of the reliability of an issuer is that an organization has considerable flexibility in how they prepare for an [SP800-37] authorization (particularly in implementing security controls) but have little room for variation when it comes to the authorization of an issuer. Much of the flexibility in [SP800-37] comes from the necessity of acceptable variations in security controls since individual information systems within varied environments may have significantly different security requirements. Conversely, the desire for standardization in [HSPD-12] has led to the development of a stable set of requirements. There may be some flexibility in how a requirement is met, but a majority of requirements must be satisfied in a uniform manner in order for an issuer to be deemed reliable. Allowing too much latitude in how a requirement is met undermines its reliability.
393 394 395 396 397 398 399 400 401 402 403
Although organizations may feel constrained by the uniformity required by [FIPS201], standardization greatly contributes to achieving the objectives of [HSPD-12] across issuer implementations. For all federal organizations to accept the PIV Cards and derived PIV credentials of other federal organizations, one set of rules (i.e., [FIPS201]) must be followed by all PIV system participants. This document provides a way to determine whether the participants are following these rules. Assessment methods that are consistent, reliable, and repeatable provide a basis for determining the reliability and capability of issuers of PIV Cards and derived PIV credentials, which herein is defined as consistent adherence to the PIV standards. In particular, if an issuer meets the requirements of [FIPS201] and relevant documents as verified through applicable assessment procedures and maintains consistency in their operations with respect to meeting these criteria, they can be considered reliable, as is required by [HSPD-12].
404
The objectives of this document are to:
405 406 407 408
•
Outline the requirements for PIV Card issuers and derived PIV credentials issuers, including the rationale for the requirements and the assessment procedures for determining the satisfaction of those requirements through a combination of policies, procedures, and operations
409 410 411
•
Describe an authorization methodology that provides a framework for organizing the requirements and assessment procedures stated above and meeting all of the control objectives stated in [HSPD-12]
412 413
•
Emphasize the role of risk associated with an authorization decision based on assessment outcomes that consider the organization’s mission
4
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Applicability, Intended Audience, and Usage
414 415 416 417
This document is applicable to and SHALL be used by all federal organizations. It may also be used by any other organization (e.g., state or local government, educational institution, non-profit group) that wishes to align with [FIPS201] and associated PIV credentials.
418 419 420 421 422
All federal organizations are required to adopt [HSPD-12] and implement [FIPS201]. They must use the methodology and issuer controls outlined in this document to assess the adequacy of their implementations as well as the reliability of the directly controlled and subcontracted services involved in creating and issuing the mandatory PIV Cards and the optional derived PIV credentials (if implemented).
423 424 425 426
This document is consistent and compatible with the control objectives in [HSPD-12], [FIPS201], [SP800-157], and [SP800-37]. It includes the roles, requirements, definitions, specifications, and procedures needed to assess the reliability of an issuing organization. If an issuer fails to meet the prescribed assessment criteria, they must immediately halt operations.
427 428
Once an issuer is authorized to operate using these guidelines, trust can be established in the issued PIV credentials throughout their life cycles.
429
Requirements, Notations, and Conventions
430
This standard uses the following typographical conventions in text:
431 432
•
Specific terms in CAPITALS represent normative requirements. When these same terms are not in CAPITALS, the term does not represent a normative requirement.
433 434 435
o The terms “SHALL” and “SHALL NOT” indicate requirements to be followed strictly in order to conform to the publication and from which no deviation is permitted.
436 437 438 439 440
o The terms “SHOULD” and “SHOULD NOT” indicate that among several possibilities, one is recommended as particularly suitable without mentioning or excluding others, that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited.
441 442
o The terms “MAY” and “NEED NOT” indicate a course of action that is permissible within the limits of the publication.
443 444 445
o The terms “CAN” and “CANNOT” indicate a material, physical, or causal possibility or capability or — in the negative — the absence of that possibility or capability. Organization of This Publication
446 447 448 449 450 451
The remainder of this publication is organized as follows: •
Section 2 provides the background information needed to understand issuer assessment and authorization methodology as well as the inputs and outputs involved in the assessment of the issuance processes. These include (i) the definition of the target entities (i.e., issuer, issuer facilities, issuer boundaries); (ii) the relationship between 5
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
452 453 454 455 456
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
authorization under [SP800-37] and authorization under this revision of SP 800-79; (iii) preparatory tasks for the assessment of an issuer organization, including the assignment of roles and responsibilities; (iv) two alternative authorization decisions; (v) the acceptance of risk in the authorization decision; and (vi) the contents of the authorization package.
457 458 459
•
Section 3 describes the building blocks of the issuer assessment and authorization methodology, including Authorization Topics, Authorization Focus Areas, and the control requirements (i.e., issuer controls) within each area.
460 461
•
Section 4 provides a detailed description of the assessment methods for the issuer controls whose outcomes form the basis for the authorization decision.
462 463
•
Section 5 describes the four phases of the authorization process and the tasks involved in each phase.
464 465
•
The References section lists all of the sources and documents referenced in this publication.
466
•
The Appendices include:
467 468 469 470 471 472 473 474 475 476
o Appendix A, Acronyms o Appendix B, Glossary
o Appendix C, Issuer Readiness Review Checklist
o Appendix D, Operations Plan Templates
o Appendix E, Assessment Report Template
o Appendix F, Sample Transmittal and Decision Letters
o Appendix G, Issuer Controls and Assessment Procedures o Appendix H, Assessment and Authorization Tasks o Appendix I, Revision History
6
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Preparation for Assessment and Authorization
477 478 479 480 481 482 483 484
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
This section presents the fundamentals of an authorization of an issuer, including (i) definitions for an issuer and issuing facility, (ii) outsourcing issuer services or functions, (iii) the differences between an assessment and authorization, (iv) the authorization boundaries of an issuer, (v) roles and responsibilities, (vi) the relationship between authorization under [SP800-37] and this revision of SP 800-79, (vii) preparing for the assessment, (viii) the types of authorization decisions, (xi) the use of risk in authorization decisions, and (x) the contents of the authorization package. Organization
485 486 487 488 489 490 491 492
An organization in the context of this document is a federal department or agency that is responsible for issuing PIV Cards and, optionally, derived PIV credentials to their employees and contractors in accordance with [HSPD-12] and [FIPS201] requirements. An organization SHALL be responsible for maintaining the enterprise identity management system (IDMS) and associated PIV identity accounts for its employees and contractors. The organization SHALL also be responsible for authorizing an issuer (Sec. 2.2) via an authorization to operate (ATO) (Sec. 2.10) prior to issuing PIV credentials.
493 494 495 496 497 498 499 500
An organization is responsible for completely describing its PIV credential issuance functions in an operations plan. This comprehensive document incorporates all of the information about the organization that is needed for any independent party to review and assess the capability and reliability of its issuance functions, as implemented by the issuers. An operations plan includes a description of the issuer’s structure, its facilities, any external service providers, roles and responsibilities, the policies and procedures that govern its operations, and a description of how the requirements of [FIPS201] are being met. A template for an operations plan is provided in Appendix D. Issuer
501 502 503 504 505 506 507 508 509 510 511 512
At the highest level, an issuer is considered to be owned by an organization (e.g., federal agency) or a private entity outsourced by the organization to provide PIV credential services. An issuer SHALL provide a full set of functions required to produce, issue, and maintain PIV Cards or derived PIV credentials for the organization. An issuer is considered operational if the organization has relevant roles and responsibilities defined and appointed; suitable policies and compliant procedures have been implemented for all relevant PIV processes, 2 including sponsorship, identity proofing/registration (to include supervised remote identity proofing, if implemented), adjudication, card/token production, activation/issuance, and maintenance; and information system components that are utilized to perform the above-mentioned functions (i.e., processes) have been assessed and shown to meet all technical and operational requirements prescribed in [FIPS201] and related documents.
513 514
In order to comply with [HSPD-12], an organization SHALL first establish an issuer to issue PIV Cards or derived PIV credentials that conforms to and satisfies the requirements of [FIPS201] Some of the processes may not apply to issuers of derived PIV credentials. For example, identity proofing is not required for the issuance of derived PIV credentials since it is a post-enrollment binding process based on the issued PIV Card and identity record previously created.
2
7
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
515 516 517 518 519 520 521 522
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
and related documents. The issuer SHALL then be authorized (i.e., using the guidelines specified in this document). An organization has certain flexibility in implementing its issuance functions, such as outsourcing some of the required processes or establishing multiple units to fulfill these processes. Regardless of its structure, the organization is responsible for the management and oversight of its issuers and SHALL maintain full responsibility as required in [HSPD-12]. Given that the issuer is responsible for issuing PIV credentials on behalf of an organization, the issuer is sometimes referred to as a Credential Service Provider (CSP). Issuing Facilities
523 524 525 526 527 528 529
An issuing facility is a physical site or location — including all equipment, staff, and documentation — that is responsible for carrying out one or more of the following PIV functions: (i) identity proofing/registration, (ii) card/token production, (iii) activation/issuance, and (iv) maintenance, including reissuance. An issuing facility operates under the auspices of a PIV Card or derived PIV credential issuer and implements the policies and procedures prescribed by the issuer for those functions sanctioned for the facility (e.g., an identity proofing/registration facility).
530 531 532 533 534 535 536 537
Based on certain characteristics (e.g., size, geographic locations, etc.), an issuer can have its services and functions provided centrally, distributed across multiple locations, or performed remotely. For example, in the case of PIV Card issuance, a geographically dispersed organization may decide to set up issuing facilities to have identity proofing/registration and activation/issuance functions performed in different parts of the country so that applicants can minimize travel. In this example, the different issuing facilities fall under the purview (i.e., policy and management) of a single issuer that encompasses all of the functions necessary to issue PIV Cards for the organization.
538
Outsourcing Issuing Facilities
539 540 541 542 543 544 545 546 547
An organization MAY outsource the issuance of PIV Cards or derived PIV credentials in part or in full. As the complexity and cost of new technologies increase, the organization may decide that the most efficient and cost-effective solution for implementing [HSPD-12] is to seek the services of an external service provider. An external service provider MAY be a federal agency, a private entity, or some other organization that offers the services or functions necessary to issue PIV Cards or derived PIV credentials. Regardless of the outsourcing arrangement, the organization is responsible for ensuring that all PIV credential issuance functions are being performed according to the approved processes for issuing an authorization to operate to an issuer (Sec. 2.10).
548 549 550 551 552 553 554
Figure 1 provides an illustration of the functions that can be outsourced. Only the organization can decide which of its employees and contractors are required to apply for a PIV Card and, optionally, a derived PIV credential (i.e., via sponsorship, wherein a responsible official of the organization provides the biographic and organizational affiliation of the applicant) and under what conditions the application will be approved (e.g., via adjudication, or the kind of background information that will form the basis for authorization to issue the PIV Card). Therefore, these two functions SHALL NOT be outsourced.
8
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
555 556
Fig. 1. Outsourcing issuer functions 3
557 558 559
An organization that outsources services must make sure that all privacy-related requirements are being met both internally and by every external service provider used as part of the PIV credential issuance function.
560 561 562 563 564 565 566 567 568
If an organization is considering using PIV or derived PIV services set up by another organization’s issuer, the operations plan and associated documents — including the authorization decision and evidence that the issuer is complying with [FIPS201] requirements — SHALL be reviewed by the designated authorizing official (DAO) of the organization requesting these services. Similarly, if an issuer is selectively using the services of an external service provider for one or more of its processes, the provider’s capability to meet [FIPS201] requirements for those processes SHALL be reviewed as well. In both cases, the information gathered as part of this review activity SHALL be included in the issuer’s assessment leading to authorization. Outsourced functions SHALL be assessed prior to the authorization of an issuer. Assessment and Authorization
569 570 571 572 573 574 575
[HSPD-12] requires identification credentials to be “issued only by providers whose reliability has been established by an official accreditation process.” This document contains guidelines for satisfying the requirements for an official authorization and provides a methodology that can be utilized to formally authorize an issuer. This methodology consists of two major sets of activities: assessment and authorization. While assessment and authorization are closely related, they are two distinct activities.
576 577 578 579 580 581 582 583
Assessment occurs before authorization and is the process of gathering evidence regarding an issuer’s satisfaction of the requirements of [FIPS201], including all functions performed (i) locally, (ii) at a supervised remote identity proofing (SRIP) station (if used), or (iii) at issuing facilities. Assessment activities include interviews with the issuer, the issuing facility’s personnel, and the SRIP live operators; a review of documentation; an observation of processes; and an execution of tests to determine the overall reliability of the issuer. The result of the assessment is a report that serves as the basis for an authorization decision. The report is also the basis for developing corrective actions for removing or mitigating discovered deficiencies.
584 585 586
Authorization is the decision to permit the operation of the issuer once it has been established that the requirements of [FIPS201] have been met and the risks regarding security and privacy are acceptable. The individual making the authorization decision SHALL be knowledgeable of 3
The term “token” refers to a derived PIV credential in physical form, as detailed in [SP800-157].
9
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
587 588
[HSPD-12] and aware of the potential risks to the organization’s operations, assets, and personnel (e.g., applicants, operation staff).
589 590 591 592
The assessment (Sec. 5.2) and the authorization (Sec. 5.3) are both carried out by the organization that “owns” (i.e., manages, controls, or contracts) the issuance of PIV Cards and/or derived PIV credentials. 4 In order to make an informed, risk-based authorization decision, the assessment process SHOULD seek to answer the following questions:
593 594
•
Has the issuer implemented the requirements of [FIPS201] and, optionally, [SP800-157] (in the case of derived PIV credential issuance) in a manner consistent with the standard?
595 596
•
Do personnel understand the responsibilities of their roles and/or positions and reliably perform all required activities as described in the issuer’s documentation?
597 598 599
•
Are the services and functions at the issuer, its facilities, and/or SRIP stations (e.g., identity proofing/registration, card/token production, activation/issuance) carried out in a consistent, reliable, and repeatable manner?
600 601 602
•
Have deficiencies identified during the assessment been documented? Have current and potential impacts on security and privacy been highlighted? Have the recommendations and timelines for correction or mediation been included in the assessment report? Authorization Boundary of the Issuer
603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618
The organization’s first step is to identify the appropriate authorization boundary of the issuer. The authorization boundary defines the specific operations that are to be the target of the assessment and authorization. A PIV Card issuer (PCI) comprises the complete set of functions required for the issuance and maintenance of PIV Cards, while a derived PIV credential issuer (DPCI) comprises the complete set of functions required for the issuance and maintenance of derived PIV credentials. In determining the authorization boundary, the organization SHALL consider whether all of the necessary functions required for the issuance and maintenance of PIV Card or derived PIV credentials are included within the scope. The organization SHALL also consider whether these functions are being performed identically in all issuing facilities, are using identical information technology components, and are under the same direct management control. For example, an organization may have two sub-organizations, each of which has distinct processes and management structures. The organization MAY decide to establish two separate issuers, each with its own authorization boundary. In this example, two separate assessments would be undertaken, and each assessment would result in an independent authorization decision.
619 620 621 622 623 624
In drawing an authorization boundary, an organization MAY only want to include a subset of its issuing facilities. For example, if an issuer has several facilities, some of which are ready for operation and some that are still in the development stage, the organization MAY choose to define the authorization boundary to include only those issuing facilities that are ready to be assessed. If the authorization is successful, the organization would authorize the issuer along with its subset of issuing facilities to operate and begin issuing PIV Cards. The remaining issuing
4
The trust in PIV Cards and derived PIV credentials stems from the guidelines in Task 6 of Sec. 5.3.
10
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
625 626
facilities can continue with implementation and be included in the authorization boundary at a later date.
627 628 629 630 631 632 633 634
In the case of outsourcing PIV or derived PIV services that are not under direct management control of the organization nor physically located within its facilities, the organization SHALL include the functions provided by any external service providers within the authorization boundary to ensure that they are included within the scope of issuer authorization. This assures that no matter how and where the functions are performed, the organization maintains complete accountability for the reliability of its PIV program. From an issuer point of view, this translates to applying the necessary due diligence process with respect to the assessment of controls to ensure that outsourced functions are conducted in an acceptable and compliant manner.
635 636 637 638 639 640 641
Care should be used in defining the authorization boundary for the issuer. A boundary that is unnecessarily expansive (i.e., includes many dissimilar processes and business functions) makes the assessment and authorization processes extremely complex. Establishing a boundary and its subsequent authorization are organization-level activities that SHOULD include the participation of all key personnel. An organization SHOULD strive to define the authorization boundary of its issuers such that it strikes a balance between the costs and benefits of assessment and authorization.
642 643 644 645 646
While the above considerations SHOULD be useful to an organization in determining the boundary for purposes of authorization, they SHOULD NOT limit their flexibility in establishing a practical boundary that promotes an effective [HSPD-12]-compliant implementation. The scope of an authorization is an issuer whose boundaries are formed by included issuing facilities, not individual issuing facilities. Issuer Roles and Responsibilities
647 648 649 650 651
PIV Card and derived PIV credential issuance roles and their processes should be selected based on the organization’s structure, its mission, and operating environment. The organization SHALL make sure that a separation of roles has been established and that the processes follow the requirements of [FIPS201].
652 653 654 655 656 657
This subsection identifies the roles and responsibilities of key personnel involved in the setup, day-to-day operations, assessment, and authorization of an issuer. 5 Recognizing that organizations have widely varying missions and structures, there may be some differences in naming conventions for authorization-related roles and in how the associated responsibilities are allocated among personnel (e.g., one individual MAY perform multiple roles in certain circumstances).
658
2.7.1. Senior Authorizing Official (SAO)
659 660 661 662
The senior authorizing official (SAO) of an organization is responsible for all operations. The SAO has budgetary control, provides oversight, develops policy, and has authority over all functions and services related to the issuance of PIV Cards and derived PIV credentials for the organization.
5
Organizations may define other significant roles (e.g., PIV system liaisons, operations managers) to support the authorization process.
11
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
663
2.7.2. Designated Authorizing Official (DAO)
664 665 666 667 668 669 670 671
The designated authorizing official (DAO) has the authority within an organization to review the assessment results of the organization’s established issuers and related issuing facilities and to provide an authorization decision as required by [HSPD-12]. Through authorization, the DAO accepts responsibility for the operation of the issuers at an acceptable level of risk and attests that the organization is issuing PIV Cards and, optionally, derived PIV credentials in accordance with the requirements of [FIPS201] such that issued PIV credentials have the commensurate level of identity assurance. The SAO may also fulfill the role of the DAO. The DAO SHALL NOT assume the role of the EIMO.
672
2.7.3. Enterprise Identity Management Official (EIMO)
673 674 675 676 677 678 679 680
The organization’s enterprise identity management official (EIMO) is responsible for implementing the policies of the organization and ensuring that all identity-proofing, card/token production, issuance, and maintenance processes are being performed reliably, consistently, securely, and in compliance with [FIPS201] and, optionally, [SP800-157] (in the case of derived PIV credentials) by the issuer. The EIMO is responsible for the organization’s identity management system and the enrolled PIV identity accounts. The EIMO ensures that the PIV identity account remains current at all times and that all issued PIV credentials are represented within this PIV identity account for the cardholder.
681 682 683 684 685
Furthermore, the organization’s EIMO implements and manages the operations plan; ensures that all issuing facility roles are filled with capable, trustworthy, knowledgeable, and trained staff; ensures that all services, equipment, and processes meet [FIPS201] requirements; monitors and coordinates activities with issuing facility managers; provides guidance to the issuing facilities and SRIP operators as needed; and supports the authorization process.
686
2.7.4. Issuing Facility Manager
687 688 689 690 691 692 693 694
An issuing facility manager manages the day-to-day operations of an issuing facility, remote SIRP center, or SIRP station. The issuing facility manager is responsible for implementing all operating procedures for those functions that have been designated for that facility by the issuer. The manager ensures that all PIV processes adhere to the requirements of [FIPS201] and that all PIV and derived PIV services performed at the issuing facility are carried out in a consistent and reliable manner in accordance with the organization’s policies and procedures and the direction of the organization’s EIMO. In some cases (e.g., small organizations), the EIMO MAY fulfill the role of the issuing facility manager.
695
2.7.5. Operator
696 697 698 699 700 701
An operator is responsible for executing all operating procedures for all functions, whether inperson or remotely observed (e.g., identity proofing, registration, issuance of the PIV Card or post-enrollment binding of a derived PIV credential, etc.) All operators SHALL receive comprehensive training to perform their assigned responsibilities, detect fraudulent identity source documents, and properly capture biometrics when needed. Multiple operators CAN be assigned to an issuing facility, depending on the size of that facility. The issuer is responsible for
12
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
702 703 704
ensuring that all identity proofing, registration, card/token production, issuance, post-enrollment binding, and reissuance processes are carried out and adhere to the principle of separation of duties wherever necessary to comply with [HSPD-12] and [FIPS201].
705
2.7.6. Assessor
706 707 708 709 710 711 712 713
The assessor is responsible for performing a comprehensive, third-party assessment of an issuer. The assessor (usually supported by an assessment team) verifies that the issuer’s PIV processes comply with the control objectives of [FIPS201]. The EIMO reviews the assessment findings and prepares recommended corrective actions to reduce or eliminate any discrepancies or shortcomings prior to submission to the DAO for an authorization decision. The assessor is also responsible for providing recommendations for reducing or eliminating deficiencies and security weaknesses and describing the potential impacts if those deficiencies are not corrected. An assessor SHALL NOT be assigned the DAO’s role and vice versa.
714 715 716 717 718 719 720
To preserve the impartial and unbiased nature of the assessment, the assessor SHALL be a thirdparty that is independent of the offices and personnel that are directly responsible for the day-today operation of the issuer. The assessor SHALL also be independent of those individuals responsible for correcting the deficiencies and discrepancies identified during the assessment phase. The independence of the assessor is important for maintaining the credibility of the assessment results and ensuring that the DAO receives objective information in order to make an informed authorization decision.
721
2.7.7. Applicant Representative (AR)
722 723 724 725 726 727 728
The applicant representative (AR) is an optional role that MAY be established and used at the discretion of the organization. The AR represents the interests of current or prospective employees and contractors who are applicants for a PIV Card or derived PIV credential. ARs are responsible for assisting an applicant who is denied a PIV credential because of missing or incorrect information and for ensuring that all applicants obtain useful information and assistance when needed. This role is typically assigned to someone in the organization’s personnel or human resources office.
729
2.7.8. Privacy Official (PO)
730 731 732 733 734 735
The responsibilities of the privacy official (PO) are defined in [FIPS201]. The person filling this role SHALL not assume any other operational role within the organization. The PO issues policy guidelines with respect to the collection and handling of personally identifiable information from applicants to ensure that the issuer complies with all relevant directives of the privacy laws. The PO’s role MAY be filled by an organization’s existing official for privacy (e.g., Senior Agency Official for Privacy or Chief Privacy Officer).
736
2.7.9. Role Assignment Policies
737 738 739
Although organizational roles are independent and SHOULD be filled by different people if feasible, there may be a need (e.g., because of availability or economy) to have one person fill more than one role. Except for the roles of the assessor and PO and the separation of duty 13
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
740 741 742 743 744 745
provision under Sec. 2.7.2, one person MAY perform more than one role if needed. If an organization has established multiple issuers, an individual MAY be assigned the same role in several or all of them. For example, an issuing facility manager MAY be responsible for a number of issuing facilities. Of the roles described, the SAO, DAO, EIMO, AR, assessor, and PO SHALL be employees of the organization that owns the PCI or DPCI (e.g., federal employees.)
746
2.7.10.
747
Figure 2 illustrates a possible role structure when an issuer has multiple issuing facilities.
Assessment and Authorization Roles
748 749
Fig. 2. Issuer assessment and authorization roles
750 751 752 753 754 755
The SAO has the primary authority and responsibility for the organization. The EIMO and the DAO report to the SAO. An issuing facility manager is responsible for managing operations at each issuing facility and reports to the EIMO. The dotted lines leading to the PO and the assessor indicate their independence from the day-to-day operations of the issuer. Depending on the structure of the PCI or DPCI, operators MAY work at the issuing facilities under the supervision and guidance of the issuing facility manager or MAY report directly to the EIMO.
756 757 758 759 760 761 762
Relationship Between SP 800-79 and SP 800-37 While authorization is the major topic of both SP 800-79 and [SP800-37], the goals of authorization are different in each. Authorization compliant with [SP800-37], as mandated by Appendix III of the Office of Management and Budget (OMB) Circular A-130, focuses on authorizing the processing of information systems based on an assessment of security at the information system level. An authorization decision granted under [SP800-37] signifies that an organization official accepts responsibility for the security (i.e., the confidentiality, integrity, and 14
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
763 764 765 766 767 768 769 770 771
availability of the information) of the information system. Authorization in SP 800-79 and as mandated by [HSPD-12] is concerned with the assessment of the “reliability” of an issuer to perform its functions in accordance with [FIPS201]. The authorization of an issuer’s reliability under SP 800-79 indicates that an organization official asserts that the issuer meets and has the ability to operate within the control objectives outlined in [HSPD-12] for “secure and reliable forms of identification” within an acceptable level of risk. However, in both cases, the organization official (i.e., the authorizing official [AO] in [SP800-37] and the DAO in SP 80079) is fully accountable for any adverse impacts to the organization if a breach in security, privacy, or policy occurs.
772 773 774 775 776 777 778 779 780
SP 800-79 focuses on the authorization of an organization’s capability and reliability but depends on adequate security for all of the supporting information systems that have been authorized under [SP800-37]. Therefore, before the DAO authorizes the issuer and its facilities, all relevant PCI or DPCI information systems used must be authorized. In many cases, authorization under [SP800-37] will be granted by an organization official other than the official responsible for authorizing the issuer. The former is an organization official tasked with deciding whether to authorize the operation of an information system based on its security posture. The latter SHALL be someone specifically designated to authorize the operation of an issuer after it has been assessed and determined to be compliant with [FIPS201] control objectives.
781
Preparing for the Assessment of an Issuer
782 783 784 785 786
To facilitate an assessment of an issuer in a timely, efficient, and thorough manner, it is essential that the staff of the issuer and members of the assessment team understand their specific roles and responsibilities and participate as needed. The issuer, its operation staff, and the team responsible for performing the assessment must cooperate and collaborate to ensure the success of the assessment. Specific responsibilities of the assessment team are listed below.
787
2.9.1. Issuer Duties
788 789 790 791 792 793 794 795 796
Before the assessment can begin, an assessor SHALL be designated. The assessor conducts the assessment and oversees the assessment team. The assessment team MAY be made up of employees from the organization or personnel from a public or private-sector entity contracted to provide assessment services. Members of the assessment team should have capabilities to perform the activities specified in this document. Assessment team members SHOULD work together to prepare for, conduct, and document the findings of the assessment within the authorization boundary. Each team SHALL be made up of individuals who collectively have the knowledge, skills, training, and abilities to conduct, evaluate, and document assessments, including those performed on the information systems being used by the issuer.
797 798 799 800 801 802
Once an assessment team is in place, the EIMO and other relevant personnel SHOULD begin the preparation for the assessment. Thorough preparations by both the issuer and the assessment team are important aspects of conducting an effective assessment. The issuer sets the stage for the assessment by identifying all appropriate personnel and making them available during the assessment. A fundamental requirement for authorization is for the assessment team to interview all issuer personnel. Personnel, operators, and officials SHALL be notified of the pending
15
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
803 804
assessment, SHOULD understand their roles in the process, and SHALL be made available in accordance with the planned assessment schedule.
805 806 807 808 809 810 811 812
The EIMO SHALL ensure that all relevant documentation has been completed and organized before the assessment begins. This documentation includes policies, procedures, organizational structure, information system architecture, product and vendor details, and specifics regarding the implementation of all of the requirements in [FIPS201] and related publications. If the issuer has outsourced functions to an external service provider, all necessary documentation SHALL be obtained from the provider regarding the outsourced operations. The EIMO SHALL review any documentation to make certain that it is complete, current, and approved before providing it to the assessment team.
813 814 815 816 817 818
Another significant activity during the assessment involves the assessment team observing the actual processes performed by the issuer staff. In order for the assessment team to confirm that processes are implemented in accordance with the operations plan, the issuer organization SHALL ensure that assessment team members have access to facilities and are able to observe PIV processes in real time. This could include scheduling activities to observe identity proofing, adjudication, card/token production, activation/issuance, and maintenance processes.
819 820 821 822
Appendix C includes an issuer readiness review checklist to aid the issuer’s planning and preparation for the assessment. Satisfying the list of items before the assessment commences will facilitate efficient utilization of the assessment team’s time and contribute toward the overall effectiveness of the assessment activity.
823
2.9.2. Assessment Team Duties
824 825 826 827 828
The independence of the assessment team is important for assessing the credibility of the assessment results. In order to ensure that the results of the assessment are impartial and unbiased, the members of the assessment team SHALL NOT be involved in the development, day-to-day maintenance, or operations of the issuer or in the removal, correction, or remediation of deficiencies.
829 830 831 832 833 834 835
The assessment team may obtain information during an assessment that the organization may not want to publicly disclose. The assessment team is obligated to store and protect the confidentiality of all security assessment-related records and information, including limiting access to individuals who need to know the information. When using, storing, and transmitting information related to the assessment, the assessment team shall follow any established guidelines as agreed upon under the rules of engagement in addition to all relevant laws, regulations, and standards regarding the need, protection, and privacy of information.
836 837 838 839 840 841
Authorization Decision An authorization decision is a judgment made by the DAO to authorize the operation of an issuer and its facilities. The DAO reviews the results of the assessment, considers the impacts of any identified deficiencies on the organization, and decides whether to authorize the operation of the issuer and its facilities. In doing so, the DAO agrees to accept the security and privacy risks (if any) of issuing and maintaining PIV Cards or derived PIV credentials.
16
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
842 843 844 845 846
During the authorization decision process, the DAO evaluates the assessment findings for the issuer and each issuing facility within the authorization boundary. If the issuer has outsourced some of its services or functions, the DAO SHALL review all relevant assessments and authorizations that have been granted to the external service provider and include them as part of the overall evaluation of risk to the organization.
847 848 849 850 851 852 853 854 855 856
An authorization decision by a DAO SHALL always be granted for a specific issuer before the commencement of operations, and there can only be one authorization decision for each issuer. In issuing this decision, the DAO SHALL indicate the authorization boundary to which the authorization applies. A DAO grants an authorization to an issuer and then specifies which facilities (along with any exceptions or restrictions) are permitted to operate under that authorization. This allows the issuer and any of its authorized issuing facilities to begin operations while remaining facilities focus on addressing the deficiencies identified during the assessment. At a later date, these facilities can be reassessed. After reviewing the new findings, the DAO can reissue the authorization for the issuer and expand the authorization boundary by including the newly assessed facilities.
857 858 859 860 861
The major input to the authorization decision is the assessment report. To ensure that the assessment report is properly interpreted and the justification for the authorization decision properly communicated, the DAO SHOULD meet with the assessor, the EIMO, and the issuing facility managers prior to issuing an authorization decision to discuss the assessment findings and the terms and conditions of the authorization.
862
There are three authorization alternatives that can be rendered by the DAO:
863
1. Authorization to operate,
864
2. Interim authorization to operate, or
865
3. Denial of authorization to operate.
866
2.10.1.
867 868 869 870 871 872 873 874 875 876
An authorization to operate (ATO) may be issued 6 if — after reviewing the results of the assessment phase — the DAO deems that the operations of the issuer and its facilities conform to the control objectives of [FIPS201] to an acceptable degree and will continue to do so reliably during the authorization validity period. The issuer and its issuing facilities are authorized to perform services in compliance with all relevant policies, in conformance with all relevant standards, and in accordance with the documented operations plan. The DAO SHALL indicate exactly which issuing facilities are included in the ATO authorization decision. An ATO can only be granted to an issuer if there are no limitations or restrictions imposed on any of its issuing facilities that are included in the authorization boundary. The ATO is transmitted to the EIMO.
877 878 879 880 881
After receiving an ATO that conforms to SP 800-79, reauthorization SHALL be performed (i) within three years; (ii) when there is a significant change in personnel or operating procedures, including the improvement or degradation of operations; or (iii) when additional issuing facilities are being added to the issuer. There may also be cases in which one or more issuing facilities cease operation. If this situation results in a PIV Card or derived PIV credential issuance-related 6
Authorization to Operate (ATO)
The issuer ATO can be affected by the underlying system authorization status (see Sec. 2.10.4).
17
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
882 883 884 885 886 887
function identified in the operations plan becoming unavailable, then the DAO SHALL issue a denial of authorization to operate (DATO) (Sec. 2.10.3). However, if the issuer can continue to provide all of the services in the operations plan, then the authorization decision letter SHALL be modified to exclude those issuing facilities that have ceased operations, thus revising the authorization boundary. The required reauthorization activities are at the discretion of the DAO and based on the extent and type of change.
888
2.10.2.
889 890 891 892 893 894 895 896 897 898 899 900 901
An interim authorization is an authorization to operate under specific terms and conditions. An interim authorization to operate (IATO) SHOULD be issued 7 if — after reviewing the results of the assessment phase — the DAO deems the discrepancies to be significant, but there is an overarching necessity to allow the issuer to operate. An IATO is rendered to an issuer when the identified deficiencies are significant but can be addressed and remediated in a timely manner. The deficiencies SHALL be documented so that they can be addressed during the planning of corrective actions. The DAO SHALL indicate exactly which facilities are included in the IATO authorization decision during this interim period, along with any limitations or restrictions. The maximum duration of an IATO is three months, and a maximum of two consecutive IATOs MAY be granted. Failure to correct deficiencies before the expiration of the second IATO SHALL result in an issuance of a DATO for the issuer. The authorization boundary SHOULD be revised to exclude issuing facilities that exhibit significant deficiencies in performing their functions. The IATO is transmitted to the EIMO.
902 903 904 905
An issuer SHALL NOT be considered to be authorized during the period of an IATO. When the deficiencies have been corrected, the IATO SHOULD be replaced with an ATO. Significant changes in the status of an issuer (e.g., addition of new issuing facilities) that occur during the IATO period SHALL be reported immediately to the DAO.
906
2.10.3.
907 908 909 910 911 912 913 914 915 916 917
A denial of authorization to operate (DATO) SHALL be transmitted to the EIMO if — after reviewing the results of the assessment phase — the DAO deems operation of the issuer to be unacceptable. Failure to receive an ATO indicates that there are major deficiencies in reliably meeting the requirements of [FIPS201] and its related documents. The issuer is not authorized and SHALL NOT be allowed to operate. If issuance services are currently in operation, all functions SHALL be halted, including all operations at any issuing facility. If an issuer was previously authorized and had issued PIV Cards or derived PIV credentials under an ATO, the EIMO and issuing facility managers SHOULD consider whether a revocation of PIV Cards and derived PIV credentials is necessary. The DAO and the assessor SHOULD work with the EIMO and issuing facility managers to ensure that proactive measures are taken to correct the deficiencies.
7
Interim Authorization to Operate (IATO)
Denial of Authorization to Operate (DATO)
The issuer IATO can be affected by the underlying system authorization status (see Sec. 2.10.4).
18
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
918
2.10.4.
Authorization Impact of Information Systems Under SP 800-37
919 920 921 922 923 924 925 926
An issuer SHALL NOT be authorized to operate if one or more of its critical information systems is deemed insecure and it is therefore issued a DATO according to [SP800-37]. If an IATO has been issued for an information system, the DAO MAY NOT issue greater than an IATO for the issuer. Once the [SP800-37] IATO is replaced with an [SP800-37] ATO, the DAO can issue an SP 800-79 ATO. If the [SP800-37] ATO expires for one or more information systems during the course of operation of an issuer, the EIMO SHALL assess the criticality of the system for operations and present the analysis to the DAO. The DAO can then exercise the following options:
927 928
•
Specify a short time during which the information systems of the issuer must be reauthorized under then without changing the ATO status,
929
•
Downgrade the current SP 800-79 ATO to an IATO, or
930
•
If circumstances warrant, issue an SP 800-79 DATO and halt all issuer operations. Use of Risk in the Authorization Decision
931 932 933 934 935 936
Authorization is the official management decision by the DAO to permit the operation of an issuer based on an assessment of its reliability and an acceptance of the risk inherent in that decision. By granting an authorization to operate, the DAO accepts responsibility for the reliability of the issuer and is fully accountable for any adverse impacts to the organization or any other organization from the use of issued PIV Cards or derived PIV credentials.
937 938 939 940 941
The assessment of an issuer enables the DAO to determine its reliability and whether to accept the risk to the organization in granting an ATO. As the requirements in [FIPS201] and related documents form the basis of the authorization and are ultimately derived from the policy objectives of [HSPD-12], those not reliably met by the issuer and its issuing facilities represent the potential for adverse impact.
942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957
The PIV Card is used to establish assurance of an identity, and as such, it must be trusted as a basis for granting access to the logical and physical resources of the organization. Similarly, the derived PIV credential alternative form factors greatly improve the usability of electronic authentication to remote IT resources while maintaining identity assurance through postenrollment binding. The incorrect or inconsistent implementation of an [HSPD-12] program exposes an organization to an unacceptable level of risk since any problem with an issued PIV Card or derived PIV credential that undermines this assurance could allow unauthorized access to sensitive organizational resources and expose an organization to harm. Furthermore, the collection, processing, and dissemination of personal information is required to issue these credentials and increases the threat of this information being used for malicious purposes 8 if not secured. It is the DAO’s responsibility to weigh the risks of these and other security and privacy impacts when making the authorization decision. Furthermore, as [HSPD-12] is a governmentwide mandate based on a standard of interoperability that allows organizations to accept other organizations’ credentials, authorization decisions within a single organization directly impact other organizations. For example, an interoperable credential issued by an authorized federal organization becomes the source of trust for another organization to grant access to physical and 8
The collection of personally identifiable information (PII) is minimized for derived PIV credentials because of the derivation process.
19
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
958 959 960
logical resources based on verification of that identity. The DAO’s signature on the authorization letter thus signifies their acceptance of responsibility (i.e., accountability) for the operations of the issuer for their organization as well as other organizations in the federated circle of trust.
961
Authorization Submission Package and Supporting Documentation
962 963 964 965 966 967
The authorization submission package documents the results of the assessment phase and provides the DAO with the essential information needed to make a credible, risk-based decision on whether to authorize operation of the issuer. Unless specifically designated otherwise by the DAO, the EIMO SHALL be responsible for the assembly, compilation, and presentation of the authorization submission package. The authorization submission package contains the following documents:
968 969
•
Operations plan, including standard operating procedures (SOPs) and attachments for all issuing facilities
970
•
[SP800-37] authorization letters
971
•
Assessment report
972
•
Corrective actions plan (CAP), if required
973 974 975 976 977 978
The operations plan contains the policies, procedures, and processes for all of the major PIV functional areas. It gives the assessor and DAO a complete picture of the structure, management, and operations of an issuer, including issuing facilities. Appendix D provides templates of what to include in the operations plan. One of the most significant pieces of information contained in the operations plan is the list of issuer controls, which enables the assessor to quickly ascertain how they are implemented and by whom.
979 980 981 982 983 984 985 986
If certain functions described in the operations plan are outsourced, the operations plan SHOULD reference or point to the external service provider’s operations plan and related documentation, such as support agreements and any contracts. In this manner, the assessor has access to information about the external service provider’s operations without requiring the issuer to duplicate documentation. Upon receiving and reviewing the authorization package and in consultation with the assessor, the DAO decides whether to authorize the operations of the issuer. The authorization decision letter transmits the authorization decision from the DAO to the EIMO and contains the following information:
987
•
Authorization decision
988
•
Supporting rationale for the decision
989 990
•
Terms and conditions for the authorization, including which issuing facilities are included (i.e., authorization boundary)
20
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Operations Plan Assessment Report Corrective Actions Plan (CAP) SP 800-37 Authorization Letters
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
−
Description of the issuer’s PIV/derived PIV services, plans, procedures, technical specifications, supported options, and relevant documents (e.g., policies, standard operating procedures)
−
Report of the issuer’s control assessments and recommended corrective actions
−
Actions to be implemented by the issuer to remove or reduce deficiencies and risks
−
An authorization to operate for each information system within the issuer’s authorization boundary
DAO
991 Fig. 3. Authorization submission package
992 993 994 995 996 997 998 999
The authorization decision letter (see Appendix F for examples) informs the EIMO that the issuer is (i) authorized to operate, (ii) authorized to operate on an interim basis, or (iii) not authorized to operate. The supporting rationale includes the justification for the DAO’s decision. The terms and conditions for the authorization provide a description of any limitations or restrictions placed on the operation of the issuer, including which issuing facilities are included in the decision. The authorization decision letter SHALL be attached to the authorization submission package, which becomes the authorization decision package.
1000 1001 1002 1003
The DAO sends the authorization decision package to the EIMO and retains a copy of it. The EIMO carefully reviews the terms and conditions of authorization before initiating the necessary steps for issuer operations. Both parties mark the authorization decision package appropriately for storage under the organization’s record retention policy.
21
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Taxonomy of Issuer Controls
1004
Introducing Issuer Controls
1005 1006 1007 1008 1009 1010 1011 1012
The assessment of a PCI or DPCI is broader than an assessment of the security of an information system under [SP800-37]. The requirements specified in [FIPS201] cover all major aspects of an issuer, including organizational preparedness, security management, data protection, infrastructure, and issuance processes. In this document, each broad area is defined as an issuer authorization topic (IAT). IATs are used to summarize the assessment results for reporting and to structure the report for senior organization management to provide an analysis of the strengths and weaknesses of an issuer and its level of compliance.
1013
IATs include the following:
1014 1015 1016 1017
•
Organizational preparedness relates to the capability, knowledge, and understanding of senior management regarding the formation and operation of the issuer. Under this area, roles and responsibilities are clearly identified, and policies and procedures are defined, documented, implemented, and enforced.
1018 1019 1020 1021
•
Security management and data protection involves implementing and operating appropriate security management procedures, operational controls, and technical protection measures to ensure that privacy requirements are satisfied, the rights of individuals are assured, and personal data is protected.
1022 1023 1024 1025 1026 1027
•
Infrastructure elements represent the activities required to procure, deploy, and maintain the information system components used for the issuance of PIV Cards and derived PIV credentials. These information system components (e.g., PKI, card or token personalization, printers, tokens, etc.) must meet the technical specifications defined in [FIPS201] and related documents and must be authorized under [SP800-37] for FISMA compliance.
1028 1029 1030
•
Processes are classes of functions that collectively span the entire life cycle, 9 such as sponsorship, identity proofing/registration, adjudication, card/token production, activation/issuance, and maintenance of the PIV Card and derived PIV credential.
1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042
Each IAT is subdivided into one or more authorization focus areas. A focus area is a set of closely related requirements that need to be met by an issuer. Under each focus area, there is a procedure or technical product (termed an “issuer control”) that is used to satisfy a particular requirement. However, the manner in which the requirements are satisfied and how the specifications are implemented and managed may vary from organization to organization. For example, each PCI is required to identity-proof their applicants. This process can be implemented in one of several ways, depending on the structure, size, and geographical distribution of the organization’s headquarters and remote locations. The process could be conducted at a central location or distributed in regional centers across the country. It could be operated directly by the organization or by an external service provider. However, irrespective of the implementation approach, this identity proofing/registration activity needs to be reliably and accurately performed.
9
Some of the processes may not apply to derived PIV credential issuers.
22
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061
Issuers need to implement the PIV requirements derived from [FIPS201] and its supporting publications, Office of Personnel Management (OPM) requirements related to background investigations, and applicable OMB Memoranda. The capability of an issuer is determined through the verification of these requirements using appropriate assessments. However, authorization is generally based on both the demonstration of capability and the presence of certain organizational characteristics that will provide a high degree of confidence to the assessor that the demonstrated capabilities will be carried out in a dependable and sustainable manner. This dependability measure, or reliability (as it is generally called), has to be established by adequately assessing that an issuer has the desired organizational characteristics, including adequate issuing facilities, appropriate equipment, trained personnel, adequate resources, trustworthy management, and properly vetted operations staff. Hence, the assessment and authorization methodology includes a set of issuer controls, the verification of which establishes the reliability of the issuer. This set of controls is grouped under the IAT’s authorization focus area called “Facility and Personnel Readiness.” These reliability-relevant issuer controls are formulated based on commonly accepted security readiness measures that have evolved in response to lessons learned in security incidents (e.g., insider attacks) and risks (e.g., physical security lapses). In addition to the controls provided herein, an organization may develop additional mission-specific controls that will contribute toward the overall reliability of the issuer to meet the organization’s mission needs.
1062
Table 1 lists the four IATs with associated authorization focus areas under each topic.
1063
Table 1. IATs and associated authorization focus areas Organizational Preparedness Preparation and Maintenance of Documentation (DO) Assignment of Roles and Responsibilities (RR)
Security Management and Data Protection Protection of Stored and Transmitted Data (ST) Enforcement of Applicable Privacy Requirements (PR)
Facility and Personnel Readiness (FP) Infrastructure Elements Deployed Products & Information Systems (DP) Implementation of Credential Infrastructures (CI)
Processes Sponsorship Process (SP) Identity Proofing/Registration Process (EI) Adjudication Process (AP) Card/Token Production Process (CP) Activation/Issuance Process (AI) Maintenance Process (MP)
1064 1065 1066 1067 1068 1069 1070 1071 1072
Appendices G.1 and G.2 contain required issuer controls grouped by IAT and the associated authorization focus area for PCIs and DPCIs, respectively. Each issuer control represents how one or more requirements from [FIPS201] and its related documents can be satisfied. Issuer controls are sequentially numbered using the two-character identifier assigned to the authorization focus area under which they are listed. Identifiers for issuer controls that are applicable to both PCIs and DPCIs are aligned for ease of reference. In addition, controls for DPCIs are marked with “derived credential (DC)” for quick identification. For example, DO-1 applies to a PCI, and DO(DC)-1 applies to a DPCI. Both of these issuer controls are targeted at assessing the same requirement.
1073 1074
Table 2 shows the “Preparation and Maintenance of Documentation” authorization focus area under the “Organizational Preparedness” IAT.
23
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1075
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Table 2. Sample IAT, authorization focus area, and issuer controls (PCI) Identifier DO-1
DO-2
Issuer Control
Source
The organization develops and implements an issuer operations plan SP 800-79, Sec. 2.12 – according to the template in Appendix D.1. The operations plan Authorization Submission references other documents as needed. Package and Supporting Documentation The organization has a written policy and procedures for identity [FIPS201], Sec 2.7 – PIV proofing and registration that are approved by the head or deputy (or Identity Proofing and equivalent) of the federal department or agency. Registration Requirements
1076 1077 1078 1079 1080 1081 1082 1083 1084 1085
Unlike for a PIV Card issuer, not all issuer controls are applicable to a derived PIV credential issuer. Certain issuer controls are applicable to only Authentication Assurance Level 2 (AAL2) or AAL3 derived PIV credentials and must therefore be implemented by the issuer only if they are issuing a derived PIV credential at that level of authentication assurance. This is represented via the “applicability” column in the tables in Appendix G.2. Table 3 shows the “Maintenance Process” authorization focus area under the “Processes” IAT. The “applicability” column identifies whether the issuer control needs to be met by a PKI-based AAL2 or AAL3 derived PIV credential issuer or a non-PKI-based AAL2 or AAL3 derived PIV credential issuer. If the “applicability” column states “DPCI,” then the issuer control is applicable to all derived credential issuers, regardless of what type of derived PIV credential is issued by the issuer.
1086
Table 3. Sample IAT, authorization focus area, issuer control, and applicability (DPCI)
1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098
Identifier
Issuer Control
Applicability
Source
MP(DC)-17
If the derived PIV authentication private key was created and stored on a hardware cryptographic token that permits export of the private key, then the derived PIV authentication certificate is revoked upon termination, even if the token is collected and either zeroized or destroyed.
PKI-AAL2, PKI-AAL3
[SP800-157], Sec. 2.4.1 – PKI-Based Derived PIV Credential Invalidation
All issuer controls apply, regardless of an individual system’s FIPS 199, Standards for Security Categorization of Federal Information and Information Systems [FIPS199], impact level. Furthermore, nothing precludes an issuer from implementing additional controls to ensure a higher level of confidence in mitigating risks associated with issuing PIV Cards or derived PIV credentials. Implementing Issuer Controls Each issuer control SHALL be properly implemented, managed, and monitored in order for the issuer to be authorized. Depending on how an organization decides to implement its [HSPD-12] program, certain functions might be outsourced to external service providers. However, it is still the responsibility of the organization’s management to ensure that the issuer controls are being implemented, enforced, and maintained by the issuer, its service providers (if any), and all issuing facilities that are within scope of the authorization boundary.
24
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1099
3.2.1. Issuer Controls Implemented at the Organizational or Facility Level
1100 1101 1102 1103 1104 1105 1106 1107 1108
The nature of each issuer control dictates where it is implemented. Controls are generally considered organizational level controls if they apply to the entire organization, regardless of the structure of the issuer and its issuing facilities, or are common to or impact multiple PIV processes. The development of the operations plan is an example of an issuer control implemented at the organizational level. Generally, controls that are specific to a process are implemented at the issuing facility where that process or function is carried out. For example, the control that states, “The issuer advises applicants that the PIN on the PIV Card should not be easily guessable or otherwise individually identifiable in nature,” is implemented at an activation/issuance facility.
1109 1110 1111 1112 1113
Derived PIV credentials MAY be issued remotely. In such cases, the issuer MAY NOT need to use an issuing facility, and issuing facility-specific controls may not be applicable. Regardless of the system and process architecture on how PIV Cards and derived PIV credentials are issued, it is the responsibility of the issuer organization to ensure that all applicable controls are implemented.
1114
25
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1115
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Controls Assessment and the Authorization Decision Process
1116 1117 1118 1119 1120
An assessment is a set of activities performed by the assessor to gain assurance that the applicable issuer controls for a PCI or DPCI have been implemented properly and meet their required function or purpose. Understanding the overall effectiveness of the issuer controls implemented by the issuer and its facilities is essential for determining the risk to the organization’s overall mission and forms the basis for the authorization decision by the DAO.
1121 1122 1123 1124
An assessor SHALL (i) compile evidence that the issuer controls are implemented correctly, operating as intended, and producing the desired results and (ii) present this evidence in a manner such that the DAO can make a credible, risk-based decision about the operation of the issuer.
1125 1126 1127 1128 1129 1130
The focus of an assessment is the issuer controls, each of which is designed to satisfy one or more specific requirements from [FIPS201] and related documents. The objective for the assessor is to use the assessment procedures associated with each issuer control (described in Appendix G) to measure conformance to the requirements. The assessment procedures are designed to facilitate the gathering of evidence that issuer controls are implemented correctly, operating as intended, and producing the desired outcome.
1131
In preparation for an assessment, the assessor performs the following two preparatory steps:
1132 1133 1134
1. Determine the authorization boundary to understand the target of the assessment. The authorization boundary dictates which issuing facilities and outsourced services are to be included in the assessment.
1135 1136 1137 1138
2. Review the operations plan to determine which issuer controls are implemented at the organizational level and facility level. This analysis should provide the assessor with an understanding of where different responsibilities lie within the issuer organization and how to address them during the assessment.
1139 1140 1141 1142 1143 1144 1145 1146 1147 1148
If PIV functions have been outsourced, the issuer is responsible for ensuring that the external service provider has implemented the control. During the assessment, it is the responsibility of the EIMO to collect any service provider’s documentation and make it available to the assessor. It is recommended that organizations include appropriate language in contractual agreements with external service providers to ensure that the relevant documentation and necessary evidence is furnished by the provider in a timely manner for a successful authorization. If results from a previous assessment of the service provider (provided that the current assessment is part of reauthorization after substantial changes) can be referenced, the assessor may elect to incorporate these results (not exceeding one year) or redo part or all of the assessment. Reusing the results of the previous assessment is entirely at the discretion of the assessor.
1149 1150 1151 1152 1153 1154
Issuer controls implemented at the organizational level generally need to be assessed only once since they span the entire issuer and its issuing facilities. In other words, these controls MAY NOT need to be reassessed when the authorization boundary changes (e.g., due to the addition of facilities). Examples of organizational-level controls include the set of controls under the authorization focus areas Preparation and Maintenance of Documentation (DO) and Assignment of Roles and Responsibilities (RR).
1155 1156
There are certain controls that need to be reviewed at the issuing facility level even if they are put in place at the organizational level. An example of such a control artifact is
26
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1157 1158 1159 1160
“contingency/disaster recovery plan for information systems.” Though the development of the contingency/disaster recovery plan is an organizational-level control, it must be reviewed when new information systems in the existing facilities or new facilities are added to ensure that the new systems are brought within the scope of the plan.
1161 1162 1163 1164 1165 1166 1167 1168 1169
Unlike organizational-level issuer controls, facility-level issuer controls need to be assessed individually at each facility. A facility is often designated based on the type of PIV process it performs (exceptions are the sponsorship process and adjudication process). For example, if there are multiple facilities for identity proofing/registration (e.g., multiple registration centers), assessment of the issuer controls under the identity proofing/registration focus area should take place in each of the registration centers. However, if all facilities are operating using uniform operational procedures and underlying information systems, assessments may be performed at facilities that are selected randomly or through some other established criteria (e.g., geographical region or service provider).
1170 1171 1172 1173 1174 1175 1176 1177 1178
Prior assessments MAY be used as a starting point for the assessment of an issuer. While past assessments provide insight into the implementation and operation of an issuer, a number of factors affect the validity of past assessments. These include updates in policies and procedures, changes in systems and technology, and turnover among employees and contractors. Any significant changes in one or more of these factors SHOULD trigger a new assessment. The assessor SHALL validate whether the issuer is currently operating as expected using the given assessment procedures, including specially tailored or augmented procedures. It is only through a current valid assessment of issuer controls that the assessor and the EIMO will have confidence in the reliability of the issuer and its issuing facilities.
1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190
The use of automated security controls, if reliably implemented and maintained in information systems, results in a high assurance of the protection of information and other organizational assets. Human involvement results in more variability in how issuer controls are implemented and operated since security and reliability depend on many factors, including an individual’s training, knowledge, motivation, experience, and management. Relying on humans rather than automated security mechanisms for data protection makes it critical that trust and reliability assessments of management, operators, and maintenance personnel are current and up to date. Many assessment procedures rely on interactions among the assessor, issuer management, and facilities staff. Interviews with all involved personnel and observations of all PIV processes are required. On-site visits, real-time observations, and reviews of processes are essential. The assessor SHOULD NOT rely solely on documentation to determine whether a given issuer control has been implemented. Assessment Methods
1191 1192 1193 1194
In order to assess the capability and reliability of an issuer, one or more assessment procedures associated with each issuer control have to be completed. An assessment procedure is carried out using one or more of the following assessment methods: 10
1195 1196
•
10
Review — An evaluation of documentation that describes plans, policies, and procedures in order to verify that they are adequate, understood by management and operations
The assessment methods associated with an assessment procedure are given in parenthesis in Appendices G.1 and G.2.
27
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1197 1198
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
personnel, and are in accordance with applicable policies, regulations, standards, technical guidelines, and organizational guidance
1199 1200 1201
•
Interview — A directed conversation with one or more issuer personnel in which both preestablished and follow-on questions are asked, responses documented, discussion encouraged, and conclusions reached
1202 1203 1204
•
Observe — A real-time viewing of PIV processes in operation, including all of the information system components of the issuer involved in the creation, issuance, maintenance, and termination of PIV Cards or derived PIV credentials
1205 1206 1207
•
Test — An evaluation of a component against a set of relevant PIV specifications using applicable test methods and metrics (as given in the associated assessment procedures in Appendices G.1 and G.2.)
1208 1209 1210 1211 1212
These methods are intended to provide the assessor with sufficient, precise, accurate, and relevant evidence regarding an IAT topic and its focus areas. One or more assessment methods may be required to determine whether the issuer has satisfactorily met the objective outlined for that assessment procedure. Assessment results are used by the assessor to determine the overall effectiveness of the issuer control.
1213 1214 1215 1216 1217 1218
Table 4 shows the “Preparation and Maintenance of Documentation” authorization focus area under the “Organizational Preparedness” IAT. The “applicability” column identifies whether the issuer control needs to be met by a PKI-based AAL2 or AAL3 derived PIV credential issuer or a non-PKI AAL2 or AAL3 derived PIV credential issuer. If the “applicability” column states “DPCI,” then the issuer control is applicable to all derived PIV credential issuers, regardless of what type of derived PIV credential is issued by the issuer.
1219
Table 4. Sample issuer controls with assessment procedures (DPCI) Identifier
Issuer Control
Applicability
Source
DO(DC)-1
The organization develops and implements an issuer operations plan according to the template in Appendix D.2. The operations plan references other documents as needed.
DPCI
SP 800-79, Sec. 2.12 – Authorization Package and Supporting Documentation
DPCI
[SP800-157], Sec. 2 – Life Cycle Activities and Related Requirements
DO(DC)-3
Assessment Determine that: (i) The operations plan includes the relevant elements from the template in Appendix D.2 (review). (ii) The operations plan includes (i) the list of issuer controls from Appendix G, (ii) the owner for each owner, (iii) a description of how the control is implemented, and (iv) whether the control is organization or facility-specific (review). (iii) Relevant operating procedures and associated documentation are referenced accurately (review). (iv) The operations plan has been reviewed and approved by the DAO within the organization (review, interview). The organization has a written policy and procedures for initial issuance that are approved by the federal department or agency. Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for issuance (to include in-person, remote, or both) (review).
28
[SP800-157], Sec. 2.2 – Initial Issuance
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
(ii) The policy is consistent with the organization’s mission and functions, [FIPS201], [SP800-157], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The policy and procedures are approved by the federal department or agency (review). (iv) The organization periodically reviews and updates the policy and procedures as required (review, interview).
1220 1221 1222 1223
Some organizations may need to customize some of the issuer controls to meet their specific characteristics and mission needs. In such cases, the associated assessment procedures may also have to be customized or augmented to ensure proper implementation of the controls. Issuer Assessment Report
1224 1225 1226 1227
The assessment report contains the results of the assessment in a format that facilitates reviewing by the DAO. The DAO SHALL evaluate the information in the assessment report in order to make a sound, credible decision regarding the residual risk of authorizing the operations of the issuer.
1228 1229 1230 1231
Appendix E provides an assessment report template organized by authorization focus. For each issuer control, it SHALL document which entity is responsible for the implementation of that control (e.g., the organization or an external service provider) and whether the issuer control is at the organizational or facility level. Activation/Issuance Process Issuer Control Identifier — AI-7 Control Description — Before the PIV Card is provided to the applicant, the operator performs a one-to-one comparison of the applicant against the biometric data records available on the PIV Card or in the PIV enrollment record. If the biometric verification decision is negative, or if no biometric data records are available, the cardholder provides two identity source documents (as specified in [FIPS201], Sec. 2.7), which are inspected and compared by the operator with the photograph printed on the PIV Card. Control Owner/ Control Level — External Service Provider/Facility Level ASSESSMENT DETAILS Assessment Method(s): Review: Operations Plan Observe: Activation/Issuance Process Assessment Result — Partially Satisfied Assessment Findings — There is operational evidence that a one-to-one comparison of the applicant against the biometric data records available on the PIV Card or in the PIV enrollment record is carried out before the card is released to the applicant. Assessment Deficiency and Potential Impact — The requirement to carry out this task is not documented clearly enough in the operations plan. Although personnel are knowledgeable about this requirement and the task was observed to be performed correctly during card issuance, the lack of documentation could be a problem if there is turnover in staff. Alternate processes when a biometric match is unsuccessful are not in place. Recommendation — Update the issuance process description within the operations plan to include a clear description of this task in the process, and develop alternate processes for issuance when the biometric match is not successful.
29
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1232 1233
Fig. 4. Sample issuer control assessment result (PCI)
The assessment result for each issuer control SHALL be one of the following:
1234
•
Satisfied
1235
•
Partially Satisfied
1236
•
Not Satisfied
1237
•
Not Applicable
1238 1239 1240 1241
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
After carrying out an assessment procedure, the assessor records their conclusion in one of two ways: MET or NOT MET. Using the list of conclusions pertaining to the assessment procedures associated with an issuer control, the assessment result (i.e., one of the four outcomes listed above) is arrived at as follows:
1242 1243
•
If the conclusion from all assessment procedures is MET, then the assessment result for the issuer control is “Satisfied.”
1244 1245 1246 1247 1248 1249 1250
•
If some of the conclusions are NOT MET, then the assessment result for the issuer control is marked as either “Partially Satisfied” or “Not Satisfied,” depending on whether any of the underlying tasks in the assessment procedures are critical (i.e., they represent the only way to meet the issuer control’s objective). Figure 4 shows an example of an assessment that resulted in “Partially Satisfied.” In this instance, there is an awareness of a task requirement and the task itself is being carried out, but the reference to the task is missing in the document.
1251 1252 1253 1254 1255 1256
When drawing a conclusion after an assessment procedure, the assessor must consider the potential subjective and objective aspects of the assessment methods used (e.g., interviews, document reviews, observations, and tests) for that assessment procedure. Deficiencies that result in “Partially Satisfied” or “Not Satisfied” must be reported by the assessor. The assessor must also outline the potential adverse impacts if the issuer control is deployed with the identified deficiencies.
1257 1258 1259 1260 1261 1262
The assessment report template provides the means for recording the assessment result for each issuer control. The assessment results for all issuer controls are aggregated to generate the assessment result for an issuer authorization focus area. The set of issuer authorization focus area results are aggregated to generate issuer authorization topic results. Finally, the group of issuer authorization topic results is used to generate the overall issuer assessment report and an accompanying executive summary (intended for senior management).
30
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1263 1264 1265 1266 1267 1268 1269
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Assessment and Authorization Life Cycle The authorization of a PCI or DPCI consists of four phases: (i) Initiation, (ii) Assessment, (iii) Authorization, and (iv) Monitoring. Each phase consists of tasks and subtasks to be carried out by the responsible officials (e.g., the DAO, assessor, EIMO, and issuing facility managers). Figure 5 provides a view of the authorization phases, including the tasks associated with each phase. A table of authorization phases, tasks, subtasks, and the official responsible for each is provided in Appendix H.
• • •
INITIATION PHASE
Preparation Resource identification Operations plan analysis and acceptance
ASSESSMENT PHASE AUTHORIZATION PHASE MONITORING PHASE
• •
Issuer control assessment Assessment documentation
• •
Authorization decision Authorization documentation
• •
Operations plan update Annual life cycle walkthrough
1270 1271 1272 1273 1274 1275 1276 1277
Fig. 5. Assessment and authorization life cycle phases
Initiation Phase The initiation phase consists of three tasks: (i) preparation, (ii) resource identification, and (iii) operations plan analysis and acceptance. The primary purpose of this phase is to ensure that the issuer is prepared for the assessment, including having all resources and documentation in place. The other purpose of this phase is to include the DAO early in the process to ensure the success of the assessment and authorization.
1278
Task 1: Preparation
1279 1280 1281
The objectives of this task are to prepare for authorization by reviewing the operations plan and confirm that the plan is consistent with [FIPS201] and the template provided in Appendix D.
1282 1283
Subtask 1.1: Confirm that the operations of the issuer are fully described and
documented in their operations plan.
31
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1284
Responsibility: EIMO
1285 1286 1287 1288 1289 1290 1291 1292 1293 1294
Guidance: The operations plan includes, at a minimum, the sections defined in the
1295 1296 1297
Subtask 1.2: Confirm that the processes performed are conducted in accordance
1298
Responsibility: EIMO, Issuing Facility Manager
1299 1300 1301
Guidance: Even though an issuer follows the requirements of [FIPS201], its processes need to be consistent within the operations plan and documented in standard operating procedures.
operations plan template in Appendices D.1 or D.2, depending on whether the issuer is issuing PIV Cards or derived PIV credentials. An issuer of both PIV Cards and derived PIV credentials could develop a single operations plan that addresses both without repeating common elements. It is the EIMO’s responsibility to ensure that the operations plan incorporates a complete and accurate description of the issuer’s operations. If a process or function is provided by an external service provider, their operating procedures need to be documented and incorporated by reference in the issuer’s operations plan. In such cases, the operations plan could point readers to additional documentation and information. with the policies and procedures specified in the issuer’s operations plan and are documented in standard operating procedures.
1302
Task 2: Resource Identification
1303 1304 1305 1306
The objectives of the resource identification task are to (i) identify and document the resources required for assisting with the assessment, (ii) identify the scope of the assessment and authorization boundary, and (iii) prepare a plan of assessment activities that indicate the proposed schedule and key milestones.
1307 1308 1309 1310 1311
Subtask 2.1: Identify the SAO, DAO, PO, issuing facility managers, assessor, and
1312
Responsibility: EIMO
1313 1314
Guidance: Notify these individuals of the upcoming assessment, and inform them
1315
Subtask 2.2: Determine the authorization boundary for the issuer.
1316
Responsibility: EIMO, DAO
1317 1318 1319 1320 1321 1322 1323
Guidance: The authorization boundary determines the target of the assessment. In
other key personnel at the facility level who are performing functions, such as identity proofing/registration, card/token production, and activation/issuance (of the PIV Card or derived PIV credential). Maintenance personnel also need to be contacted to provide requested assessment information to the assessor.
of the need for their participation during the process.
preparation for the issuer assessment, the EIMO and DAO need to identify which issuing facilities and external service providers are to be included. This ensures that the functions performed and processes managed by the external service provider are considered during the authorization process. An organization could consider including only those issuing facilities that are ready to operate within the scope of the issuer assessment; other facilities can be assessed at a later date.
32
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1324 1325
Subtask 2.3: Determine the resources and the time needed for the assessment of
1326
Responsibility: EIMO, Assessor, DAO
1327 1328 1329 1330 1331 1332 1333
Guidance: The level of effort required for an assessment depends on numerous
the issuer, and prepare a plan to execute the assessment.
factors, such as (i) the size of the issuer, (ii) the location and number of its facilities, (iii) the level of outsourcing utilized by the issuer, and (iv) the number of cards and/or derived PIV credentials being issued. By examining factors that could influence the complexity of the assessment, the organization can make an informed judgment about the size of the assessment team, the resources needed to support the assessment, and the time frame for completing it.
1334
Task 3: Operations Plan Analysis and Acceptance
1335 1336 1337 1338
The objectives of the operations plan analysis and acceptance task are to (i) determine whether the requirements of [FIPS201] have been implemented, (ii) evaluate the operations plan and revise as needed, and (iii) obtain acceptance of the plan by the DAO prior to assessing the issuer controls.
1339 1340 1341
Subtask 3.1: Review the list of required issuer controls documented in the
1342
Responsibility: DAO, EIMO
1343 1344 1345 1346 1347 1348
Guidance: Since the issuer controls serve as the basis for the assessment, review
1349 1350 1351 1352 1353 1354 1355 1356 1357
Subtask 3.2: Analyze the operations plan to determine whether there are
1358
Responsibility: DAO, EIMO
1359 1360 1361
Guidance: The operations plan adequately addresses the policies, procedures, and
1362
Subtask 3.3: Verify that the operations plan is acceptable.
1363
Responsibility: DAO
organization’s issuer operations plan, and confirm that they have been implemented properly.
the operations plan and supporting documentation to identify the controls that need to be implemented before investing time in assessment activities, such as interviews or testing. The operations plan documents each issuer control (whether it is specific to the organization or facility), the owner of the issuer control, and how the control is implemented. deficiencies in satisfying all of the policies, procedures, and other requirements in [FIPS201] that could result in a DATO being issued. After discussing the discovered deficiencies in the documentation and operations plan with the EIMO, the organization may still want to continue with the assessment if it has determined that it can address all deficiencies within the time period of the current assessment. In this situation, the DAO either authorizes continuation of the assessment or terminates the assessment effort, depending on the evaluation of the issuer’s ability to address the deficiencies.
processes of the issuer so that after an initial review, deficiencies that could lead to an eventual DATO can be identified and remediated as soon as possible.
33
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Guidance: If the operations plan is deemed acceptable, the DAO authorizes the
authorization processes to advance to the next phase. Acceptance of the operations plan signifies that the resources required to initiate and complete the authorization activities can be deployed. Assessment Phase The assessment phase consists of two tasks: (i) issuer control assessment and (ii) assessment documentation. The purpose of this phase is to determine the extent to which the requirements of [FIPS201] are implemented correctly, operating as intended, and producing the desired outcomes. This phase also specifies the actions to be taken to correct all identified deficiencies. An analysis of the impacts of identified deficiencies that cannot be corrected or mitigated efficiently on the reliable operation of the issuer is conducted and documented. The successful completion of this phase provides the DAO with the information needed to make an appropriate authorization decision.
1377
Task 4: Issuer Control Assessment
1378 1379 1380 1381 1382 1383 1384 1385 1386 1387
The objectives of this task are to (i) initiate and assess the applicable issuer controls and (ii) document the results of the assessment. The assessor first verifies the acceptability of all documentation, including the operations plan and previous assessments, along with all relevant federal laws, regulations, standards, and directives. Issuer control assessment then commences. The assessor also schedules interviews and real-time observations of issuance processes and initiates all needed testing of the PIV Card, derived PIV credential, and relevant information system components. Once the assessor has gathered the results of the assessment procedures, they prepare descriptions of all discovered deficiencies along with recommendations for addressing and remediating those deficiencies.
1388 1389
Subtask 4.1: Review the suggested and selected assessment methods for each
1390
Responsibility: Assessor
1391 1392 1393 1394 1395 1396 1397 1398 1399
Guidance: The scope of the assessment is established based on the authorization
1400 1401 1402 1403
Subtask 4.2: Assemble all documentation and the supporting materials necessary
1404
Responsibility: EIMO, Assessor
issuer control in preparation for the assessment.
boundary. The assessor reviews the selected assessment procedures (based on the scope of the assessment) in order to plan and coordinate activities for the assessment. For example, if a particular issuer control requires the observation of a particular process, the assessor needs to schedule the activity in a timely fashion after coordinating with the issuing facility management. The assessor, as directed by the DAO, may supplement the assessment methods and procedures recommended in these guidelines. Assessment methods and procedures may be created or tailored for a particular issuer. for the assessment of the issuer. If these documents include previous assessments, review the findings, and determine whether they are applicable to the current assessment.
34
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416
Guidance: The EIMO assists the assessor in gathering all relevant documents and
1417 1418 1419 1420 1421 1422
The assessor is strongly encouraged to review the results of any previous assessments, including the one on which the current ATO is based. The assessor might satisfy some of the issuer control assessment requirements by reviewing and referencing previous assessment reports. Although previous assessments cannot be used as a substitute for the current assessment, they provide insight on problems that could have existed in the past.
1423 1424 1425
Subtask 4.3: Assess the required issuer controls using the prescribed assessment
1426
Responsibility: Assessor
1427 1428 1429 1430 1431 1432 1433 1434 1435
Guidance: The assessor performs the assessment procedures selected for each
1436 1437 1438 1439 1440 1441 1442 1443
As part of an assessment, all applicable issuer controls need to be assessed. If PIV or derived PIV services have been outsourced to an external provider, the assessor verifies that the issuer controls that apply to those services are assessed, and the reliability of the service provider is found to be satisfactory. If an issuer and its facilities have already been assessed and are operating under a current ATO and the purpose of the assessment is to add a facility to the authorization letter, the assessor can reuse the results of a previous assessment for the organization-level issuer controls and assess a random sample of the new issuing facilities.
1444
Subtask 4.4: Prepare the assessment report.
1445
Responsibility: Assessor
1446 1447
Guidance: The assessment report contains (i) the results of the assessment, (ii)
supporting materials from the organization that are required during the assessment of the issuer. The operations plan is central to this effort. The issuer’s operations are completely described in the operations plan. The operations plan also includes or points to the supporting materials. In this case, the EIMO needs to gather the supporting material for the assessor. Examples of other documentation include (i) letters of appointment; (ii) privacy-related documentation; (iii) information forms utilized by the issuer; (iv) documentation from each outsourced service provider, including control implementation specifics, support and service-level agreements, and contracts; (v) standard operating procedures for the issuing facilities within the authorization boundary; and (vi) signed authorization letters under [SP800-37] for all information systems.
procedures found in Appendices G.1 and G.2 based on the scope of the issuance functions.
issuer control to determine whether they have been implemented correctly, are operating as intended, and producing the desired outcomes. The assessor uses the assessment methods specified in Sec. 4.1. The documentation collected in the previous task is reviewed, and any deficiencies are identified. Interviews can be used as an opportunity to clarify issues encountered during a review of the issuer’s documentation and to determine the expertise of the personnel performing key PIV functions. Processes need to be observed to ensure that PIV components have been configured and are operating in a PIV-compliant manner.
recommendations for correcting deficiencies, and (iii) the residual risk to the 35
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1448 1449 1450 1451
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
organization if those deficiencies are not corrected or mitigated. The assessment report is the assessor’s statement of the results of analyzing and evaluating the issuer’s implementation of controls. The sample assessment report in Appendix E provides a template for documenting the results after assessing the issuer controls.
1452
Task 5: Assessment Documentation
1453 1454 1455 1456 1457 1458
This task consists of the assessor submitting the assessment report to the EIMO, who then adds the issuer’s operations plan (revised, if necessary) and the CAP to generate an authorization submission package for the DAO. If the assessment report contains deficiencies, the EIMO might choose to address some deficiencies based on the assessor’s recommendations and revise the operations plan (if needed) before submitting the package for authorization.
1459
Subtask 5.1: Provide the EIMO with the assessment report.
1460
Responsibility: Assessor
1461 1462 1463 1464 1465 1466 1467 1468 1469
Guidance: The EIMO relies on the expertise, experience, and judgment of the
1470 1471
Subtask 5.2: Revise the operations plan (if necessary), and implement its new
1472
Responsibility: EIMO
1473 1474
Guidance: The revised operations plan includes all of the changes made in
1475
Subtask 5.3: Prepare the CAP.
1476
Responsibility: EIMO
1477 1478 1479 1480 1481 1482
Guidance: The CAP is one of the three primary documents in the authorization submission package and describes actions that need to be taken by the EIMO to correct the deficiencies identified in Task 4, Issuer Control Assessment. The CAP identifies (i) the tasks to be accomplished, (ii) the resources required to accomplish the tasks, (iii) scheduled completion dates for the tasks, and (iv) the person responsible for completing each of the tasks.
1483 1484
Subtask 5.4: Assemble the authorization submission package, and submit it to the
1485
Responsibility: EIMO
1486 1487
Guidance: The EIMO is responsible for the assembly and compilation of the
assessor to (i) provide recommendations on how to correct deficiencies in the planned or performed operations and (ii) understand the potential impacts of those deficiencies. The EIMO can choose to act on selected recommendations of the assessor before the authorization package is finalized. Any actions taken by the EIMO prior to the final authorization decision need to be coordinated with the DAO to optimize the utilization of resources across the organization. The assessor reviews any changes made in response to the corrective actions and revises the assessment report, as appropriate.
provisions.
response to the assessor’s recommendations for corrective actions.
DAO.
authorization submission package. The authorization submission package contains
36
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
(i) the final assessment report, (ii) the CAP, (iii) the revised operations plan, and (iv) the [SP800-37] authorization letters for all information systems used by the issuer. The EIMO may wish to consult other key organization participants (e.g., the assessor, PO) prior to submitting the authorization submission package to the DAO. The authorization submission package can be submitted in either paper or electronic form. The contents of the authorization submission package need to be protected in accordance with organization policy. Authorization Phase The authorization phase consists of two tasks: (i) making an appropriate authorization decision and (ii) completing the authorization documentation. Upon completion of this phase, the EIMO will have one of the following: (i) an authorization to operate the issuer’s services, as defined in its operations plan; (ii) an interim authorization to operate under specific terms and conditions; or (iii) a denial of authorization to operate.
1501
Task 6: Authorization Decision
1502 1503 1504 1505 1506 1507 1508
The authorization decision task determines whether the assessment phase has been satisfactorily completed so that a recommendation on the operation of the issuer can be made with assurance. The DAO works with the assessor to review the contents of the assessment submission package, the identified and uncorrected or uncorrectable deficiencies, the potential impacts of using the issuer’s services, and the CAP to determine the final risk to the organization and the acceptability of that risk in light of the organization’s mission.
1509 1510 1511
Subtask 6.1: Review the authorization decision package to see if it is complete and
1512
Responsibility: DAO
1513 1514 1515 1516 1517
Guidance: Coverage for all issuer controls and proper adherence to assessment
1518 1519
Subtask 6.2: Determine whether the risk to the organization’s operations, assets,
1520
Responsibility: DAO
1521 1522 1523 1524 1525 1526 1527 1528
Guidance: After the completion of the assessment review, the DAO has a clear
if all applicable issuer controls are fully assessed using the designated assessment procedures.
procedures and appropriate assessment methods help create confidence in assessment findings and is the main objective of the assessment review. Part of the assessment review also includes understanding the impacts of the identified deficiencies on the organization’s operations, assets, and individuals. or potentially affected individuals is acceptable.
understanding of the impacts of deficiencies. This helps the DAO judge which deficiencies are of greatest concern to the organization and which can be tolerated without creating unreasonable organization-level risk. The CAP is also considered when determining the risk to the organization in terms of when and how the EIMO intends to address the known deficiencies. The DAO may consult the EIMO, assessor, or other organization officials before completing the final risk evaluation. This risk evaluation then determines the degree of acceptability of 37
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1529 1530
issuer operations. The logic for using the latter as the basis for an authorization decision is described in Sec. 2.10.
1531 1532
Subtask 6.3: Share the authorization package with an independent party for
1533
Responsibility: DAO
1534 1535 1536 1537 1538 1539
Guidance: Before providing the final authorization decision, the DAO may seek
review, and arrive at an authorization decision.
an independent review of the risks involved in the issuer operations. If the DAO finds it necessary, the DAO shares the results of the assessment and the perceived risks with another issuer (e.g., another agency that issues PIV Cards or derived PIV credentials) to get their opinion and establish trustworthiness in the issued credentials.
1540
Task 7: Authorization Documentation
1541 1542 1543
The authorization documentation task includes (i) completing and transmitting the authorization decision package to the appropriate individuals and organizations and (ii) updating the issuer’s operations plan.
1544 1545 1546
Subtask 7.1: Provide copies of the authorization decision package in either paper
1547
Responsibility: DAO
1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560
Guidance: The authorization decision package, including the authorization
decision letter, is transmitted to the EIMO. Upon receipt of the authorization decision package, the EIMO reviews the authorization and its terms and conditions. The original authorization decision package is kept on file by the EIMO. The DAO retains copies of the contents of the authorization decision package. The authorization decision package needs to be appropriately safeguarded and stored in a centralized organization filing system whenever possible to ensure accessibility. The authorization decision package is made available to authorized auditors and oversight organizations upon request. The authorization decision package needs to be retained in accordance with the organization’s records retention policy. The issuer and specific facilities are authorized for a maximum of three years from the date of the ATO. After the period ends, reauthorization is performed.
1561
Subtask 7.2: Update the operations plan.
1562
Responsibility: EIMO
1563 1564 1565 1566
Guidance: The operations plan needs to be updated to reflect all changes made as
or electronic form to the EIMO and any other organization officials who have interests, roles, or responsibilities in the issuer’s operations.
a result of the assessment and authorization. All conditions of the issuer’s operations that are set forth in the authorization decision need to be noted in the plan and addressed in a timely manner, as conveyed by the DAO.
38
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1567
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Monitoring Phase
1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578
The Monitoring Phase consists of two tasks: (i) operations plan maintenance and (ii) an annual life cycle walkthrough. Based on the importance of reliably creating and issuing PIV Cards and derived PIV credentials, it is imperative that once the authorization is completed, the issuer’s operations are monitored to ensure that policies, procedures, and processes remain in effect as originally intended. There can be significant changes in an issuer’s policies, management, operations personnel, and available technology during a three-year ATO. These changes need to be monitored so that the organization minimizes exposing itself to security and privacy threats that exist or arise after the authorization of the issuer. For example, if there is significant staff turnover, the organization needs to be sure that new staff are performing the PIV functions using the same reliable processes that were previously approved. The overall responsibility for monitoring lies with the EIMO and the DAO.
1579 1580 1581 1582 1583
An annual life cycle walkthrough of issuer operations involves reviewing all of the services and functions of an issuer and its facilities for continued reliability. The annual walkthrough covers the life cycle of PIV Card and derived PIV credential from sponsorship to maintenance. Observation of the full life cycle ensures that all processes are still reliably operating as assessed during the authorization.
1584
Task 8: Operations Plan Update
1585 1586 1587 1588 1589
An operations plan serves as the primary description on how PIV Cards or derived PIV credentials are being issued by the issuer. It is essential that this document be updated as changes occur in the issuer’s operations. Management will be able to analyze the impacts of changes as they occur and be significantly better prepared when reauthorization is required.
1590 1591
Subtask 8.1: Document all relevant changes in the issuance processes within the
1592
Responsibility: EIMO
1593 1594 1595
Guidance: If changes are made to the information system, the issuer needs to
operations plan.
update the operations plan, PIV Card, derived PIV credential, privacy policies, roles and responsibilities, and issuer controls.
1596 1597
Subtask 8.2: Analyze the proposed or actual changes to the issuer, and determine
1598
Responsibility: EIMO
1599 1600 1601 1602
Guidance: If the results of the impact analysis indicate that changes to the issuer
the impacts of such changes.
affect the reliability of its operations, the changes and impacts need to be reported to the DAO, corrective actions need to be initiated, and the CAP needs to be updated. If major changes have occurred, the issuer will need to be reauthorized.
1603
Task 9: Annual Life Cycle Walkthrough
1604 1605 1606 1607
The annual life cycle walkthrough is a monitoring activity to be performed by the issuer when its PIV Card or derived PIV credential issuing services begin and annually thereafter. The EIMO (or designated appointee) is responsible for observing and reviewing the entire life cycle of the PIV Card or derived PIV credential. This 39
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1608 1609 1610 1611
walkthrough is intended to provide an accurate and holistic view of the issuer’s operations and reliability at a point in time. Any potential impacts to the reliability of the issuer’s operations and risks to the organization need to be documented and presented to the EIMO and the DAO.
1612 1613 1614 1615 1616
Subtask 9.1: Observe all of the processes involved in getting a PIV Card or a
1617
Responsibility: EIMO (or designated appointee)
1618 1619 1620 1621 1622 1623
Guidance: As part of the walkthrough, the EIMO (or designated appointee)
1624 1625 1626
Subtask 9.2: The results of the life cycle walkthrough are summarized in a report
1627
Responsibility: EIMO, DAO
1628 1629 1630 1631 1632
Guidance: The EIMO (or designated appointee) documents the results of the
derived PIV credential, including those from sponsorship to maintenance. Observe each process, and compare its controls against the applicable list of required issuer controls. If an issuer has several facilities, this process needs to be repeated using randomly selected issuing facilities.
observes the processes followed for new employees and contractors (if different) as well any maintenance processes, such as termination, reissuance, or renewals. The EIMO (or designated appointee) observes each process and compares it to the documented steps for the issuer and the associated issuer controls. An annual walkthrough is required until reauthorization is initiated. to the DAO. The report highlights any deficiencies and the corrective actions that need to be implemented to correct those deficiencies.
walkthrough, which are recorded in the assessment report template included in Appendix E. All deficiencies need to be highlighted, and a plan for correcting each deficiency needs to be documented. The DAO decides whether any deficiency is significant enough to require a change of the issuer’s ATO status.
40
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1633
References
1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677
[A-130]
[COMMON]
[CSP]
[E-GOV] [FCS]
[FIPS140]
[FIPS199]
[FIPS200]
[FIPS201]
[FPKI]
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Office of Management and Budget (2016) Managing Information as a Strategic Resource. (The White House, Washington, DC), OMB Circular A130, July 28, 2016. Available at https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/ a130revised.pdf Federal Public Key Infrastructure Policy Authority (2023) X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework. (Federal CIO Council), Version 2.5 [or as amended]. Available at https://www.idmanagement.gov/docs/fpki-x509-cert-policy-common.pdf U.S. Office of Personnel Management (2020) Credentialing Standards Procedures for Issuing Personal Identity Verification Cards under HSPD-12 and New Requirement for Suspension or Revocation of Eligibility for Personal Identity Verification Credentials (U.S. Office of Personnel Management, Washington, DC), December 15, 2020. Available at https://www.opm.gov/suitability/suitability-executive-agent/policy/credstandards.pdf E-Government Act of 2002, Pub. L. 107-347, 116 Stat 2899. Available at https://www.govinfo.gov/app/details/PLAW-107publ347 U.S. Office of Personnel Management (2008) Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12. (U.S. Office of Personnel Management, Washington, DC), July 31, 2008. Available at https://www.opm.gov/suitability/suitability-executive-agent/policy/finalcredentialing-standards.pdf National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 140-3 [or as amended]. https://doi.org/10.6028/NIST.FIPS.140-3 National Institute of Standards and Technology (2004) Standards for Security Categorization of Federal Information and Information Systems. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 199 [or as amended]. https://doi.org/10.6028/NIST.FIPS.199 National Institute of Standards and Technology (2006) Minimum Security Requirements for Federal Information and Information Systems. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 200 [or as amended]. https://doi.org/10.6028/NIST.FIPS.200 National Institute of Standards and Technology (2022) Personal Identity Verification (PIV) of Federal Employees and Contractors. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 201-3 January 2022. https://doi.org/10.6028/NIST.FIPS.201-3 Federal Public Key Infrastructure Policy Authority (2022) Federal Public Key Infrastructure (FPKI) Annual Review Requirements. (Federal CIO Council),
41
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722
[HSPD-12]
[NIST IR 7817]
[M-03-22]
[M-05-24]
[M-19-17]
[PAPER-RED] [PRIVACY] [REAL-ID]
[SP800-37]
[SP800-53]
[SP800-63]
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Version 1.2 [or as amended]. Available at https://www.idmanagement.gov/docs/fpki-annual-review-requirements.pdf Bush, GW (2004) Policy for a Common Identification Standard for Federal Employees and Contractors. (The White House, Washington, DC), Homeland Security Presidential Directive HSPD-12. Available at https://www.dhs.gov/homeland-security-presidential-directive-12 Ferraiolo H (2012) A Credential Reliability and Revocation Model for Federated Identities. (National Institute of Standard and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7817. https://doi.org/10.6028/NIST.IR.7817 Office of Management and Budget (2003) OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. (The White House, Washington, DC), OMB Memorandum M-03-22, September 26, 2003. Available at https://obamawhitehouse.archives.gov/omb/memoranda_m03-22/ Office of Management and Budget (2005) Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, (The White House, Washington, DC), OMB Memorandum M-05-24, August 05, 2005. Available at https://georgewbushwhitehouse.archives.gov/omb/memoranda/fy2005/m05-24.pdf Office of Management and Budget (2019) Enabling Mission Delivery through Improved Identity, Credential, and Access Management. (The White House, Washington, DC), OMB Memorandum M-19-17, May 21, 2019. Available at https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf Paperwork Reduction Act of 1995, Pub. L. 104-13, 109 Stat 163. https://www.govinfo.gov/content/pkg/PLAW-104publ13/pdf/PLAW104publ13.pdf Privacy Act of 1974, Pub. L. 93-579, 88 Stat 1896. https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88Pg1896.pdf “Minimum Standards for Driver’s Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes; Final Rule,” 73 Federal Register 5271 (January 29, 2008), pp 5271-5340. https://www.federalregister.gov/d/08-140 Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2 [or as amended]. https://doi.org/10.6028/NIST.SP.800-37r2 Joint Task Force (2020) Security and Privacy Controls for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 5 [or as amended]. https://doi.org/10.6028/NIST.SP.800-53r5 Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST
42
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766
[SP800-63A]
[SP800-63B]
[SP800-63C]
[SP800-73]
[SP800-76]
[SP800-78]
[SP800-156]
[SP800-157]
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Special Publication (SP) 800-63-3, Includes updates as of March 02, 2020 [or as amended]. https://doi.org/10.6028/NIST.SP.800-63-3 Grassi PA, Fenton JL, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Enrollment and Identity Proofing. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63A, Includes updates as of March 02, 2020 [or as amended]. https://doi.org/10.6028/NIST.SP.800-63A Grassi PA, Newton EM, Perlner RA, Regenscheid AR, Fenton JL, Burr WE, Richer JP, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Authentication and Lifecycle Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63B, Includes updates as of March 02, 2020 [or as amended]. https://doi.org/10.6028/NIST.SP.800-63B Grassi PA, Nadeau EM, Richer JP, Squire SK, Fenton JL, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Federation and Assertions. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63C, Includes updates as of March 02, 2020 [or as amended]. https://doi.org/10.6028/NIST.SP.800-63C Cooper DA, Ferraiolo H, Mehta KL, Francomacaro S, Chandramouli R, Mohler J (2015) Interfaces for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-73-4, Includes updates as of February 8, 2016 [or as amended]. https://doi.org/10.6028/NIST.SP.800-73-4 Grother PJ, Salamon WJ, Chandramouli R (2013) Biometric Specifications for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-76-2 [or as amended]. https://doi.org/10.6028/NIST.SP.800-76-2 Polk WT, Dodson DF, Burr WE, Ferraiolo H, Cooper DA (2015) Cryptographic Algorithms and Key Sizes for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-78-4 [or as amended]. https://doi.org/10.6028/NIST.SP.800-78-4 Ferraiolo H, Chandramouli R, Mehta KL, Mohler J, Skordinski S, Brady S (2016) Representation of PIV Chain-of-Trust for Import and Export. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-156 [or as amended]. https://doi.org/10.6028/NIST.SP.800-156 Ferraiolo H, Cooper DA, Francomacaro S, Regenscheid AR, Burr WE, Mohler J, Gupta S (2014) Guidelines for Derived Personal Identity Verification (PIV) Credentials. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-157 [or as amended]. https://doi.org/10.6028/NIST.SP.800-157
43
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1767
Appendix A. Acronyms
1768 1769
AAL Authentication Assurance Level
1770 1771
ATO Authorization to Operate
1772 1773
CAP Corrective Action Plan
1774 1775
CSP Credential Service Provider
1776 1777
DAO Designated Authorizing Official
1778 1779
DATO Denial of Authorization to Operate
1780 1781
DPCI Derived PIV Credential Issuer
1782 1783
EIMO Enterprise Identity Management Official
1784 1785
FIPS Federal Information Processing Standard
1786 1787
HSPD-12 Homeland Security Presidential Directive-12
1788 1789
IATO Interim Authorization to Operate
1790 1791
IDMS Identity Management System
1792 1793
OMB Office of Management and Budget
1794 1795
OPM Office of Personnel Management
1796 1797
PCI PIV Card Issuer
1798 1799
PII Personally Identifiable Information
1800 1801
PIV Personal Identity Verification
1802 1803
SAO Senior Authorizing Official
1804 1805
SOP Standard Operating Procedures
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
44
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1806 1807
SORN System of Records Notice
1808 1809
SRIP Supervised Remote Identity Proofing
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1810
45
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1811
Appendix B. Glossary
1812 1813 1814 1815
access control The process of granting or denying specific requests to (i) obtain and use information and related information processing services and (ii) enter specific physical facilities (e.g., federal buildings, military establishments, and border-crossing entrances).
1816 1817 1818
authorization (as applied to an issuer) The official management decision of the designated authorizing official to permit the operation of an issuer after determining that the issuer’s reliability has satisfactorily been established through appropriate assessment processes.
1819 1820 1821
authorization package The results of assessment and supporting documentation provided to the designated authorizing official to be used in the authorization decision process.
1822 1823 1824 1825
agency An executive department specified in 5 U.S.C., Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); or a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91.
1826 1827
applicant An individual applying for a PIV Card or a derived PIV credential.
1828 1829 1830 1831
assessment (as applied to an issuer) A formal process for assessing the implementation and reliable use of issuer controls using various methods of assessment (e.g., interviews, document reviews, observations) that support the assertion that an issuer is reliably meeting the requirements of [FIPS201].
1832 1833
assessment method A focused activity or action employed by an assessor to evaluate a particular issuer control.
1834 1835 1836
assessment procedure A set of activities or actions employed by an assessor to determine the extent to which an issuer control is implemented.
1837 1838 1839
assessor The third-party individual responsible for conducting assessment activities under the guidance and direction of a designated authorizing official.
1840 1841 1842 1843
authorization to operate (ATO) One of three possible decisions made by a designated authorizing official after all assessment activities have been performed that states that the issuer is authorized to perform PIV Card and/or derived PIV credential issuance services.
1844 1845 1846 1847 1848
activation/issuance A process that includes procuring FIPS-approved blank PIV Cards or hardware/software tokens (for derived PIV credentials), initializing them using appropriate software and data elements, personalizing the cards/tokens with the identity credentials or authenticators of authorized subjects, and picking up or delivering the personalized cards/tokens to the authorized subjects, along with appropriate instructions for protection and use.
1849 1850 1851
component An element such as a fingerprint capture station or card reader used by an issuer for which [FIPS201] has defined specific requirements.
1852 1853 1854 1855
corrective action plan (CAP) Corrective actions for an issuer to remove or reduce the deficiencies or risks that were identified by the assessor during the assessment of issuer operations. The plan identifies actions that need to be performed in order to obtain or sustain authorization.
46
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1856 1857 1858
credential An object or data structure that authoritatively binds an identity (and optionally, additional attributes) to a PIV Card or a hardware/software device that is possessed and controlled by a cardholder or subscriber.
1859 1860 1861
denial of authorization to operate (DATO) Issued by a designated authorizing official to an issuer that is not authorized as being reliable for the issuance of PIV Cards or derived PIV credentials.
1862 1863 1864 1865
derived PIV credential A credential issued based on proof of possession and control of the PIV Card so as not to duplicate the identity proofing process defined in [SP800-63]. A derived PIV credential token can be a hardware- or software-based token that meets the requirements of [SP800-157].
1866 1867
derived PIV credential issuer (DPCI) An issuer of a derived PIV credential, as defined in [SP800-157].
1868 1869
designated authorizing official (DAO) A senior organization official who has the authority to authorize the reliability of an issuer.
1870 1871 1872
enterprise identity management official (EIMO) The individual responsible for overseeing the operations of an issuer in accordance with [FIPS201] and for performing the responsibilities specified in this guideline.
1873 1874
Homeland Security Presidential Directive 12 (HSPD-12) HSPD-12 established the policy for which [FIPS201] was developed.
1875 1876 1877
identification The process of discovering the true identity (i.e., origin, initial history) of a person or item from the entire collection of similar persons or items.
1878 1879
identifier Unique data used to represent a person’s identity and associated attributes (e.g., a name, a card number).
1880 1881
identity The set of physical and behavioral characteristics by which an individual is uniquely recognizable.
1882 1883 1884
identity proofing Verifying the claimed identity of an applicant by authenticating the identity source documents provided by the applicant.
1885 1886 1887
information system A computer-based system used by an issuer to perform the functions necessary for PIV Card or derived PIV credential issuance, as per [FIPS201].
1888 1889 1890 1891
interim authorization to operate (IATO) Issued by a designated authorizing official to an issuer who is not satisfactorily performing PIV Card and/or derived PIV credential specified services (e.g., identity proofing/registration, if applicable; card/token production; activation/issuance and maintenance).
1892 1893 1894
issuer An entity that performs the functions required to produce, issue, and maintain PIV Cards or derived PIV credentials for an organization.
1895 1896 1897
issuing facility A physical site or location that is responsible for carrying out one or more of the PIV functions, including all equipment, staff, and documentation.
47
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1898 1899 1900
maintenance The process of managing PIV Cards or derived PIV credentials once they are issued, including reissuance, postissuance updates, and termination.
1901 1902 1903 1904 1905 1906 1907
mobile device A portable computing device that (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable, or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the devices to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, tablets, and e-readers.
1908 1909 1910
personally identifiable information (PII) Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. [E-GOV]
1911 1912 1913 1914 1915
PIV Card The physical artifact (e.g., identity card, “smart” card) issued to an applicant by an issuer that contains stored identity markers or credentials (e.g., a photograph, cryptographic keys, digitized fingerprint representations) so that the claimed identity of the cardholder can be verified against the stored credentials by another person (i.e., humanreadable and verifiable) or an automated process (i.e., computer-readable and verifiable).
1916 1917 1918
PIV credential Evidence that attests to one’s right to credit or authority that authoritatively binds an identity (and, optionally, additional attributes) to an individual.
1919 1920 1921 1922
PIV identity account The logical record that contains credentialing information for a given PIV cardholder. This is stored within the issuer’s identity management system and includes PIV enrollment data, cardholder identity attributes, and information regarding the cardholder’s PIV Card and any derived PIV credentials bound to the account.
1923 1924 1925
post-enrollment binding An association of the issued derived PIV credential to the subscriber’s PIV identity account, as specified in [SP80063B].
1926 1927 1928 1929 1930 1931
registration Making a person’s identity known to the enrollment/identity management information system by associating a unique identifier with that identity and collecting and recording the person’s relevant attributes into the information system. Registration is required for adjudication, card/credential personalization and issuance, and maintenance, which are necessary to issue or maintain a PIV Card or derived PIV credential. Attributes about a cardholder and derived PIV credential holder may also be recorded in the individual’s PIV identity account.
1932 1933 1934
risk The level of potential impact on an organization’s operations (including mission, functions, image, or reputation), its assets, or individuals of a threat or a given likelihood of that threat occurring.
1935 1936 1937
senior authorizing official (SAO) A senior organization official who has budgetary control, provides oversight, develops policy, and has authority over all functions and services provided by the issuer.
1938 1939
subscriber A PIV cardholder to whom a derived PIV credential has been issued.
1940 1941 1942 1943
system of record (SOR) A group of records under the control of a federal agency that contain a personal identifier (e.g., a name, date of birth, fingerprint, Social Security Number, Employee Number) and one other item of personal data (e.g., home address, performance rating, and blood type) from which information is retrieved using a personal identifier.
48
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1944 1945 1946
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
System of Records Notice (SORN) Ensures that privacy considerations have been addressed in the implementation of a system. The Privacy Act requires each agency to publish a notice of its systems of records in the Federal Register.
1947
49
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1948
Appendix C. Issuer Readiness Review Checklist
1949 1950 1951 1952
The readiness review checklist is to be used by the organization while preparing for an assessment of their issuer. The checklist may also be used to validate that all relevant documentation is collected and that appropriate individuals have been identified and made available to the assessment team.
1953
Table 5. Issuer readiness review checklist Activity Identify a third-party assessment team to support the assessment of the issuer. Determine the authorization boundary. Establish the scope and objectives of the assessment. Determine the level of effort and resources necessary to carry out the assessment. Establish the time frame to complete the assessment and identify key milestone decision points. Notify key personnel at the issuing facility and any external service providers (if applicable) of the impending assessment. Validate that the operations plan is complete and includes all required information. Ensure that the necessary roles have been designated. Validate that implementation and management responsibilities for issuer controls have been accurately assigned. Ensure that the information systems utilized by the issuer are assessed and authorized to operate in accordance with [SP800-37]. Ensure that the following documentation has been developed and made available to the assessment team: • Operations plan • Results from any past assessment and authorization • Letters of appointment (if any) • Service-level agreements (SLA) and memoranda of understanding (MOU) between the organization and service providers • List of all HSPD-12 components used within the PIV system • Privacy-related documentation • All forms utilized by the issuer • Documentation from outsourced providers • Standard operating procedures for the issuing facilities within the authorization boundary • Signed authorization letter under [SP800-37] for each information system within scope of the assessment
Completed
50
Comments
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
1954
Activity Prior to authorization, an independent third party has been consulted and has reviewed the assessment (if needed). The PIV system is operational, and actual PIV processes can be observed by the assessment team. PIV Cards or derived PIV Credential tokens are ready to be personalized and can be used for testing by the assessment team. Personalized PIV Cards and/or derived PIV credentials are submitted on an annual basis to the FIPS 201 Evaluation Program for testing and are issued from a production system.
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers Completed
51
Comments
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1955
Appendix D. Operations Plan Templates
1956 1957 1958 1959 1960
Appendices D.1 and D.2 are suggested outlines for a PCI and DPCI, respectively. It is highly recommended that an organization follow these templates to comprehensively document its operations in support of a successful authorization. An issuer of both PIV Cards and derived PIV credentials can develop a single operations plan that addresses all requirements without repeating common elements of the plan.
1961
D.1.
Operations Plan Template for PIV Card Issuers
1962
1. Background
1963 1964
<Provide a brief background on HSPD-12, FIPS 201, and PIV, as well as how the organization plans to meet the directive.>
1965
2. Purpose and Scope
1966
<Describe the purpose and scope of the operations plan.>
1967
3. Applicable Laws, Directives, Policies, Regulations, and Standards
1968 1969
<Identify all laws, directives, policies, regulations, and standards that govern PIV Card issuance at the organization.>
1970
4. PCI Roles and Responsibilities
1971 1972
<Identify the authorization-related roles and responsibilities of all key personnel within the PCI.>
1973
5. Assignment of Roles
1974 1975 1976
<Document how the various roles that have been identified in the section above are appointed. These can be either specific individuals or positions within the organization. Provide contact information for all the roles assigned.>
1977
6. PCI Description
1978 1979
<Provide a description of the organization’s PCI. Details such as structure and geographic dispersion should be included.>
1980
7. Issuing Facility Details
1981 1982 1983 1984
<Identify all of the issuing facilities that are included and part of the authorization boundary. Provide details, such as the location, the PIV Card processes performed (e.g., registration, issuance, etc.) at the facility, and the approximate number of PIV Cards personalized at each facility.>
1985
8. PCI Management
1986
<This section discusses various management aspects of the PCI.>
1987
a. Coordination and interaction
1988 1989
<Describe the management interactions within the PCI, both at an organization level and between the organization and the facilities.>
52
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
1990
b. Staffing
1991 1992
<Describe the procedures employed to ensure that adequate staff are available to perform PIV Card issuance-related functions.>
1993
c. Training
1994 1995
<Describe the procedures employed to ensure that staff are properly trained to perform their respective duties.>
1996
d. Procurement
1997 1998
<Describe the mechanism typically used for procuring products/services related to the organization’s HSPD-12 implementation.>
1999
e. Outsourcing
2000
<Describe the PIV Card functions being outsourced (if applicable).>
2001
9. PCI Policies and Procedures
2002 2003 2004 2005
<Describe the various policies and procedures that apply for (i) sponsorship, (ii) identity proofing/registration, (iii)adjudication, (iv) PIV Card production, (v) activation and issuance, and (vi) maintenance. Also discuss the procedures for temporary badges and non-PIV badges employed by the organization.>
2006
a. Sponsorship
2007
b. Identity proofing and registration
2008
c. Adjudication
2009
d. PIV Card production
2010
e. Activation/issuance
2011
f. Maintenance
2012
i. Reissuance
2013
ii. Post-issuance updates
2014
iii. Termination
2015
g. Temporary/non-PIV badges
2016
10. PCI Issuance Information System Description
2017 2018 2019 2020
<Provide a description of the technical aspects of the organization’s PIV issuance system, including system architecture, network connectivity, connections to external systems and information shared both internally and externally, the PKI provider, and the information system authorization status.>
2021
a. Architecture
2022
b. Interconnections and information sharing
2023
c. Information system inventory
2024
d. Public key infrastructure
53
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2025
e. [SP800-37] Authorization letters
2026
11. Card Personalization and Production
2027 2028 2029 2030
<Describe the organization’s PIV Card graphical layouts and the (optional) data of the containers being used. Provide details on PIV Card expiration date requirements levied by the organization, and describe the mechanisms in place for securing both prepersonalized and personalized PIV Card stock.>
2031
a. PIV Card graphical topology
2032
b. PIV Card electronic data elements
2033
c. Expiration date requirements
2034
d. Card inventory management
2035
12. Issuer Controls
2036 2037 2038 2039
<This section documents the issuer controls (Appendix G.1) and provides the following information for each: (i) issuer control identifier and description, (ii) control owner, (iii) whether the control is organization-specific or facility- specific, and (iv) a description of how the issuer control has been implemented by the organization.>
2040
a. Issuer control identifier and control description
2041
b. Issuer control owner
2042
c. Organization/facility-specific
2043
d. How the issuer control is implemented
2044
Appendix I — Memoranda of Appointment
2045 2046 2047
<Attach copies of signed memoranda of appointment that record the various roles that have been assigned and the personnel who have accepted the roles and their associated responsibilities.>
2048
Appendix II — Privacy Requirements
2049
<Attach copies of privacy-related information, as identified below.>
2050
a. Privacy policy
2051
b. Privacy impact assessment
2052
c. System of record notice
2053
d. Privacy Act statement/notice
2054
e. Rules of conduct
2055
f. Privacy processes
2056
i. Requests to review personal information
2057
ii. Requests to amend personal information
2058
iii. Appeal procedures
2059
iv. Complaint procedures
54
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2060 2061
Appendix III — Service-Level Agreements and Memoranda of Understanding (MOU)
2062 2063 2064
<Attach copies of any service-level agreements and memoranda of understanding executed between the organization and any external service provider that has been contracted to provide PIV-related functions.>
2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089
D.2.
Operations Plan Template for Derived PIV Credential Issuers 1. Background <Provide a brief background on HSPD-12, FIPS 201, PIV, and SP 800-157, as well as how the organization plans to meet the directive.> 2. Purpose and Scope <Describe the purpose and scope of the operations plan.> 3. Applicable Laws, Directives, Policies, Regulations, and Standards <Identify all laws, directives, policies, regulations, and standards that govern derived PIV credential issuance at the organization.> 4. DPCI Roles and Responsibilities <Identify the authorization-related roles and responsibilities of all key personnel within the DPCI.> 5. Assignment of Roles <Document how the various roles that have been identified in the section above are appointed. These can be specific individuals or positions within the organization. Provide contact information for all roles assigned.> 6. DPCI Description <Provide a description of the organization’s DPCI. Details such as structure and geographic dispersion should be included.> 7. Issuing Facility Details <If applicable, identify all of the issuing facilities that are included and part of the authorization boundary. Provide details, such as the location, the derived PIV credential functions performed at the facility, and the types and approximate number of derived PIV credentials personalized at each facility. Indicate whether issuance is conducted remotely in 6.>
2090
8. DPCI Management
2091
<This section discusses the various management aspects of the DPCI.>
2092
a. Coordination and Interaction
2093 2094
<Describe the management interactions within the DPCI, both at an organization level and between the organization and facilities.>
55
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2095
b. Staffing
2096 2097
<Describe the procedures employed to ensure that adequate staff are available to perform derived PIV credential-related issuance functions.>
2098
c. Training
2099 2100
<Describe the procedures employed to ensure that staff are properly trained to perform their respective duties.>
2101
d. Procurement
2102 2103
<Describe the mechanism typically used for procuring products/services related to the organization’s HSPD-12 implementation.>
2104
e.
2105 2106
<Describe the derived PIV credential functions being outsourced (if applicable).>
Outsourcing
2107
9.
DPCI Policies and Procedures
2108 2109 2110
<Describe the various policies and procedures that apply for (i) sponsorship, (ii) postenrollment binding, (ii) token production, (ii) activation and issuance, and (iv) maintenance.
2111
a. Sponsorship
2112
b. Post-enrollment binding
2113
c. Token production (if applicable)
2114
d. Activation/issuance
2115
e. Maintenance
2116
i. Reissuance
2117
ii. Post-issuance updates
2118
iii. Termination
2119
10. DPCI Issuance System Description
2120 2121 2122 2123
<Provide a description of the technical aspects of the organization’s derived PIV credential issuance system, including system architecture, network connectivity, connections to external systems and information shared both internally and externally, the PKI provider (if applicable), and the information system authorization status.>
2124
a. Architecture
2125
b. Interconnections and information sharing
2126
c. Information system inventory
2127
d. Public key infrastructure
2128
e. [SP800-37] Authorization letters
56
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2129
11. Derived PIV Credential Details
2130 2131
<Provide details about the organization’s implementation of the derived PIV credential. Describe whether it is PKI or non-PKI-based and whether it is AAL2 or AAL3.>
2132
a. Derived PIV credential data elements
2133
b. Inventory management (for hardware-based)
2134
12. Issuer Controls
2135 2136 2137 2138
<This section documents the issuer controls (from Appendix G.2) and provides the following information for each: (i) issuer control identifier and description, (ii) control owner, (iii) whether the control is organization-specific or facility-specific, and (iv) a description of how the issuer control has been implemented by the organization.>
2139
a. Issuer control identifier and control description
2140
b. Issuer control owner
2141
c. Organization/facility-specific
2142
d. How the issuer control is implemented
2143
Appendix I — Memoranda of Appointment
2144 2145 2146
<Attach copies of signed memoranda of appointment that record the various roles that have been assigned and the personnel who have accepted the roles and their associated responsibilities.>
2147
Appendix II — Privacy Requirements
2148
<Attach copies of privacy-related information, as identified below.>
2149
a. Privacy policy
2150
b. Privacy impact assessment
2151
c. System of record notice
2152
d. Privacy Act statement/notice
2153
e. Rules of conduct
2154
f. Privacy processes
2155
i. Requests to review personal information
2156
ii. Requests to amend personal information
2157
iii. Appeal procedures
2158
iv. Complaint procedures
2159 2160
Appendix III — Service-Level Agreements and Memoranda of Understanding (MOU)
2161 2162 2163
<Attach copies of any service-level agreements and memoranda of understanding executed between the organization and any external service provider that has been contracted to provide derived PIV-related functions.>
57
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2164
Appendix E. Assessment Report Template
2165 2166
Below is a template to use when generating the assessment report. This is to be completed for each issuer control.
2167
Issuer Authorization Topic (IAT):
2168
Authorization Focus Area
2169
Issuer Control Identifier —
2170
Control Description —
2171 2172
Issuer Control Owner/Control Level — (External service provider, organization-specific, facility-specific)
2173
ASSESSMENT DETAILS
2174
Assessment Method(s):
2175
Review: (Artifacts)
2176
Observe: (Name of Process)
2177
Assessment Result — (Satisfied, Partially Satisfied, Not Satisfied, Not Applicable)
2178
Assessment Findings —
2179
Assessment Deficiency and Potential Impact —
2180
Recommendation —
2181
Summary Report Template
2182
IAT (% Satisfied, % Partially Satisfied, % Not Satisfied)
2183
For each Authorization Focus Area
2184
(% Issuer controls Satisfied, % Partially Satisfied, % Not Satisfied)
2185 2186
(% Review Assessments Satisfied, % Interview Assessments Satisfied, % Observe Assessments Satisfied, % Test Assessments Satisfied)
2187
58
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2188
Appendix F. Sample Transmittal and Decision Letters
2189
Sample Assessment/Authorization Package Transmittal Letter
2190
From: Enterprise Identity Management Official
2191
To: Designated Authorizing Official (DAO)
2192
Subject: Authorization Submission Package for [PCI/DPCI]
2193 2194 2195 2196 2197 2198
An assessment of the [PCI/DPCI NAME] located at [PCI/DPCI LOCATION AND ISSUING FACILITY LOCATIONS] has been conducted in accordance with NIST Special Publication (SP) 800-79r3, Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers, and the [ORGANIZATION] policy on authorization. The attached authorization package contains (i) the operations plan, (ii) the assessment report, (iii) a corrective actions plan (CAP), and (iv) [SP800-37] authorization letter(s) for each information system of the [ISSUER].
2199 2200 2201 2202 2203
The operations plan and its policies, procedures, and processes have been assessed by [ASSESSOR] using the assessment methods and procedures defined in SP 800-79r3 and specified in the assessment report to determine the extent to which the requirements under [HSPD-12] and [FIPS201] have been met. The CAP describes the corrective actions that we plan to perform to remove or reduce any remaining deficiencies detected in our operations.
Date:
2204 2205 2206 2207
Signature
2208 2209
Title
59
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2210
Sample Authorization Decision Letter (Authorization to Operate)
2211
From: Designated Authorizing Official
2212
To: Enterprise Identity Management Official
2213
Subject: Authorization Decision for [PCI/DPCI]
2214 2215 2216 2217 2218 2219
After reviewing the results of the authorization package of the [PCI/DPCI NAME], I have determined that its policies, procedures, and processes comply with both [FIPS201] and our organization’s own policies, regulations, and standards. Accordingly, I am issuing an authorization to operate (ATO). [PIV Card and/or derived PIV credential] issuance services are authorized without any restrictions or limitations. This authorization is my formal declaration that the requirements of [HSPD-12] are being satisfied.
2220 2221
This ATO also applies to issuing facilities under this [ISSUER]. Included is a list of facilities authorized to operate under this authorization decision.
2222 2223 2224 2225
This authorization and ATO will remain in effect for 3 years from the date of this letter if (i) all required documentation is updated annually; (ii) a life cycle walkthrough is completed annually, and the results are sent to me within 30 days of completion; and (iii) no deficiencies are identified during the walkthrough that would increase the risk to the organization’s mission.
2226 2227
A copy of this letter and all supporting authorization documentation shall be retained in accordance with the organization’s record retention schedule.
Date:
2228 2229 2230 2231
Signature
2232 2233
Title
60
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2234
Sample Authorization Decision Letter (Interim Authorization to Operate)
2235
From: Designated Authorizing Official
2236
To: Enterprise Identity Management Official
2237
Subject: Authorization Decision for [PCI/DPCI]
2238 2239 2240 2241 2242 2243 2244
After reviewing the results of the assessment of [ISSUER NAME], I have determined that the requirements identified in [FIPS201] and the organization’s policies, regulations, and standards have not been implemented satisfactorily. However, I have also determined that there is an overarching need for the issuance services to continue due to mission necessity and other considerations. Accordingly, I am issuing an interim authorization to operate (IATO). Operation of the [ISSUER] shall be performed in accordance with the enclosed terms and conditions during the IATO period. The [ISSUER] is not considered authorized during this IATO period.
2245 2246
This IATO also applies to facilities under the [ISSUER]. Included is a list of facilities authorized to operate during this interim period, along with specific limitations or restrictions that apply.
2247 2248 2249 2250 2251 2252 2253 2254 2255 2256
This interim authorization to operate is valid until close of business on <date> [not to exceed three months]. This interim authorization will remain in effect as long as (i) the required status reports for the [ISSUER] are submitted to this office every month, (ii) the problems or deficiencies reported from the authorization do not result in additional risk that is deemed unacceptable, and (iii) continued progress is being made to reduce or eliminate the deficiencies in accordance with the corrective actions plan (CAP). At the end of IATO period, the [ISSUER] must be ready to receive an authorization to operate. A second IATO will be granted only in extenuating circumstances. This office will review the CAP submitted with the authorization package during the IATO period and monitor progress on the removal or reduction of concerns and discrepancies before reauthorization is initiated.
2257 2258
A copy of this letter and all supporting authorization documentation shall be retained in accordance with the organization’s record retention schedule.
Date:
2259 2260 2261 2262
Signature
2263 2264
Title
61
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2265
Sample Authorization Decision Letter (Denial of Authorization to Operate)
2266
From: Designated Authorizing Official
2267
To: Enterprise Identity Management Official
2268
Subject: Authorization Decision for [PCI/DPCI]
2269 2270 2271 2272 2273 2274
After reviewing the results of the assessment of [ISSUER NAME] and the supporting evidence provided in the associated authorization package, I have determined that the requirements identified in [FIPS201] and the organization’s policies, regulations, and standards are not being met by the [ISSUER]. Accordingly, I am issuing a denial of authorization to operate (DATO) to the [ISSUER] and its issuing facilities. The [ISSUER] is not authorized and [MAY NOT BE PLACED INTO OPERATION OR ALL CURRENT OPERATIONS MUST BE HALTED].
2275 2276 2277 2278
The corrective actions plan (CAP) is to be pursued immediately to ensure that proactive measures are taken to correct the deficiencies found during the assessment. Reauthorization is to be initiated at the earliest opportunity to determine the effectiveness of correcting the deficiencies.
2279 2280
A copy of this letter and all supporting authorization documentation shall be retained in accordance with the organization’s record retention schedule.
Date:
2281 2282 2283 2284
Signature
2285 2286
Title
62
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2287
Appendix G. Issuer Controls and Assessment Procedures
2288 2289 2290 2291
Appendices G.1 and G.2 list issuer controls that are applicable to a PCI and DPCI, respectively. An issuer must comply with all applicable requirements, with applicability determined by whether the organization issues the mandatory PIV Cards, the optional derived PIV credentials (if implemented), or both.
2292
G.1.
2293 2294 2295 2296 2297 2298 2299
The following tables list the set of issuer controls applicable to PCIs. Control descriptions and assessment procedures have been updated in this revision of SP 800-79 based on updates to [FIPS201] and its supporting publications. Control identifiers have been labeled with “NEW” or “UPDATED” to clearly identify whether an existing issuer control has been added or updated, respectively. Additionally, controls that were either (i) withdrawn in the previous version of SP 800-79 or (ii) moved to or combined with another control in the previous version of SP 800-79 have been removed from this version for the sake of conciseness and brevity.
2300 2301 2302 2303 2304 2305 2306
A control labeled with “NEW” represents an issuer control that has been added to the issuer control catalog. This does not necessarily represent a new requirement added to [FIPS201]. A “NEW” control signifies that a requirement in [FIPS201] needs to be explicitly assessed to ensure that the PCI is compliant with the necessary requirements associated with PIV Card issuance and maintenance. Controls labeled with “UPDATED” represent an existing issuer control for which the control description and assessment procedures have been revised considerably, though the overall intent of the control has not changed from the prior version.
Controls and Assessment Procedures for PCIs
2307
Table 6. Preparation and Maintenance of Documentation for PCIs Identifier
Issuer Control
Source
DO-1
The organization develops and implements an issuer operations plan according to the template in Appendix D.1. The operations plan references other documents as needed.
SP 800-79, Sec. 2.12 – Authorization Submission Package and Supporting Documentation
Assessment Determine that: (i) The operations plan includes the relevant elements from the template in Appendix D.1 (review). (ii) The operations plan includes (i) the list of issuer controls from Appendix G.1, (ii) the owner for each issuer control, (iii) a description of how the control is implemented, and (iv) whether the control is organization- or facility-specific (review). (iii) Relevant operating procedures and associated documentation are referenced accurately (review). (iv) The operations plan has been reviewed and approved by the DAO within the organization (review, interview). DO-2
The organization has a written policy and procedures for identity proofing and registration that are approved by the head or deputy (or equivalent) of the federal department or agency. Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for identity proofing and registration (to include in-
63
[FIPS201], Sec. 2.7 – PIV Identity Proofing and Registration Requirements
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
person, supervised remote identity proofing, interagency transfer, and extended enrollment if supported) (review). (ii) The policy is consistent with the organization’s mission, functions, [FIPS201], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The policy and procedures have been approved by the head or deputy (or equivalent) of the federal department or agency (review). (iv) The organization periodically reviews and updates the policy and procedures, as required (review, interview). DO-3
The organization has a written policy and procedures for issuance that are [FIPS201], Sec. 2.8 – PIV Card approved by the head or deputy (or equivalent) of the federal department or Issuance Requirements agency. Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for issuance (to include in-person and supervised remote issuance if supported) (review). (ii) The policy is consistent with the organization’s mission, functions, [FIPS201], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The policy and procedures have been approved by the head or deputy secretary (or equivalent) of the federal department or agency (review). (iv) The organization periodically reviews and updates the policy and procedures, as required (review, interview).
DO-5
The organization has a written policy and procedures that describe the conditions for PIV Card termination.
[FIPS201], Sec. 2.9.4 – PIV Card Termination Requirements
Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for PIV Card termination (review). (ii) The policy is consistent with the organization’s mission, functions, [FIPS201], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The organization periodically reviews and updates the policy as required (review, interview). DO-6
DO-7 (UPDATED)
The organization has a written policy and procedures that describe the conditions for PIV Card reissuance and post-issuance updates.
[FIPS201], Sec. 2.9.1 – PIV Card Reissuance Requirements
Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for card reissuance and post-issuance updates (review). (ii) The policy is consistent with the organization’s mission, functions, [FIPS201], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The organization periodically reviews and updates the policy and procedures as required (review, interview).
[FIPS201], Sec. 2.9.2 – PIV Card Post Issuance Update Requirements
The organization has developed procedures in conjunction with the credentialing standards for making all decisions regarding the eligibility of individuals, such as guest researchers, volunteers, intermittent employees, seasonal employees, or employees on temporary appointments that last less than 6 months.
OPM Memorandum [CSP]
64
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for the issuance of an alternative identity credential for short-term personnel who do not qualify for a PIV Card (review). (ii) The policy is consistent with the organization’s mission, functions, and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The organization periodically reviews and updates the policy and procedures as required (review, interview). DO-8
The organization has a written policy and procedures for identity proofing and registration that apply to citizens of foreign countries who are working for the Federal Government overseas (if applicable).
[FIPS201], Sec. 2.7 – PIV Identity Proofing and Registration Requirements
Assessment Determine that: (i) The organization uses a process that is approved by the U.S. State Department’s Bureau of Diplomatic Security, except for employees under the command of a U.S. area military commander (review). (ii) The policy and procedures have been approved by the head or deputy (or equivalent) of the federal department or agency (review).
OPM Memorandum [CSP]
2308 2309
Table 7. Assignment of Roles and Responsibilities for PCIs Identifier
Issuer Control
Source
RR-1
The organization has appointed the role of senior authorizing official (SAO).
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
Assessment Determine that: (i) The organization has defined the role of SAO and its responsibilities according to the requirements of SP 800-79 (review). (ii) The organization has assigned the role of SAO (review). RR-2
The organization has appointed the role of designated authorizing official (DAO).
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
Assessment Determine that: (i) The organization has defined the role of DAO and its responsibilities according to the requirements of SP 800-79 (review). (ii) The organization has assigned the role of DAO (review, interview). RR-3
The organization has appointed the role of enterprise identity management official (EIMO).
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
Assessment Determine that: (i) The organization has defined the role of EIMO and its responsibilities according to the requirements of SP 800-79 (interview). (ii) The organization has assigned the role of EIMO (review, interview). RR-4
The organization has appointed the role of assessor. Assessment Determine that:
65
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(i) The organization has defined the role of assessor and its responsibilities according to the requirements of SP 800-79 (review). (ii) The organization has assigned the role of assessor (review). (iii) The assessor is a third party that is independent of and organizationally separate from the persons and office(s) directly responsible for the day-to-day operations of the organization (review, interview). RR-5
The organization has appointed the role of privacy official (PO). Assessment Determine that: (i) The organization has defined the role of PO and its responsibilities according to the requirements of SP 800-79 (review). (ii) The organization has assigned the role of PO (review). (iii) The PO does not have any other roles in the organization (review, interview).
RR-6
[FIPS201], Sec. 2.11 – PIV Privacy Requirements SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
The organization employs processes that adhere to the principle of separation [FIPS201], Sec. 2.7 – PIV Identity of duties to ensure that no single individual has the capability to issue a PIV Proofing and Registration Card without the cooperation of another authorized person. Requirements Assessment Determine that: (i) Standard operating procedures for identity proofing, registration, issuance, and re-issuance demonstrate adherence to the principle of separation of duties (review, interview, observe).
2310 2311
Table 8. Facility and Personnel Readiness for PCIs Identifier FP-1
Issuer Control
Source
Minimum physical controls at the issuing facility are implemented, including (i) Commonly accepted security door locks and restricted access (e.g., use of locked rooms, safes, and readiness measures lockable cabinets, as appropriate); (ii) sensor devices on registration and issuance stations (e.g., fingerprint readers and cameras) that are integral to [FIPS201], Sec. 2.7.1 – Supervised the station (for supervised remoted identity proofing only); (iii) protection of Remote Identity Proofing registration and issuance stations against tampering, removal, or replacement; (iii) security for registration and issuance stations to ensure that no malicious code is introduced to compromise or otherwise impair the station or PIV Card; (v) security monitoring and automated alarms; (v) emergency power and lighting; and (vi) fire prevention and protection mechanisms. Assessment Determine that: (i) The EIMO and facility managers are aware of the minimum set of physical controls that need to be in place at the facilities (interview). (ii) The minimum physical security controls are implemented by the facility (observe). (iii) The facility has a process to report any problems with the station to the issuer (review).
FP-2
Issuer documentation (e.g., operations plan, standard operating procedures, contracts, etc.) is maintained at each issuing facility. Assessment Determine that:
66
Commonly accepted security readiness measures
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(i) The most current versions of issuer documentation are available at each issuing facility for reference as needed (review, interview). FP-3
Issuing facility managers have a securely stored copy of the contingency/disaster recovery plan for the information systems.
Commonly accepted security readiness measures
Assessment Determine that: (i) The contingency plan/ disaster recovery plan is stored securely at the facility (interview, observe). (ii) The issuing facility manager is knowledgeable on how to restore/reconstitute the information systems in case of system failures (interview). FP-4
The intent of this control is covered by DP-1.
-
FP-5
Card activation/issuance workstations are situated in an enclosed area (e.g., wall or partition) to provide privacy for an applicant or card holder.
Commonly accepted security readiness measures
Assessment Determine that: (i) Issuing facility workstations are situated in an enclosed area (e.g., wall or partition) such that other individuals cannot see an applicant or card holder’s personal information (observe). FP-6
This control is withdrawn since M-11-11 has been rescinded.
-
FP-7
All operators who perform roles within an issuing facility in the areas of identity SP 800-79, Sec. 2.6 – Issuer Roles proofing and registration, issuance, and maintenance have undergone training and Responsibilities (e.g., fraudulent source document detection, correct techniques for fingerprint capture, etc.) that is specific to their duties prior to being allowed to perform in Commonly accepted security that function. readiness measures Assessment Determine that: (i) All operators who perform roles within an issuing facility in the areas of identity proofing and registration, issuance, and maintenance are allowed access to information systems only after completing a training course specific to their duties (review, interview). (ii) Records showing that the appropriate training course has been completed by issuing facility personnel are stored by the facility for audit purposes ( review, interview).
FP-8
The issuing facility is responsible for the card stock, its management, and its integrity. All pre-personalized and personalized smart card stock from card vendors and card production facilities are only received by authorized personnel who ensure that the card stock is stored, handled, and disposed of securely. Assessment Determine that: (i) The issuing facility has an authorized list of personnel that are responsible for ensuring that smart card stock is received and stored securely (interview). (ii) Procedures for receiving, storing, and destroying smart card stock are documented in the issuing facility’s standard operating procedures (review). (iii) Authorized personnel are knowledgeable about procedures for receiving, storing, and destroying (in case of printing errors) smart card stock (interview).
67
[FIPS201], Sec. 2.8 – PIV Card Issuance Requirements
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier FP-9
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
The organization maintains a current list of designated points of contact and Commonly accepted security alternate points of contact for all issuing facilities used by the issuer for identity readiness measures proofing, registration, issuance, and maintenance processes. Assessment Determine that: (i) The organization maintains a list of designated points of contact and alternate points of contact for all issuing facilities used by the organization (review). (ii) The list is current, and the individuals named are the correct points of contact (review, interview).
2312 2313
Table 9. Protection of Stored and Transmitted Data for PCIs Identifier
Issuer Control
Source
ST-1 (UPDATED)
The issuer PIV information systems are implemented in accordance with the spirit and letter of all federal privacy laws and policies, including the EGovernment Act of 2002 [E-GOV], the Privacy Act of 1974 [PRIVACY], and OMB [M-03-22], as applicable.
[FIPS201], Sec. 2.11 - PIV Privacy Requirements E-Government Act [E-GOV]
Assessment Privacy Act [PRIVACY] Determine that: (i) PIV information systems are operated and managed in accordance OMB Memorandum [M-03-22] with federal privacy laws and applicable organizational policies (review). (ii) The organization does not disclose any record contained in the system of records to any person or organization unless written consent has been given by the individual to whom the record pertains or one of the exceptions for disclosure in the Privacy Act are met (review, interview). (iii) Individuals are permitted access to their personal record, and the information is provided in a form that is comprehensible to them (review, interview). (iv) Individuals are able to request amendments to records pertaining to them. Corrections are made promptly, and if not, the individual is provided with a reason for the refusal and can request a review of the refusal (review, interview). (v) The organization notifies an individual when their record is made available to any person under a compulsory legal process when such a process becomes a matter of public record (review, interview). ST-2
The information systems protect the integrity and confidentiality of transmitted [FIPS201], Sec. 2.11 – PIV information. Privacy Requirements Assessment Determine that: (i) The integrity of transmitted information is protected (interview, test, review). (ii) The confidentiality of transmitted information is protected (interview, test, review).
ST-3 (NEW)
The organization ensures that only personnel (e.g., operators) with a legitimate need for access to PII in the PIV system are authorized to access the PII, including the information and databases maintained for registration and credential issuance. Assessment
68
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
Determine that: (i) The organization maintains a list of personnel who can access PII (review, interview). (ii) Personnel with access to PII have completed a privacy training course and are familiar with PII handling procedures (review, interview). (iii) Records showing that a privacy training course has been completed by personnel with access to PII are stored for audit purposes (review).
2314 2315
Table 10. Enforcement of Privacy Requirements for PCIs Identifier
Issuer Control
Source
PR-1
Privacy Act statements/notices, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees who violate privacy policies are developed and posted by the organization in multiple locations at the issuing facility (e.g., internet site, human resource offices, regional offices, and contractor orientation handouts).
OMB Memorandum [M-05-24]
Assessment Determine that: (i) The issuing facility posts Privacy Act statements/notices, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees who violate privacy policies (review, interview). (ii) The organization maintains appeal procedures for those who are denied a credential or whose credentials are revoked (review). PR-2 (UPDATED)
PR-3
The organization conducts a comprehensive privacy impact assessment (PIA) and a periodic review and update of the assessment on systems that contain PII for the purpose of implementing PIV consistent with the methodology of [E-GOV] and the requirements of [M-03-22].
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
Assessment Determine that: (i) The organization conducts a PIA of their issuer information systems based on guidance found in [E-GOV] and [M-03-22] (review). (ii) The organization submits the PIA of their issuer information systems to OMB (review, interview).
OMB Memorandum [M-03-22]
The organization’s employee and contractor identification system of records notices (SORNs) are updated to reflect any changes in the disclosure of information to other organizations in order to be consistent with the Privacy Act of 1974 [PRIVACY] and OMB Circular [A-130], Appendix 1.
Privacy Act [PRIVACY]
E-Government Act [E-GOV]
OMB Memorandum [M-05-24]
Assessment Determine that: (i) The organization updates SORNs to reflect changes in the disclosure of information (review, interview). PR-4 (UPDATED)
The organization writes, publishes, and maintains a clear and comprehensive [FIPS201], Sec. 2.11 – PIV Privacy document that lists the types of information that will be collected (e.g., Requirements transactional information, PII), the purpose of collection, what information may be disclosed to whom during the life of the credential, how the information will be protected, and the complete set of uses of the credential and related information.
69
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
Assessment Determine that: (i) The organization has developed, documented, and published the types of information that will be collected (e.g., transactional information, PII), the purpose of collection, what information may be disclosed to whom during the life of the credential, how the information will be protected, and the complete set of uses of the credential and related information (review). (ii) The issuing facility requires the applicant to be notified of the PII that is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (interview, observe). PR-5
The issuer employs technologies that allow for the continuous auditing of compliance with privacy policies and practices.
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
Assessment Determine that: (i) The issuing facility employs technologies that allow for the continuous auditing of compliance with privacy policies and practices. This could include the use of technology to monitor data access, data flows between information systems, and the use of PII (review, interview, observe). PR-6
In the case of termination, the PII collected from the cardholder is disposed of [FIPS201], Sec. 2.9.4 – PIV Card in accordance with the stated privacy and data retention policies of the Termination Requirements organization. Assessment Determine that: (i) As part of PIV Card termination, the organization disposes of PII in accordance with its privacy and data retention policies while considering grace period provisions (review, interview).
PR-7 (NEW)
Enrollment records contain PII that needs to be protected in a manner that protects the individual’s privacy and maintains the integrity of the records both in transit and at rest.
[FIPS201], Sec. 2.6 – PIV Enrollment Records
Assessment Determine that: (i) The organization ensures that cardholder PII is protected following applicable policies and guidance (review). (ii) The issuer components that contain PII are authorized to operate in accordance with [SP800-37] (review). PR-8 (NEW)
The organization follows applicable federal laws and regulations regarding the retention and destruction of biometric data. Assessment Determine that: (i) The organization follows a documented policy that addresses the retention and destruction of biometric data (review). (ii) The organization does not retain biometric data beyond the documented timelines (observe). (iii) The organization has an approved method for the destruction of biometric data (review, observe).
70
[FIPS201], Sec. 2.5 – Biometric Data Use
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
2316
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Table 11. Deployed Products and Information Systems for PCIs Identifier
Issuer Control
Source
DP-1
In order to be compliant with the provisions of OMB Circular [A-130], App III, the issuer PIV information systems are authorized to operate in accordance with [SP800-37]. Controls described in [SP800-53] are used to accomplish security and privacy goals, where applicable.
[FIPS201], Appendix A.2 Application of Risk Management Framework to IT System(s) Supporting PCI
Assessment Determine that: (i) The organization has a letter showing the current authorization decision of each PIV information system used to support the issuer (review).
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
Products and services utilized by an issuing facility to issue a PIV Card are listed on the GSA FIPS 201 Evaluation Program’s Approved Products List (APL), where applicable.
OMB Memorandum [M-05-24]
DP-2
Assessment Determine that: (i) For each product or service that falls within one of the categories in the FIPS 201 Evaluation Program, its presence (i.e., make, model, version) is checked on the APL (review). (ii) There is no product in operation that has been moved to the GSA Removed Products List (RPL) (review). DP-3 (UPDATED)
Federal Acquisition Regulation (FAR), Sec. 4.1302 Acquisition of approved products and services for personal identity verification
The organization annually submits a personalized PIV Card issued from their [COMMON], Sec. 8.1 – Frequency production system to the FIPS 201 Evaluation Program for conformance or Circumstances of Assessment testing. Assessment Determine that: (i) Printed information on the submitted PIV Card complies with the mandatory and optional items specified in [FIPS201], Sec. 4.1.4. (review). (ii) The PIV credentials on the PIV Card conform to the PIV Data Model (review).
2317 2318
Table 12. Implementation of Credentialing Infrastructures for PCIs Identifier
Issuer Control
Source
CI-1 (UPDATED)
For legacy public key infrastructures (PKIs), the organization’s CA is crosscertified with the Federal Bridge Certificate Authority (FBCA) and issues certificates with the id-fpki-common-authentication and id-fpki-commonauthentication policy OIDs of the U.S. Federal PKI Common Policy Framework.
[FIPS201], Sec. 5.4 – Legacy PKI
Assessment Determine that: (i) The organization’s CA is cross-certified and authorized to issue certificates with the appropriate OIDs (review). (ii) The organization operating the legacy PKI conducts an annual CA review in accordance with https://www.idmanagement.gov/docs/fpkiannual-review-requirements.pdf (review). (iii) The organization assembles and submits their annual review package to the FPKI Policy Authority (PA) by their coordinated due date (review, interview).
71
[FPKI], Sec. 1.4 – Package Submission
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier CI-2 (UPDATED)
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
For non-legacy PKIs, all certificates issued to support PIV Card authentication are issued under the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework.
[FIPS201], Sec. 5.2 – PKI Certificate
When cards are personalized, each PIV Card contains a unique PIV Card application administration key specific to that PIV Card.
[FIPS201], Sec. 4.3.2 – Activation by Card Management System
[FPKI], Sec. 1.4 – Package Assessment Submission Determine that: (i) The PKI provider is listed as being a shared service provider (review). (ii) The organization leveraging a shared service provider for PIV certificates completes an annual registration authority audit in accordance with https://www.idmanagement.gov/docs/fpki-ra-auditguidance.pdf (review). (iii) The organization leveraging a shared service provider for PIV certificates completes an annual key recovery audit in accordance with https://www.idmanagement.gov/docs/fpki-ra-audit-guidance.pdf (review). (iv) The organization submits the results of the annual audit of their registration authority and key recovery practices against the relevant CP/CPS to their shared service provider for submission to the FPKI Policy Authority (PA) by their coordinated due date (review, interview). CI-3
Assessment Determine that: (i) The CMS vendor’s documentation shows the use of unique PIV Card application administration keys (review). (ii) The EIMO indicates that the PIV Card application administration keys are unique to each card (interview). CI-4
Fingerprint images retained by organizations are formatted according to [SP800-76]. Assessment Determine that: (i) The fingerprint images are formatted according to Table 4 in [SP80076] and INCITS 381-2004 (review, test).
CI-5
Facial images collected during identity proofing and registration are formatted such that they conform to [SP800-76].
[SP800-76], Sec. 3.3 – Fingerprint Image Format for Images Retained by Agencies
[SP800-76], Sec. 7.2 – Acquisition and Format
Assessment Determine that: (i) The facial images are formatted according to Table 12 in [SP800-76] and INCITS 385 (review, test). CI-6
The fingerprint templates stored on the PIV Card (which is used for off-card comparison) are (i) prepared from images of the primary and secondary fingers, where the choice of fingers is based on the criteria described in [SP800-76], Sec. 4.2, and (ii) formatted such that they conform to [SP80076]. Assessment Determine that: (i) The procedures used to fingerprint the applicant are based on the primary and secondary finger selection criteria detailed in [SP80076], Sec. 4.2 (review, observe).
72
[SP800-76], Sec. 4.2 – Source Images
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(ii) The fingerprint templates are prepared from images of the primary and secondary fingers (test). (iii) The fingerprint templates are formatted according to Table 6 in [SP800-76] and INCITS 378-2004 (review, test). CI-7
The identity management system (IDMS) or Central Verification System (CVS) reflects the adjudication status of each PIV cardholder as part of the PIV identity account.
[FIPS201], Sec. 2.8 – PIV Card Issuance Requirements
Assessment Determine that: (i) The issuer’s IDMS or CVS is capable of recording the adjudication status of each PIV Cardholder as part of the PIV identity account (review, observe). CI-8
Iris images collected during identity proofing and registration are formatted such that they conform to [SP800-76], if applicable.
[SP800-76], Sec. 6.3 – Iris image specification for PIV Cards
Assessment Determine that: (i) Iris images are formatted according to Table 9 in [SP800-76] and ISO/IEC 19794-6:2011 (review, test). CI-9
Fingerprint templates for on-card comparison (OCC) that are collected during identity proofing and registration are formatted such that they conform to [SP800-76], if applicable.
[SP800-76], Sec. 5.5.1 – Biometric Information Template
Assessment Determine that: (i) Fingerprint templates for on-card comparison are formatted according to Table 7 in [SP800-76] and ISO/IEC 19794-2:2011 (review, test). CI-10
The intent of this control is covered by CI-11.
-
CI-15 (NEW)
As part of the PIV identity account, the issuer maintains an enrollment record for each issued PIV Card.
[FIPS201], Sec. 2.6 – PIV Enrollment Records
Assessment [SP800-156], Sec. 2 – Chain-ofDetermine that: Trust Data Representation (i) The enrollment data record maintains an auditable sequence of enrollment events to bind an applicant to multiple transactions that might take place at different times and locations. These include activities that document (i) who took the action, (ii) what action was taken, (iii) when and where the action took place, and (iv) and what data was collected (review). (ii) The enrollment data record includes details of biometric acquisition, including the name and role of the acquiring agent, the office and organization, time, place, and acquisition method (review). (iii) The enrollment data record includes (i) unique identifiers issued to the individual (e.g., FASC-N, UUID, etc.); (ii) information about the authorizing entity that has approved the issuance of a credential; (iii) the current status of the background investigation, including the results of the investigation once completed; (iv) the evidence of authorization if the credential is issued under a pseudonym; and (v) any other relevant data about the cardholder, including subsequent changes in the data (e.g., cardholder name changes) (review). (iv) The records are stored as part of the cardholder’s PIV identity account, either as part of the issuer’s IDMS or through links to
73
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
records in other related systems (e.g., card management systems) (review). (v) Exchange/transfer of enrollment records are represented in an XML schema in accordance with [SP800-156] (review), if applicable. CI-16 (NEW)
If the organization collects biometric data to conduct background investigations and for PIV Card personalization on separate occasions, a biometric comparison is performed to confirm that the two fingerprints collected for off-card one-to-one comparisons elicit a positive biometric verification decision when compared to the same two fingerprints from the original set of 10 fingerprints.
[FIPS201], Sec. 2.2 – Biometric Data Collection for PIV Card
Assessment Determine that: (i) The organization has implemented a solution to perform a biometric comparison to confirm that the fingerprints collected on separate occasions elicit a positive biometric verification decision (review). (ii) The organization performs a biometric comparison to confirm that the fingerprints collected for off-card one-to-one comparison are compared to the same two fingerprints from the original set of 10 fingerprints (review, observe). CI-17 (NEW)
PIV Card application administration keys meet the algorithm and key size requirements stated in [SP800-78].
[FIPS201], Sec. 4.3.2 – Activation by Card Management System
Assessment Determine that: (i) The PIV Card application administration keys meet the algorithm and key size requirements stated in Table 5-1 of [SP800-78] (review, test).
2319 2320
Table 13. Sponsorship Process for PCIs Identifier SP-1
Issuer Control
Source
A PIV Card is issued to an individual only after a proper authority has authorized issuance of the card.
[FIPS201], Sec. 2.1 – Control Objectives
Assessment Determine that: (i) The process for making a request is documented (review). (ii) A request from a valid authority is required to issue a PIV Card (observe). SP-2
The issuing facility collects personal information using only the forms approved by OMB under the Paperwork Reduction Act of 1995. Assessment Determine that: (i) The forms used to collect personal information have been approved by OMB (review, observe).
2321
74
Paperwork Reduction Act [PAPERRED]
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
2322
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Table 14. Identity Proofing/Registration Process for PCIs Identifier
Issuer Control
Source
EI-1
The issuing facility has a process in place to verify the authenticity of the [FIPS201], Sec. 2.1 – Control source documents and match them to the identity claimed by the applicant. Objectives Fraudulent identity source documents are not accepted as genuine or unaltered. [FIPS201], Sec. 2.7 – PIV Identity Proofing and Registration Requirements Assessment Determine that: (i) The issuing facility has a process in place to verify the authenticity of the source documents and match them to the identity claimed by the applicant (interview, observe). (ii) The issuing facility has materials used to train operators on how to verify the authenticity of source documents (review). (iii) The issuing facility performs electronic verification of identity source documents. Cryptographic security features are used to validate evidence, when available (review, observe).
EI-2
The applicant appears in person at least once before the issuance of a PIV [FIPS201], Sec. 2.7 – PIV Identity Card, either at the issuing facility or at a supervised remote identity Proofing and Registration proofing station. Requirements Assessment Determine that: (i) The standard operating procedures for identity proofing, registration, and issuance ensure that the applicant appears in person at least once before the issuance of the PIV Card (review). (ii) The applicant appears in person at least once before the issuance of a PIV Card (observe).
EI-3 (UPDATED)
Two identity source documents are checked based on those listed in [FIPS201], Sec. 2.7 and are neither expired nor cancelled. Assessment Determine that: (i) The requirement to check two identity source documents based on the list provided in [FIPS201], Sec. 2.7 of is documented (review). (ii) At least one identity source document meets the requirements of strong evidence, as specified in [SP800-63A] (review, interview, observe). (iii) The identity source documents are not expired or cancelled (interview, observe). (iv) Two identity source documents are checked in accordance with [FIPS201], Sec. 2.7 of during the identity proofing process (observe). (v) If the two identity source documents bear different names, evidence of a formal name change is provided (review, observe).
EI-4
[FIPS201], Sec. 2.7 – PIV Identity Proofing and Registration Requirements
At least one of the identity source documents used to verify the claimed [FIPS201], Sec. 2.1 – Control identity of the applicant is a valid federal or state government-issued photo Objectives identification. [FIPS201], Sec. 2.7 – PIV Identity Proofing and Registration Assessment Requirements Determine that: (i) The requirement that at least one of the identity source documents is a valid federal or state government-issued photo ID is documented (review).
75
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(ii) At least one of the identity source documents used to verify the claimed identity of the applicant is a valid federal or state government-issued photo identification (observe). (iii) Driver’s licenses and ID cards presented by applicants comply with [REAL-ID] when required pursuant to DHS regulations. Stateissued driver’s licenses and ID cards that are not [REAL-ID]compliant can be used until the full enforcement date under [6 CFR § 37.5] (review, observe). EI-7
The biometric data (e.g., fingerprints, facial image, and optional iris images) used to personalize the PIV Card are captured during the identity proofing and registration process.
[FIPS201], Sec. 2.8 – PIV Card Issuance Requirements
Assessment Determine that: (i) The requirement to capture biometric data (e.g., fingerprints, facial image, and optional iris images) used to personalize the PIV Card are captured during the identity proofing and registration process and documented as part of standard operating procedures (review). (ii) The biometric data (e.g., fingerprints, facial image, and optional iris image) used to personalize the PIV Card are captured during the identity proofing and registration process (observe). EI-9
The issuing facility captures the applicant’s fingerprints in accordance with [SP800-76], Sec. 3.2 – Fingerprint any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or Image Acquisition (iii) rolled ink card. Assessment (i) The issuing facility captures the applicant’s fingerprints in accordance with any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or (iii) rolled ink card (observe).
EI-10
The issuing facility has an in-person or remote operator present at the time [SP800-76], Sec. 3.2 – Fingerprint of biometric (e.g., fingerprint, facial image, and optional iris images) Image Acquisition capture. [SP800-76], Sec. 6.6 – Iris image quality control Assessment Determine that: [FIPS201], Sec. 2.7.1 – Supervised (i) The requirement that the issuing facility has an attending official present at the time of biometric (e.g., fingerprint, facial image, and Remote Identity Proofing optional iris images) capture is documented (review). (i) The issuing facility has an attending official present at the time of biometric (e.g., fingerprint, facial image, and optional iris images) capture (observe).
EI-11
The issuing facility acquires fingerprint images in accordance with Table 3 in [SP800-76]. Assessment Determine that: (i) Fingers are inspected to ensure the absence of dirt, coatings, gels, and other of foreign materials (observe). (ii) Scanner and card surfaces are clean (observe). (iii) The presentation of fingers for a plain live scan, rolled live scan, or rolled ink card are based on procedures in Table 2 of [SP800-76] (observe). (iv) Multi-finger plain impression images are properly segmented into single finger images (observe).
76
[SP800-76], Sec. 3.2 – Fingerprint Image Acquisition
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier EI-12
EI-13 (UPDATED)
EI-14 (NEW)
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
A full set of fingerprints is collected from a PIV applicant who lacks an on- [FIPS201], Sec. 2.3 –Biometric Data record background investigation. If fewer than 10 fingers are available, the Collection for Background missing fingers are labeled before transmitting the fingerprints to the FBI to Investigations conduct a background investigation. [SP800-76], Sec. 3.2 – Fingerprint Image Acquisition Assessment Determine that: (i) The requirement that the issuing facility captures the 10 fingerprints of the applicant and labels any missing fingers is documented (review). (ii) The issuing facility captures the 10 fingerprints of the applicant and labels any missing fingers (observe). (iii) If no fingers are available to be imaged, guidance is sought from respective investigative service providers for alternative means of performing law enforcement checks (review). If the identity proofing and enrollment process is performed over multiple visits, an automated biometric verification attempt that compares the applicant’s newly captured biometric characteristics against biometric data collected during a previous visit is performed at each visit and results in a positive verification decision.
[FIPS201], Sec. 2.1 – Control Objectives
Assessment Determine that: (i) If multiple sessions are needed for identity-proofing, registration, and issuance, the applicant is linked through a positive biometric verification decision obtained from an automated comparison of biometric characteristics captured at a previous session to biometric characteristics captured during the current session (review, observe). (ii) No substitution occurs in the identity proofing process. More specifically, the individual who appears for identity proofing and whose fingerprints are checked against databases is the person to whom the credential is issued (review, observe).
[FIPS201], Sec. 2.5 – Biometric Data Use
[FIPS201], Sec. 2.4 – Biometric Data Collection for PIV Card
If supervised remote identity proofing is used, it meets the following [FIPS201], Sec. 2.7.1 –Supervised requirements at a minimum: (i) the station is maintained in a controlledRemote Identity Proofing access environment; (ii) the station is monitored by staff at the station location while it is being used; (iii) a live operator participates remotely with the applicant for the entirety of the identity proofing session; (iv) operators have undergone a training program to detect potential fraud and to properly perform a supervised remote identity proofing session; (v) the operator monitors the entire identity proofing session with at least one continuous, high-resolution video transmission of the applicant; (vi) the operator requires all actions taken by the applicant during the identity proofing session to be clearly visible to the operator; (vii) the operator validates the physical or cryptographic security features of the primary and secondary identity source documents using scanners and sensors that are integrated into the station; and (viii) all communications occur over a mutually authenticated protected channel. Assessment Determine that: (i) The station is maintained in a controlled access environment (observe). (ii) The station is monitored by staff at the station location while it is being used (observe). (iii) A live operator participates remotely with the applicant for the entirety of the identity proofing session (observe).
77
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(iv) The operator has undergone a training program to detect potential fraud and to properly perform a supervised remote identity proofing session (review). (v) The operator monitors the entire identity proofing session using at least one continuous, high-resolution video transmission of the applicant (observe). (vi) All actions taken by the applicant during the identity proofing session are clearly visible to the operator (observe). (vii) The operator validates the physical or cryptographic security features of the primary and secondary identity source documents using scanners and sensors that are integrated into the station (review, observe). (viii) All communications from the remote station to the identity management system occur over a mutually authenticated protected channel (review, observe, test). EI-15 (NEW)
If during supervised remote identity proofing, applicant biometric data [FIPS201], Sec. 2.7.1 –Supervised cannot be collected per the criteria defined in [SP800-76] or if validation of Remote Identity Proofing the identity evidence is inadequate, identity proofing and enrollment needs to be halted and performed in-person at the issuer’s facility. Assessment Determine that: (i) The organization has a formally documented operating procedure on how to perform supervised remote identity proofing (including reasons for termination of the remote identity session, if required) (review). (ii) Supervised remote identity proofing is terminated if applicant biometric data cannot be collected per the criteria defined in [SP800-76] or if validation of the identity evidence is inadequate (review, observe).
2323 2324
Table 15. Adjudication Process for PCIs Identifier AP-1 (UPDATED)
Issuer Control
Source
Prior to PIV Card issuance, the organization ensures that, at a minimum, [FIPS201], Sec. 2.7 – PIV Identity (a) a completed and favorably adjudicated Tier 1 investigation — formerly Proofing and Registration called a National Agency Check with Written Inquiries (NACI) — or (b) the Requirements appropriate required investigation is initiated with the authorized federal investigative service provider, and the FBI NCHC portion of the background OPM Memorandum [CSP] investigation is completed and favorably adjudicated for individuals for whom no prior investigation exists. Assessment: Determine that: (i) The organization references a completed and favorably adjudicated Tier 1 investigation or the appropriate required investigation is initiated with the authorized federal investigative service provider, and the FBI NCHC portion of a background investigation is completed and favorably adjudicated for the applicant prior to PIV Card issuance (review, interview, observe). (ii) If the required investigation completes with an unfavorable adjudication after PIV Card issuance, termination procedures are followed, and the PIV identity account is updated with the results of the investigation (review, interview).
78
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier AP-2 AP-3 (UPDATED)
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
The intent of this control is covered by AP-1.
-
The organization follows the credentialing eligibility standards issued by the [FIPS201], Sec. 2.2 –Credentialing Director of OPM and OMB. Requirements Assessment: OPM Memorandum [CSP] Determine that: (i) The organization has developed and documented a written policy and procedures on credentialing and eligibility standards (review). (ii) The organization assigns position designations to determine the investigative requirement (review, interview). (iii) Investigative requirements for each position are established by the Suitability and Credentialing Executive Agent and the Security Executive Agent (review, interview). (iv) Applicants being processed for a PIV Card receive the required investigation and are subject to any applicable reinvestigation or continuous vetting requirements to maintain their PIV eligibility (review, interview). (v) Final eligibility determination is reported to the Central Verification System or, if applicable, to their enrollment in the Continuous Vetting Program (review, interview). (vi) Final eligibility determination is recorded in or referenced by the PIV enrollment record to reflect PIV eligibility for the PIV cardholder (review, observe).
AP-4
The intent of this control is covered by AP-1.
-
AP-5
The intent of this control is covered by AP-1.
-
AP-6 (NEW)
Only fingerprints are used to link background investigations since fingerprints are the only biometric characteristic used for background investigations.
[FIPS201], Sec. 2.5 – Biometric Data Use
Assessment: Determine that: (i) The organization has a formally documented process to link biometric investigations for PIV applicants when required (review). (ii) The issuing facility is capable of linking the background investigations of PIV applicants, when required (observe). (iii) The issuing facility staff is knowledgeable on how to link the background investigations of PIV applicants (interview).
2325 2326
Table 16. Card Production Process for PCIs Identifier CP-1
Issuer Control
Source
To combat counterfeiting and alterations, the PIV Card contains security [FIPS201], Sec. 4.1.2 – Tamper features outlined in the American Association of Motor Vehicle Proofing and Resistance Administrators (AAMVA) Drivers License/Identification (DL/ID) Card Design Standard. Assessment Determine that: (i) The PIV Card contains at least one security feature at inspection level 1 (e.g., an embossed surface pattern; an optically variable device, such as a hologram; color-shifting inks) or inspection level 2
79
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(e.g., microtext, UV-fluorescent images, IR-fluorescent ink, nano and micro images, and chemical taggants) (interview, observe). (ii) The incorporation of security features (i) are in accordance with durability requirements; (ii) are free of defects, such as fading and discoloration; (iii) do not obscure printed information; and (iv) do not impede access to machine-readable information (interview, observe). (iii) The presence of security features does not prevent the recognition of white as the principal card body color by a person with normal vision (corrected or uncorrected) at a working distance of 50 cm to 200 cm. (observe). CP-2
The PIV Card is not embossed other than for security and accessibility features.
[FIPS201], Sec. 4.1.3 – Physical Characteristics and Durability
Assessment Determine that: (i) The PIV Card is not embossed other than for security and accessibility features (review, observe). CP-3
Decals are not adhered to the PIV Card. Assessment Determine that: (i) Decals are not adhered to the PIV Card (review, observe).
CP-4
[FIPS201], Sec. 4.1.3 – Physical Characteristics and Durability
If organizations choose to punch an opening in the card body to enable the [FIPS201], Sec. 4.1.3 – Physical card to be oriented by touch or to be worn on a lanyard, all such alterations Characteristics and Durability are closely coordinated with the card vendor and/or manufacturer to ensure that the card’s material integrity is not adversely impacted. Assessment Determine that: (i) Card body durability requirements and characteristics are not compromised by a punched opening (test). (ii) Printed information, including the photograph, are not altered or interfered with (test). (iii) Machine-readable technology, such as the embedded antenna, is not interfered with or damaged (test). (iv) Documentation shows that card manufacturer warranties or other product claims are not invalidated (review).
CP-5
Requirements for tactilely discernible markers (e.g., edge ridging, notched corner, laser engraving) are covered under of AI-3.
-
CP-6
PIV Cards that contain topographical defects (e.g., scratches, poor color, fading, etc.) or are improperly printed are destroyed.
[FIPS201], Sec. 2.8 – PIV Card Issuance Requirements
Assessment Determine that: (i) The issuing facility has a procedure to destroy PIV Card that contain topographical defects or are improperly printed (review). (ii) The issuing facility destroys PIV Cards that contain topographical defects or are improperly printed (observe). CP-7
PIV Cards are printed using the color representation specified in Table 4-2 Color Representation in [FIPS201], Sec. 4.1.5. Assessment Determine that:
80
[FIPS201], Sec. 4.1.5 – Color Representation
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(i) The issuer uses an appropriate color representation for printing PIV Cards (review, test). (ii) The card production system is configured to use an appropriate color representation system (review). CP-8 (NEW)
Card personalization ensures that, at a minimum, (i) the printed material does not rub off, (ii) the printing process does not deposit debris on the printer rollers during printing and laminating, and (iii) printed material does not interfere with the ICCs or related components, nor does it obstruct access to machine-readable information.
[FIPS201], Sec. 4.1.1 – Printed Material
Assessment Determine that: (i) Printed material does not rub off once the PIV Card is personalized (observe, test). (ii) PIV Cards function as intended once they are printed and laminated (observe, test).
2327 2328
Table 17. Activation/Issuance Process for PCIs Identifier
Issuer Control
Source
AI-1
The personalized PIV Card complies with all mandatory items on the front of the PIV Card.
[FIPS201], Sec. 4.1.4.1 – Mandatory Items on the Front of the PIV Card
Assessment Determine that: (i) The PIV Card meets the specific requirements in [FIPS201] for (i) photograph; (ii) name; (iii) employee affiliation; (iv) agency, department, or organization; (v) card expiration dates (zones 14F and 19F); and (vi) color coding for employee affiliation (zone 15F and 18F) (observe, test). AI-2
The personalized PIV Card complies with all mandatory items on the back of the PIV Card. Assessment Determine that: (i) The PIV Card meets the specific requirements in [FIPS201] for (i) an agency card serial number and (ii) issuer identification number (observe, test).
AI-3
If one or more optional items are printed on the front of the PIV Card, they comply with the requirements for the optional items on the front on the PIV Card. Assessment Determine that: (i) The PIV Card meets the specific requirements in [FIPS201] if it includes optional items on the front of the card, such as a (i) signature, (ii) agency-specific text area, (iii) rank, (iv) portable data file (deprecated), (v) header, (vi) agency seal, (vii) footer, (viii) issue date, (ix) photo border, (x) agency-specific data, (xi) organizational affiliation abbreviation, (xii) edge ridging or notched corner tactile marking, and (xiii) laser engraving tactile marker (observe, test).
81
[FIPS201], Sec. 4.1.4.2 – Mandatory Items on the Back of the Card
[FIPS201], Sec. 4.1.4.3 – Optional Items on the Front of the Card
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Identifier
Issuer Control
Source
AI-4
If one or more optional items are printed on the back of the PIV Card, they comply with the requirements for the optional items on the back on the PIV Card.
[FIPS201], Sec. 4.1.4.4 – Optional Items on the Back of the Card
Assessment Determine that: (i) The PIV Card meets the specific requirements in [FIPS201] if it includes optional items on the back of the card, such as (i) a magnetic stripe (deprecated); (ii) a return address (iii) the physical characteristics of the cardholder; (iv) additional language for emergency responder officials; (v) standard Section 499, Title 18 language; (vi) linear 3 of 9 bar code (deprecated); and (vii) agencyspecific text (zones 9B and 10B) (observe, test). AI-5 (UPDATED)
The PIV Card includes mechanisms to block activation of the card after a number of consecutive failed activation attempts. A maximum of 10 consecutive activation retries for each of the activation methods (i.e., PIN and OCC attempts) are permitted.
[FIPS201], Sec. 4.3.1 – Activation by Cardholder
Assessment Determine that: (i) The PIV Card blocks activation after 10 consecutive failed attempts unless a lower limit is imposed by the issuer (observe, test). AI-6
The PIV Card is valid for no more than six years. Assessment Determine that: (i) The expiration date printed on the PIV Card is no more than six years from the issuance date (observe). (ii) The expiration date is printed in the CHUID (test). (iii) The date printed on the card and the expiration date in the CHUID are the same (test). (iv) The biometric that is used for reissuance is not older than 12 years (review).
AI-7 (UPDATED)
[FIPS201], Sec. 2.8 – PIV Card Issuance Requirements [FIPS201], Sec. 2.9.1 – PIV Reissuance Requirements
Before the PIV Card is provided to the applicant, the operator performs a [FIPS201], Sec. 2.8 – PIV Card one-to-one comparison of the applicant against the biometric data records Issuance available on the PIV Card or in the PIV enrollment record. If the biometric verification decision is negative, or if no biometric data records are available, the cardholder provides two identity source documents (as specified in [FIPS201], Sec 2.7), which are inspected and compared by the operator with the photograph printed on the PIV Card. Assessment Determine that: (i) The PIV Card is released to the applicant only after a positive biometric verification decision (review, observe). (ii) The issuer has alternate processes in place if biometric matches are not possible (review, observe).
AI-9
The issuer advises applicants in selecting a strong PIN value. The PIN is (i) [FIPS201], Sec. 4.3.1 – Activation a minimum of six digits in length, (ii) not easily guessable, (iii) not by Cardholder individually identifiable (e.g., part of a Social Security Number or phone number), and (iv) not commonly used (e.g., 000000, 123456). Assessment Determine that: (i) The issuer has trained operators to advise applicants on PIN selection (review).
82
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(ii) The operator advises applicants on the selection of a strong PIN (observe). (iii) The PIN is a minimum of six digits in length (test). AI-10
This control has been withdrawn as the PIV background investigation indicator extension identified by the id-piv-NACI object identifier is deprecated.
-
AI-12
The organization issues electromagnetically opaque holders or other technology to protect against unauthorized contactless access to information stored on a PIV Card.
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
Assessment Determine that: (i) Electromagnetically opaque holders or other technology is provided at the time of PIV Card issuance (review, observe). AI-14
If pseudonyms are required to protect an employee or contractor (e.g., from [FIPS201], Sec. 2.8.1 – Special physical harm, severe distress, or harassment), the issuance of a PIV Card Rule for Pseudonyms uses agency-approved pseudonyms and follows normal procedures for PIV Card issuance. Assessment Determine that: (i) The use of a pseudonym is necessary to protect employees or contractors (review). (ii) The organization maintains a list of pseudonyms that have been issued and can link them to the employees or contractors authorized to receive such pseudonyms (review). (iii) Issuance procedures for pseudonyms are consistent with procedures for issuing regular PIV Cards (review, observe). (iv) The use of a pseudonym has been authorized by the organization (review).
2329 2330
Table 18. Maintenance Process for PCIs Identifier MP-1
Issuer Control
Source
A post-issuance update applies to cases where one or more certificates, keys, biometric data records, or signed data objects are updated. Postissuance updates do not modify the PIV Card expiration date, FASC-N, card UUID, or cardholder UUID.
[FIPS201], Sec. 2.9.2 – PIV Card Post Issuance Update Requirements
Assessment Determine that: (i) Only certificates, keys, biometric data records, or signed data objects are updated during a post-issuance update (review, interview). (ii) The PIV Card expiration date, FASC-N, card UUID, or cardholder UUID are not modified post-issuance (review, interview). MP-2
[FIPS201], Sec. 2.9.1 – PIV In the case of reissuance and termination, the PIV Card is collected and Reissuance Requirements destroyed whenever possible. If the PIV Card cannot be collected and destroyed, the CA is informed, and the certificates corresponding to the PIV [FIPS201], Sec. 2.9.4 - PIV Card authentication key and the asymmetric card authentication key on the PIV Termination Requirements
83
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
Card are revoked. The certificates corresponding to the digital signature and key management keys are also revoked, if present. Assessment Determine that: (i) In the case of reissuance and termination, the requirement that the PIV Card is collected and destroyed whenever possible is documented and performed (review, observe). (ii) The issuer has procedures to notify the CA in the event that the PIV Card cannot be collected (review, observe). MP-3 (UPDATED)
During PIV Card reissuance and termination, (i) normal revocation procedures are completed within 18 hours of notification if the issued PIV Card cannot be collected and destroyed, and (ii) any databases maintained by the PIV Card issuer that indicate current valid (or invalid) FASC-N or card UUID values are updated to reflect the change in status.
[FIPS201], Sec. 2.9.1 – PIV Reissuance Requirements [FIPS201], Sec. 2.9.4 – PIV Card Termination Requirements
Assessment Determine that: (i) Documentation includes the requirement that if a PIV Card cannot be collected and destroyed, normal revocation procedures are completed within 18 hours of notification (review). (ii) If the PIV Card cannot be collected and destroyed, normal revocation procedures are completed within 18 hours of notification (observe). (iii) Databases maintained by the issuer indicate that the FASC-N or card UUID values are updated to reflect the change in status (review, observe). MP-4 (UPDATED)
During PIV Card termination, the following actions are taken: (i) the PIV [FIPS201], Sec. 2.9.4 – PIV Card Card is collected and destroyed; (ii) per OPM guidance, the Central Termination Requirements Verification System is updated to reflect the change in status; and (iii) card management systems are updated to reflect the PIV Card termination and method of termination (e.g., PIV Card destruction for collected PIV Cards or certificate revocations for uncollected PIV Cards). Assessment Determine that: (i) The PIV Card is collected and destroyed, if available (review, observe). (ii) The Central Verification System is updated to reflect the change in status (observe). (iii) Card management systems are updated to reflect the PIV Card termination and method of termination (review, observe).
MP-5
Upon PIV Card termination, the organization enforces a standard methodology of updating systems of records to indicate the PIV Card status. This information is distributed effectively throughout the systems used for physical and logical access to organizational facilities and resources. Assessment Determine that: (i) The issuing facility has procedures to update information systems and disseminate information to indicate PIV Card termination (review). (ii) The organization’s information systems are updated to indicate PIV Card termination (observe).
84
Commonly accepted security readiness measures
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(iii) The PIV Card termination status is distributed to all logical and physical access points, as applicable (test). MP-7
The organization has completed a life cycle walkthrough at one year intervals since the last authorization date, and the results are documented in a report to the DAO.
SP 800-79, Sec. 5.4 – Monitoring Phase
Assessment Determine that: (i) The organization has completed a life cycle walkthrough to cover sponsorship, identity proofing, card production, activation/issuance, and maintenance processes (interview). (ii) Life cycle walkthroughs have been completed at one year intervals since the last authorization date (interview). (iii) The results of the issuer life cycle walkthrough have been documented and reviewed by the DAO (review, interview). MP-8 MP-9 (UPDATED)
The intent of this control is covered by controls MP-18 and MP-19.
-
The entire identity proofing, registration, and issuance process is repeated if the issuer does not maintain a PIV enrollment record that includes biometric data records for the cardholder.
[FIPS201], Sec. 2.9.1 – PIV Card Reissuance Requirements
Assessment Determine that: (i) The issuing facility completes the entire identity proofing, registration, and issuance process if they do not maintain a PIV enrollment record that includes biometric data records for the cardholder (review, observe). MP-10
Previously collected biometric data is not reused with the new PIV Card if the expiration date of the new PIV Card is more than 12 years after the date that the biometric data was obtained.
[FIPS201], Sec. 2.9.1 – PIV Card Reissuance Requirements
Assessment Determine that: (i) The issuing facility ensures that new biometric data is collected if the new PIV Card’s expiration is 12 years after the collection of the initial biometric data available with the issuer (review, observe). MP-11
Post-issuance updates are performed (either with the issuer in physical [FIPS201], Sec. 2.9.2 – PIV Card custody of the PIV Card or remotely) with issuer security controls Post Issuance Update equivalent to those applied during PIV Card reissuance. These include the Requirements following: (i) communication between the PIV Card issuer and the PIV Card only occurs over mutually authenticated secure sessions between tested and validated cryptographic modules (one being the PIV Card); (ii) data transmitted between the issuer and PIV Card is encrypted and contain data integrity checks; (iii) the PIV Card application will communicate with no endpoint entity other than the PIV Card issuer during the remote postissuance update. Assessment Determine that: (i) Post-issuance updates require all security controls to be implemented by the issuer and the issuer’s information systems (review).
MP-12 (UPDATED)
When a PIN reset is performed in person at the issuing facility, the issuer [FIPS201], Sec. 2.9.3.1 – PIN performs a biometric verification before giving the reset PIV Card back to Reset the cardholder to ensure that the cardholder’s biometric characteristics elicit a positive biometric verification decision when compared to biometric data
85
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
records stored in the PIV enrollment record or when compared to the biometric data records on the PIV Card using the BIO-A or OCC-AUTH authentication mechanisms. If the biometric verification decision is negative or the cardholder’s biometric characteristics are not successfully acquired, the cardholder provides another identity source document, and an attending operator inspects it and compares the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the card. Assessment Determine that: (i) The reset PIV Card is released to the cardholder only after a positive biometric verification decision (review, observe). (ii) If the biometric verification decision is negative, the cardholder provides a primary identity source document that is compared to the electronic facial image retrieved from the enrollment data record and the photograph printed on the card (interview, observe). MP-13 (UPDATED)
When a PIN reset is performed at an unattended issuer-operated kiosk, the [FIPS201], Sec. 2.9.3.1 – PIN issuer ensures that the PIV Card is authenticated and that the cardholder’s Reset biometric characteristics elicit a positive biometric verification decision when compared to biometric data records stored in the PIV enrollment record or when compared to the biometric data records on the PIV Card using the OCC-AUTH authentication mechanism. If the biometric verification decision is negative or the cardholder’s biometric characteristics are not successfully acquired, the session is terminated, and the kiosk does not reset the PIV Card. Assessment Determine that: (i) The reset PIV Card is only released to the cardholder after a positive biometric verification decision (review, observe).
MP-14
Remote PIN reset on a general computing platform (e.g., desktop, laptop) is only performed if the following requirements are met: (i) the cardholder initiates a PIN reset with the issuer operator, (ii) the operator authenticates the owner of the PIV Card through an independent procedure (e.g., authenticating the cardholder with an associated derived PIV credential or by confirming reset via email to the on-record government-issued email address), and (iii) the cardholder’s biometric characteristics elicit a positive biometric verification decision when compared to the stored biometric data records on the PIV Card through the OCC-AUTH authentication mechanism.
[FIPS201], Sec. 2.9.3.1 – PIN Reset
Assessment Determine that: (i) The PIV Card PIN is only reset after a positive biometric verification decision (observe). (ii) Remote PIN resets meet all security requirements to be implemented by the issuer and the issuer information systems (review, observe, test). MP-15
The intent of this control is covered by MP-21, MP-22, and MP-23.
-
MP-16 (NEW)
The issuer ensures that an adjudicative entity has authorized the issuance of the new PIV Card if the expiration date of the new PIV Card is later than the expiration date of the old card or if any data about the cardholder is being changed.
[FIPS201], Sec. 2.9.1 – PIV Card Reissuance Requirements
86
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
Assessment Determine that: (i) The issuance of the new PIV Card has been authorized (review). (ii) The issuer ensures that the adjudicative entity has verified that there is a PIV eligibility determination in an authoritative record in the IDMS or the Central Verification System (review). MP-17 (NEW)
During reissuance, the issuer only releases the new PIV card to the applicant after a positive biometric verification decision using the BIO-A or OCC-AUTH authentication mechanisms. If the biometric verification decision is negative or if no biometric data records are available, the cardholder provides two identity source documents, and an attending operator inspects them and compares the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the new PIV Card.
[FIPS201], Sec. 2.9.1 – PIV Card Reissuance Requirements
Assessment Determine that: (i) The new PIV Card is only released to the applicant after a positive biometric verification decision (review, observe). (ii) If the biometric verification decision is negative or if no biometric data records are available, the cardholder provides two identity source documents that are compared to the electronic facial image retrieved from the enrollment data record and the photograph printed on the new PIV Card (interview, observe). MP-18 (NEW)
During reissuance of a PIV Card, the following actions are taken: (i) a new [FIPS201], Sec. 2.9.1 – PIV Card PIV authentication certificate and a new card authentication certificate are Reissuance Requirements generated, (ii) the corresponding certificates are populated with the new FASC-N and card UUID, and (iii) a new digital signature key and associated certificate are generated for government-issued email accounts, while key management keys and associated certificates may be imported to the new PIV Card. Assessment Determine that: (i) A new PIV authentication key and certificate and card authentication key and certificate are generated (review). (ii) A new FASC-N and card UUID are generated to be populated on the newly issued certificates (review). (iii) A new digital signature key and certificate are issued (to be used for government-issued email accounts) (review). (iv) A new key management key and certificate are issued, or old key management keys and certificates are imported on to the new PIV Card (review, observe).
MP-19 (NEW)
In the event of a name change, the following actions are taken prior to the [FIPS201], Sec. 2.9.1 – PIV Card card issuer issuing a new PIV Card: (i) the cardholder notifies the issuer Reissuance Requirements that their name has changed and presents the card issuer with evidence of a formal name change, and (ii) the card issuer notifies the respective adjudicative entity of the name change to ensure that appropriate records are updated unless the expiration date of the new card is no later than the expiration of the old card and no data other that the cardholder’s name is being changed. Assessment Determine that: (i) The cardholder presents the issuer with evidence of a formal name change (e.g., marriage certificate, divorce decree, judicial
87
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
recognition of a name change, or any other mechanism permitted by state law or regulation) (review, observe). (ii) The card issuer notifies the respective adjudicative entity of the name change to ensure that appropriate records are updated, if required (review). MP-20 (NEW)
During a PIV Card activation reset, no more than 10 consecutive activation [FIPS201], Sec. 2.9.3 – PIV Card retries for each of the activation methods (i.e., PIN and OCC attempts) are Activation Reset permitted. Assessment Determine that: (i) The issuer does not permit more than 10 consecutive activation retries when attempting to reset the PIN or OCC (review, observe).
MP-21 (NEW)
When a PIN reset is performed at a supervised remote identity proofing [FIPS201], Sec. 2.9.3 – PIV Card station, the issuer initiates a biometric verification to ensure that the Activation Reset cardholder’s biometric characteristics captured at the station elicit a positive biometric verification decision when compared to biometric data records stored in the PIV enrollment record or when compared to the biometric data records on the PIV Card using the OCCAUTH authentication mechanism. If the biometric verification decision is negative or the cardholder’s biometric characteristics are not successfully acquired, the cardholder provides another primary identity source document via the scanners and sensors integrated into the station. The remote operator inspects the document and compares the video feed of the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the PIV Card. Assessment Determine that: (i) All protections and requirements of [FIPS201], Sec. 2.7.1 are observed during the procedure (review, observe). (ii) The PIV Card PIN is only reset after a positive biometric verification decision (review, observe). (iii) If the biometric verification decision is negative, the cardholder provides another primary identity source document via the scanners and sensors integrated into the station. The remote operator inspects the document and compares the video feed of the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the PIV Card (interview, observe).
MP-22 (NEW)
When an OCC reset is performed in person at the issuing facility, the issuer [FIPS201], Sec. 2.9.3 – OCC Reset performs a biometric verification of the cardholder to the biometric data records in the PIV enrollment record before the reset. If the biometric verification decision is negative or no alternative biometric data records are available, the cardholder provides another primary identity source document, which is inspected and compared to the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the PIV Card. Assessment Determine that: (i) Both fingerprints used for OCC are replaced during an OCC reset (observe, test). (ii) The reset PIV Card is only released to the cardholder after a positive biometric verification decision (review, observe).
88
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Source
(iii) If the biometric verification decision is negative or no alternative biometric data records are available, the cardholder provides another primary identity source document, which is inspected and compared to the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the PIV Card (review, observe). MP-23 (NEW)
When an OCC reset is performed at a supervised remote identity proofing [FIPS201], Sec. 2.9.3 – OCC Reset station, the operator initiates a biometric verification to ensure that the cardholder’s biometric characteristics captured at the station elicit a positive biometric verification decision when compared to biometric data records stored in the PIV enrollment record or when compared to the biometric data records on the PIV Card using the BIO-A authentication mechanism. If the biometric verification decision is negative or the cardholder’s biometric characteristics are not successfully acquired, the cardholder provides another primary identity source document via the scanners and sensors integrated into the station. The remote operator inspects the document and compares the video feed of the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the PIV Card. Assessment Determine that: (i) Both fingerprints used for OCC are replaced during an OCC reset (observe, test). (ii) All protections and requirements of [FIPS201], Sec. 2.7.1 are observed during the procedure (review, observe). (iii) The PIV Card OCC is only reset after a positive biometric verification decision (review, observe). (iv) If the biometric verification decision is negative, the cardholder provides another primary identity source document via the scanners and sensors integrated into the station. The remote operator inspects the document and compares the video feed of the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the PIV Card (interview, observe).
2331
89
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
2332
G.2.
Controls and Assessment Procedures for DPCIs
2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344
The following tables specify the controls and assessment procedures for derived PIV credential issuance. Unlike for a PIV Card issuer, not all controls are applicable to a derived PIV credential issuer as the issuance of a derived PIV credential is an instance of post-enrollment binding, which leverages the identity proofing and vetting associated with an existing PIV identity account. Certain issuer controls are only applicable to AAL2 or AAL3 derived PIV credentials and must therefore be implemented by the issuer only if they are issuing that level of a derived PIV credential. Similarly, certain issuer controls are applicable to PKI-based derived PIV credentials, while some are applicable to non-PKI-based derived PIV credentials. This is represented via the “applicability” columns, which identify whether the issuer control needs to be met by a PKI-based or non-PKI, AAL2, or AAL3 derived PIV credential issuer. If the “applicability” column states “DPCI,” then the issuer control is applicable to all derived credential issuers, regardless of what type of derived PIV credential is issued by the issuer.
2345
Table 19. Preparation and Maintenance of Documentation for DPCIs Identifier
Issuer Control
Applicability
DO(DC)-1
The organization develops and implements an issuer operations plan according to the template in Appendix D.2. The operations plan references other documents as needed.
DPCI
SP 800-79, Sec. 2.12 – Authorization Submission Package and Supporting Documentation
DPCI
[SP800-157], Sec. 2 – Life Cycle Activities and Related Requirements
Assessment Determine that: (i) The operations plan includes the relevant elements from the template in Appendix D.2 (review). (ii) The operations plan includes (i) the list of issuer controls from Appendix G.2, (ii) the owner for each owner, (iii) a description of how the control is implemented, and (iv) whether the control is organization or facility-specific (review). (iii) Relevant operating procedures and associated documentation are referenced accurately (review). (iv) The operations plan has been reviewed and approved by the DAO within the organization (review, interview). DO(DC)-3
The organization has a written policy and procedures for initial issuance that are approved by the federal department or agency. Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for issuance (to include inperson, remote, or both) (review). (ii) The policy is consistent with the organization’s mission and functions, [FIPS201], [SP800-157], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The policy and procedures are approved by the federal department or agency (review). (iv) The organization periodically reviews and updates the policy and procedures as required (review, interview).
90
Source
[SP800-157], Sec. 2.2 – Initial Issuance
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Identifier
Issuer Control
Applicability
Source
DO(DC)-5
The organization has a written policy and procedures that describe the conditions for derived PIV credential termination.
DPCI
[SP800-157], Sec. 2 – Life Cycle Activities and Related Requirements
DPCI
[SP800-157], Sec. 2 –Life Cycle Activities and Related Requirements
Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for derived PIV credential termination (review). (ii) The policy is consistent with the organization’s mission and functions, [FIPS201], [SP800-157], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The organization periodically reviews and updates the policy as required (review, interview). DO(DC)-6
The organization has a written policy and procedures that describe the conditions for derived PIV credential maintenance. Maintenance activities include rekeying, the modification of certificates (if the authenticator is PKI-based), and the replacement of an activation factor (e.g., biometric or memorized secret), as appropriate.
[SP800-157], Sec. 2.3 – Maintenance
Assessment Determine that: (i) The organization has developed and documented a written policy and procedures for derived PIV credential maintenance (review). (ii) the policy is consistent with the organization’s mission and functions, [FIPS201], [SP800-157], and applicable laws, directives, policies, regulations, standards, and guidance (review). (iii) The organization periodically reviews and updates the policy and procedures as required (review, interview).
2346 2347
Table 20. Assignment of Roles and Responsibilities for DPCIs Identifier RR(DC)-1
Issuer Control
Applicability
The organization has appointed the role of senior authorizing official (SAO).
Source
DPCI
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
DPCI
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
Assessment Determine that: (i) The organization has defined the role of senior authorizing official and its responsibilities according to the requirements of SP 800-79 (review). (ii) The organization has assigned the role of senior authorizing official (review). RR(DC)-2
The organization has appointed the role of designated authorizing official (DAO). Assessment Determine that:
91
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
(i) The organization has defined the role of designated authorizing official and its responsibilities according to the requirements of SP 800-79 (review). (ii) The organization has assigned the role of designated authorizing official (review, interview). RR(DC)-3
The organization has appointed the role of enterprise identity management official (EIMO).
DPCI
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
DPCI
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
DPCI
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
Assessment Determine that: (i) the organization has defined the role of enterprise identity management official and its responsibilities according to the requirements of SP 800-79 (interview). (ii) The organization has assigned the role of enterprise identity management official (review, interview). RR(DC)-4
The organization has appointed the role of assessor. Assessment Determine that: (i) the organization has defined the role of assessor and its responsibilities according to the requirements of SP 80079 (review). (ii) The organization has assigned the role of assessor (review). (iii) The assessor is a third party that is independent of and organizationally separate from the persons and offices directly responsible for the day-to-day operation of the organization (review, interview).
RR(DC)-5
The organization has appointed the role of privacy official (PO). Assessment Determine that: (i) The organization has defined the role of privacy official and its responsibilities according to the requirements of SP 800-79 (review). (ii) The organization has assigned the role of the privacy official (review). (iii) The privacy official does not have any other roles in the organization (review, interview).
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities
2348 2349
Table 21. Facility and Personnel Readiness for DPCIs Identifier
Issuer Control
Applicability
Source
FP(DC)-1
For hardware-based tokens issued in person, minimum physical controls at the issuing facility are implemented. These include (i) door locks and restricted access (e.g., use of locked rooms, safes, and lockable cabinets, as appropriate), (ii) secure issuance stations to ensure that no malicious code is introduced to compromise or otherwise impair the station and the derived PIV credential, (iii) security monitoring and automated alarms, (iv) emergency power and lighting, and (v) fire prevention and protection mechanisms.
DPCI
Commonly accepted security readiness measures
92
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
DPCI
Commonly accepted security readiness measures
DPCI
Commonly accepted security readiness measures
Assessment Determine that: (i) The EIMO and issuing facility managers are aware of the minimum set of physical controls that need to be in place at the facility (interview). (ii) The minimum physical security controls are implemented by the issuing facility (observe). (iii) The facility has a process to report any problems with the station to the issuer (review). FP(DC)-2
Issuer documentation (e.g., operations plan, standard operating procedures, contracts, etc.) are maintained for issuing facilities. Assessment Determine that: (i) The most current versions of issuer documentation are available for reference as needed (review, interview).
FP(DC)-3
The issuer develops, maintains, and securely stores a contingency/disaster recovery plan for information systems. Assessment Determine that: (i) The contingency/disaster recovery plan is stored securely at the facility (interview, observe). (ii) The operations staff are knowledgeable about how to restore/reconstitute information systems in case of system failures (interview).
FP(DC)-4
The intent of this control is covered by DP(DC)-1.
FP(DC)-5
For in-person authenticator issuance and maintenance using stations, ensure that the stations are situated in an enclosed area (e.g., wall or partition) to provide privacy for the applicant and the operator.
-
DPCI
Commonly accepted security readiness measures
Assessment Determine that: (i) Issuing facility stations are situated in an enclosed area (e.g., wall or partition) such that unauthorized individuals cannot see applicant information (observe). FP(DC)-6
This control is withdrawn since M-11-11 has been rescinded. -
FP(DC)-7
All operators who perform roles within the areas of initial issuance, maintenance, and termination have undergone training that is specific to their duties prior to being allowed to perform in that function. Assessment Determine that: (i) All operators who perform roles in the areas of initial issuance, maintenance, and termination are allowed access to information systems only after completing a training course specific to their duties (review, interview).
93
DPCI
SP 800-79, Sec. 2.6 – Issuer Roles and Responsibilities Commonly accepted security readiness measures
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
DPCI
Commonly accepted security readiness measures
DPCI
Commonly accepted security readiness measures
(ii) Records showing that the appropriate training course has been completed by issuing facility personnel are stored by the facility for audit purposes (interview, review). FP(DC)-8
All pre-personalized, unissued physical authenticators from vendors are only received by authorized personnel who ensure that these authenticators are stored, handled, and disposed of securely at the issuing facility. Assessment Determine that: (i) The issuing facility has an authorized list of personnel who are responsible for ensuring that authenticator stock is received and stored securely (interview). (ii) The procedures for receiving, storing, and destroying authenticators are documented in the issuing facility’s standard operating procedures (review). (iii) Authorized personnel are knowledgeable about the procedures on how to receive, store, and destroy the authenticators (interview).
FP(DC)-9
The organization maintains a current list of designated points of contact and alternate points of contact for all issuing facilities used by the organization for derived PIV credential (i.e., physical authenticators) issuance, maintenance, and termination processes. Assessment Determine that: (i) The organization maintains a list of designated points of contact and alternate points of contact for all issuing facilities used by the organization (review). (ii) The list is current, and the individuals named are the correct points of contact (review, interview).
2350 2351
Table 22. Protection of Stored and Transmitted Data for DPCIs Identifier
Issuer Control
Applicability
ST(DC)-1 (UPDATED)
The issuer PIV information systems are implemented in accordance with the spirit and letter of all federal privacy laws and policies, including the E-Government Act of 2002 [E-GOV], the Privacy Act of 1974 [PRIVACY], and OMB [M-03-22], as applicable.
DPCI
Assessment Determine that: (i) PIV information systems are operated and managed in accordance with federal privacy laws and applicable organizational policies (review). (ii) The organization does not disclose any record that is contained in the system of records to any person or to another organization unless written consent has been given by the individual to whom the record pertains or one of the exceptions for disclosure in the Privacy Act are met (review, interview).
94
Source [FIPS201], Sec. 2.11 – PIV Privacy Requirements E-Government Act [E-GOV] Privacy Act [PRIVACY] OMB Memorandum [M-03-22]
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
(iii) Individuals are permitted to gain access to their personal record (i.e., in the PIV identity account), and the information is provided in a form that is comprehensible to them (review, interview). (iv) Individuals are able to request amendments to records pertaining to them. Corrections are made promptly, and if not, the individual is provided with a reason for the refusal and is able to request a review of the refusal (review, interview). (v) The organization notifies an individual when their record is made available to any person under a compulsory legal process when such a process becomes a matter of public record (review, interview). ST(DC)-2
The information systems protect the integrity and confidentiality of transmitted information.
DPCI
Assessment Determine that: (i) The integrity of transmitted information is protected (interview, test, review). (ii) The confidentiality of transmitted information is protected (interview, test, review).
2352 2353
[FIPS201], Sec. 2.11 – PIV Privacy Requirements [SP800-157], Sec. 2.2 – Initial Issuance
Table 23. Enforcement of Privacy Requirements for DPCIs Identifier
Issuer Control
Applicability
Source
PR(DC)-1
Privacy act statements/notices, complaint procedures, appeals procedures for those denied derived PIV credentials or whose credentials are revoked, and sanctions for employees who violate privacy policies are developed and posted by the organization in multiple locations (e.g., internet site, human resource offices, regional offices, and contractor orientation handouts).
DPCI
OMB Memorandum [M-05-24]
DPCI
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
Assessment Determine that: (iii) The issuing facility posts privacy act statements/notices, complaint procedures, appeals procedures for those denied a token or whose token is revoked, and sanctions for employees who violate privacy policies (interview, review). (iv) The organization maintains appeal procedures for those who are denied a derived PIV credential or whose credentials are revoked (review). PR(DC)-2 (UPDATED)
The organization conducts a comprehensive privacy impact assessment (PIA) and a periodic review and update of the assessment on systems that contain PII for the purpose of implementing derived PIV credentials in a manner consistent with the methodology of [E-GOV] and the requirements of [M03-22]. Assessment Determine that:
95
E-Government Act [E-GOV] OMB Memorandum [M-03-22]
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
(i) The organization conducts a privacy impact assessment of their issuer information systems based on guidance found in [E-GOV] and [M-03-22] (review). (ii) The organization submits the privacy impact assessment of their issuer information systems to OMB (interview, review). PR(DC)-3
The organization’s employee and contractor identification SORNs are updated to reflect any changes in the disclosure of information to other organizations in order to be consistent with the Privacy Act of 1974 [PRIVACY] and OMB Circular [A-130], Appendix 1.
DPCI
Privacy Act [PRIVACY] OMB Memorandum [M-05-24]
Assessment Determine that: (i) The organization updates SORNs to reflect changes in the disclosure of information (review, interview). PR(DC)-4 (UPDATED)
The organization writes, publishes, and maintains a clear and comprehensive list of the types of information that will be collected (e.g., transactional information, PII), the purpose of collection, what information may be disclosed to whom during the life of the derived PIV credential, how the information will be protected, and the complete set of uses of the derived PIV credential and related information.
DPCI
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
DPCI
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
Assessment Determine that: (i) Before receiving the derived PIV credential, the issuer requires the applicant to be notified of the PII that is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of the information (review, observe). (ii) The applicant is informed of what PII is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (interview). PR(DC)-5
2354
The issuer employs technologies that allow for the continuous auditing of compliance with privacy policies and practices. Assessment Determine that: (i) The issuer employs technologies that allow for the continuous auditing of compliance with privacy policies and practices. This could include the use of technology to monitor data access, data flows between information systems, and the use of PII (interview, test).
96
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
2355
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Table 24. Deployed Products and Information Systems for DPCIs Identifier
Issuer Control
Applicability
Source
DP(DC)-1
Issuer PIV information systems are authorized to operate in accordance with [SP800-37] in order to be compliant with the provisions of OMB Circular [A-130], App III. The controls described in [SP800-53] are used to accomplish security and privacy goals, where applicable.
DPCI
[FIPS201], Appendix A.2 – Application of Risk Management Framework to IT System(s) Supporting PCI
DP(DC)-2
DP(DC)-3 DP(DC)-4 (NEW)
DP(DC)-5 (NEW)
Assessment Determine that: (i) The organization has a letter showing the current authorization decision for each information system used to support the issuer (review). Products and services utilized by an issuing facility to issue derived PIV credentials are listed on the GSA FIPS 201 Evaluation Program’s Approved Products List (APL), where applicable. 11
[FIPS201], Sec. 2.11 – PIV Privacy Requirements
DPCI
Federal Acquisition Regulation (FAR), Sec. 4.1302 – Acquisition of Approved Products and Services for Personal Identity Verification
Assessment Determine that: (i) The presence (i.e., make, model, versions) of each product or service that falls within one of the categories in the FIPS 201 Evaluation Program is checked on the APL (review). (ii) There is no product in operation that has been moved to the GSA FIPS 201 Evaluation Program Removed Products List (RPL). This control has been withdrawn as OMB Memorandum M-07- 06 has been rescinded. PKI-based derived PIV credentials issued at AAL2 meet the requirements for phishing resistance defined in [SP800-63B], Sec. 5.2.5. Assessment Determine that: (i) The organization establishes blanket approvals for particular device types that meet AAL2 requirements (interview). (ii) Either a multi-factor cryptographic device authenticator or a multi-factor cryptographic software authenticator as specified in [SP800-63B], Sec. 5.1.8.1 is used for derived PIV authentication at AAL2 (review, interview). (iii) For a specific devices or authenticators issued to a cardholder, the organization has a documented policy and procedure for approval and issuance (review, interview). Non-PKI based derived PIV credentials issued at AAL2 meet the requirements for phishing resistance defined in [SP80063B], Sec. 5.2.5. Assessment Determine that: (i) The organization establishes blanket approvals for particular device types that meet AAL2 requirements (interview).
OMB Memorandum [M-05-24]
PKI-AAL2
[SP800-157], Sec. 2.2 – Initial Issuance [SP800-157], Sec. 3.1.3 – Allowable Authenticator Types
Non-PKI-AAL2
[SP800-157], Sec. 2.2 – Initial Issuance [SP800-157], Sec. 3.2.1 – Allowable Authenticator Types
This control will be applicable when the test requirements and tools for testing and approving derived PIV credentials are available through the GSA FIPS 201 Evaluation Program.
11
97
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
DP(DC)-6 (NEW)
DP (DC)-7 (NEW)
DP (DC)-8 (NEW)
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control (ii) A cryptographic device authenticator or a multi-factor cryptographic software authenticator as specified in [SP800-63B], Sec. 5.1.8.1, or a single-factor cryptographic software authenticator as specified in [SP800-63B], Sec. 5.1.6.1 is used for derived PIV authentication at AAL2 (review, interview). (iii) For specific devices or authenticators issued to a cardholder, the organization has a documented policy and procedure for approval and issuance (review, interview). PKI-based derived PIV credentials issued at AAL3 meet the requirements for phishing resistance defined in [SP800-63B], Sec. 5.2.5. Assessment Determine that: (i) The organization establishes blanket approvals for particular device types that meet AAL3 requirements (interview). (ii) A multi-factor cryptographic device authenticator as specified in [SP800-63B], Sec. 5.1.9.1 is used for derived PIV authentication at AAL3 (review, interview). (iii) For specific devices or authenticators issued to a cardholder, the organization has a documented policy and procedure for approval and issuance (review, interview). Non-PKI-based derived PIV credentials issued at AAL3 meet the requirements for phishing resistance defined in [SP80063B], Sec. 5.2.5. Assessment Determine that: (i) The organization establishes blanket approvals for particular device types that meet AAL3 requirements (interview). (ii) Either a multi-factor cryptographic device authenticator as specified in [SP800-63B], Sec. 5.1.9.1 or a singlefactor cryptographic device authenticator as specified in [SP800-63B], Sec. 5.1.7.1 is used for derived PIV authentication at AAL3 (review, interview). (iii) For specific devices or authenticators issued to a cardholder, the organization has a documented policy and procedure for approval and issuance (review, interview). The applicant is provided with or needs to supply an approved physical authenticator for the highest AAL that the derived PIV credential will be used to authenticate. If the authenticator is not directly provided by the issuer, the issuer verifies that the authenticator’s characteristics (e.g., single-factor or multifactor) meet the requirements of [SP800-63B] for the highest authentication assurance level at which it will be used (AAL2 or AAL3), including [FIPS140] requirements. Assessment Determine that: (i) The organization establishes approved authenticator characteristics (review, interview).
98
Applicability
Source
PKI-AAL3
[SP800-157], Sec. 2.2 – Initial Issuance [SP800-157], Sec. 3.1.3 – Allowable Authenticator Types
Non-PKI-AAL3
[SP800-157], Sec. 2.2 – Initial Issuance [SP800-157], Sec. 3.2.1 – Allowable Authenticator Types
Non-PKI-AAL2, [SP800-157], Sec. 2.2.2 – NonNon-PKI-AAL3 PKI-based Derived PIV Credential Issuance
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
(ii) Authenticator characteristics meet the requirements of [SP800-63B] and [FIPS140] for the highest authentication level at which it will be used (review).
2356 2357
Table 25. Implementation of Credentialing Infrastructures for DPCIs Identifier
Issuer Control
Applicability
Source
CI(DC)-2 (UPDATED)
Derived PIV authentication certificates are issued under the idfpki-common-derived-pivAuth-hardware policy of the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework.
PKI-AAL3
[SP800-157], Sec. 3.1.1 – Certificate Policies for Derived PIV Credentials [SP800-157], Sec. 3.1.2 – Cryptographic Specifications
Assessment Determine that: (i) The PKI is listed on the Federal PKI Policy Authority’s website as being a provider of derived PIV Credential certificates at AAL3 (review). (ii) Derived PIV authentication certificates comply with the derived PIV authentication certificate profile (review). (iii) Cryptographic algorithms and key sizes are based on [SP800-78] (review). CI(DC)-11
For derived PIV authentication certificates issued under id-fpkicommon-derived-pivAuth-hardware, the derived PIV authentication key pair is generated within a hardware cryptographic module that meets the requirements of [SP80063B], Sec. 4.2.2, including being validated to [FIPS140] Level 2 or higher, providing Level 3 physical security to protect the derived PIV authentication private key while in storage, and not permitting the private key to be exported.
PKI-AAL3
[SP800-157], Sec. 2.2.1 – PKIBased Derived Credential Issuance [SP800-157], Sec. 3.1.2 – Cryptographic Specifications
Assessment Determine that: (i) The organization ensures that derived PIV authentication certificates issued under id-fpki-common-derivedpivAuth-hardware certificate policy are generated on cryptographic modules the meet the requirements of [SP800-63B], Sec. 4.2.2 and validated against [FIPS140] at Level 2 or higher with Level 3 physical security (review). (ii) The keypair is generated in the device (authenticator or endpoint) that will house the derived PIV credential (interview, test). CI(DC)-12
For derived PIV authentication certificates issued under id-fpkicommon-derived-pivAuth, the derived PIV authentication key pair is generated within a cryptographic module that has been validated to [FIPS140] Level 1 or higher. Assessment Determine that: (i) The organization ensures that derived PIV authentication certificates issued under id-fpki-common-derived-pivAuth certificate policy are generated on [FIPS140]-validated cryptographic modules or higher (review). (ii) If the key pair is generated outside of the authenticator itself, the private key is transferred via an authenticated
99
PKI-AAL2
[SP800-157], Sec. 3.1.2 – Cryptographic Specifications
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
protected channel as defined in [SP800-63B], and the authenticator meets the requirements of [SP800-63B], Sec. 4.2.2, including being validated to [FIPS140] Level 1 or higher (review). CI(DC)-13 (UPDATED)
Binding a derived PIV credential to a PIV identity account is accomplished through a connection to a PIV-authenticated endpoint, a direct connection to the PIV Card, or the use of the external authenticator binding procedure, as described in [SP800-63B], Sec. 6.1.2.4. In all cases, binding SHALL require the use of the PIV-AUTH authentication mechanism specified in [FIPS201].
DPCI
[SP800-157], Sec. 3.3 – Binding Derived PIV Credentials
DPCI
[SP800-157], Sec. 2.2 – Initial Issuance
PKI-AAL2
[SP800-157], Sec. 3.1.1 – Certificate Policies for Derived PIV Credentials
Assessment Determine that: (i) The organization has implemented a method to bind the derived PIV credential to the PIV identity account (review). (ii) Binding of the derived PIV credential to the PIV identity account uses the PIV-AUTH mechanism (observe). CI(DC)-14
The issuer retains the biometric sample used to verify the applicant for future reference. Assessment Determine that: (i) The issuer has implemented a process/system to retain the applicant’s biometric data for maintenance of the derived PIV Credential (review).
CI(DC)-18 (NEW)
Derived PIV authentication certificates are issued under the idfpki-common-derived-pivAuth policy of the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework. Assessment Determine that: (i) The PKI is listed on the Federal PKI Policy Authority’s website as being a provider of derived PIV Credential certificates (review). (ii) Derived PIV authentication certificates comply with the derived PIV authentication certificate profile (review). (iii) Cryptographic algorithms and key sizes are based on [SP800-78] (review).
CI(DC)-19 (NEW)
Once the applicant is authenticated and the derived PIV credential is issued, it is represented in the cardholder’s PIV identity account. Assessment Determine that: (i) The issuance of a derived PIV credential is recorded in the PIV identity account for the cardholder (review, observe, test).
100
[SP800-157], Sec. 3.1.2 – Cryptographic Specifications
DPCI
[SP800-157], Sec. 2.2 – Initial Issuance
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Issuer Control
CI(DC)-20 (NEW)
Authenticators used as non-PKI-based derived PIV credentials meet the cryptographic requirements specified in [SP800-63B], Sec. 5.1 for the corresponding authenticator type.
Applicability
Source
Non-PKI-AAL2, [SP800-157], Sec. 3.2.2 – Non-PKI-AAL3 Cryptographic Specifications
Assessment Determine that: (i) The authenticator used for non-PKI-based derived PIV credentials meet the cryptographic requirements in [SP800-63B], Sec. 5.1 (review, test).
2358 2359
Table 26. Sponsorship Process for DPCIs Identifier
Issuer Control
SP(DC)-1
A derived PIV credential is issued only upon request by a proper authority. Assessment Determine that: (i) The process for making a request is documented (review). (ii) A derived PIV credential is issued only by the home agency of the associated PIV identity account (review, interview). (iii) A request from a valid authority is made in order to issue a derived PIV credential (observe). The issuing facility collects personal information using only forms approved by OMB under the Paperwork Reduction Act of 1995.
SP(DC)-2
Applicability
Source
DPCI
[FIPS201], Sec. 2.1 –Control Objectives [SP800-157], Sec. 2.2 – Initial Issuance
DPCI
Paperwork Reduction Act [PAPER-RED]
Assessment Determine that: (i) The forms used to collect personal information have been approved by OMB (review, observe).
2360 2361
Table 27. Identity Proofing/Registration Process for DPCIs Identifier EI(DC)-1
2362
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
This control is withdrawn as there are no identity-proofing requirements for issuing derived PIV credentials.
2363
-
Source -
Table 28. Activation/Issuance Process for DPCIs Identifier
Issuer Control
Applicability
AI(DC)-5 (UPDATED)
A mechanism to block use of the derived PIV credential after a number of consecutive failed authentication attempts using the memorized secret is implemented.
DPCI
Assessment Determine that: (i) The implementation can block use of the derived PIV credential if the number of consecutive failed
101
Source [SP800-157], Sec. 3.1.4 – Activation Data [SP800-157], Sec. 3.2.3 – Activation Data
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
AI(DC)-16 AI(DC)-17 (UPDATED)
AI(DC)-18 (UPDATED)
AI(DC)-19 (NEW)
AI(DC)-20 (NEW)
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
attempts to activate the memorized secret has exceeded that set by the issuer (test, observe). This control is withdrawn. Requirements for issuance over multiple transactions is covered by AI(DC)-18. A derived PIV credential at AAL3 is issued after verifying that the applicant is currently eligible to possess a PIV Card by (i) performing the PKI-AUTH authentication mechanism described in Sec. 6.2.3.1 of [FIPS201] and (ii) identifying themselves using a biometric sample that can be verified against their PIV Card or the biometric information in their enrollment record. Assessment Determine that: (i) The issuer has a documented process in place to verify the identity of the applicant (review). (ii) Derived PIV credentials at AAL3 are issued in accordance with [SP800-63B]. Sec. 6.1.2.1 (review, interview, observe). If the issuance of a derived PIV credential at AAL3 consists of two or more transactions, the applicant identifies themselves using a biometric sample that can be verified against either their PIV Card or a biometric sample that was recorded in a previous transaction. Assessment Determine that: (i) The issuer retains the biometric sample for future reference. The retained biometric is used to verify the applicant (review, interview, observe). (ii) The issuing facility verifies the identity of the applicant by using a biometric sample that can be verified against their PIV Card or a biometric that was recorded in a previous transaction (review, observe). The issuer notifies the PIV cardholder of the binding of a derived PIV credential through independent means that would not afford an attacker the opportunity to interfere with the notification. Assessment Determine that: (i) The issuer has a process to notify the PIV cardholder of the binding of a derived PIV credential (review). (ii) The method of notification does not provide an attacker with an opportunity to interfere with the notification (review, observe). Activation using a biometric characteristic meets the requirements of [SP800-63B], Sec. 5.2.3. Assessment Determine that: (i) Activation of the biometric characteristic meets the requirements of [SP800-63B], Sec. 5.2.3 (review, interview).
102
-
Source
-
PKI-AAL3, Non-PKI-AAL3
[SP800-157], Sec. 2.2 – Initial Issuance
PKI-AAL3, Non-PKI-AAL3
[SP800-157], Sec. 2.2 – Initial Issuance
DPCI
[SP800-157], Sec. 2.2 – Initial Issuance
DPCI
[SP800-157], Sec. 3.1.4 – Activation Data [SP800-157], Sec. 3.2.3 – Activation Data
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Source
(ii) The applicant is able to successfully activate the derived PIV authenticator using the biometric characteristic (observe, test). AI(DC)-21 (NEW)
AI(DC)-22 (NEW)
AI(DC)-23 (NEW)
AI(DC)-24 (NEW)
AI(DC)-25 (NEW)
Unlocking the device that houses a derived PIV authenticator (e.g., mobile phone) is not considered activation of the authenticator. A separate entry of the activation secret or presentation of a biometric factor is performed to use the authenticator. Assessment Determine that: (i) A separate entry of the activation secret or presentation of a biometric factor is performed to use the authenticator (observe, test). A derived PIV credential at AAL2 is issued after verifying that the applicant is currently eligible to possess a PIV Card by performing the PKI-AUTH authentication mechanism described in Sec. 6.2.3.1 of [FIPS201]. Assessment Determine that: (i) The issuer has a documented process in place to verify the identity of the applicant (review). (ii) Derived PIV credentials are issued in accordance with [SP800-63B], Sec. 6.1.2.1 (review, interview, observe). Activation of the derived PIV authenticator using a memorized secret meets the requirements of [SP80063B], Sec. 5.2.11. Assessment Determine that: (i) Activation of the memorized secret meets the requirements of [SP800-63B], Sec. 5.2.11 (review, interview). (ii) The applicant is able to successfully activate the derived PIV authenticator using the established memorized secret (observe, test). The applicant is prompted to establish a memorized secret or biometric activation factor (or both) for a multifactor authenticator and successfully authenticate using the authenticator. Assessment Determine that: (i) A process to authenticate to a multi-factor authenticator is established (review, interview). (ii) The applicant is able to establish a memorized secret, a biometric activation factor, or both and successfully authenticate to the authenticator (observe, test). The applicant is prompted to register a memorized secret that meets the requirements of [SP800-63B], Sec. 5.1.1 for a single-factor authenticator that will be verified along with the physical authenticator during the authentication process. Assessment
103
DPCI
[SP800-157], Sec. 3.1.4 – Activation Data [SP800-157], Sec. 3.2.3 – Activation Data
PKI- AAL2, Non-PKI-AAL2
PKI-AAL2, PKI-AAL3
[SP800-157], Sec. 2.2 – Initial Issuance
[SP800-157], Sec. 3.1.4 – Activation Data
Non-PKI-AAL2, Non-PKI-AAL3
[SP800-157], Sec. 2.2.2 – NonPKI-Based Derived PIV Credential Issuance
Non-PKI-AAL2, Non-PKI-AAL3
[SP800-157], Sec. 2.2.2 – NonPKI-Based Derived PIV Credential Issuance
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
AI(DC)-26 (NEW)
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Determine that: (i) A process to register a memorized secret that meets the requirements of [SP800-63B], Sec. 5.1.1 is established (review, interview). (ii) The applicant is able to register a memorized secret that meets the requirements of [SP80063B], Sec. 5.1.1 and successfully authenticate to the authenticator (observe, test). Activation of a multi-factor authenticator being used as a derived PIV credential using a memorized secret SHALL meet the requirements of [SP800-63B], Sec. 5.2.11.
Non-PKI-AAL2, Non-PKI-AAL3
Source
[SP800-157], Sec. 3.2.3 – Activation Data
Assessment Determine that: (i) Activation of the multi-factor authenticator meets the requirements of [SP800-63B], Sec. 5.2.11 (review, interview). (ii) The applicant is able to successfully activate the multi-factor authenticator using the established memorized secret (observe, test).
2364 2365
Table 29. Maintenance Process for DPCIs Identifier
Issuer Control
Applicability
Source
MP(DC)-2 (UPDATED)
When an authenticator that contains the private key corresponding to a PKI-based derived PIV credential is lost, stolen, or damaged, the issuer prevents further use of the affected credential by either collecting and destroying the associated private key or by revoking the associated certificate.
PKI-AAL2, PKI-AAL3
[SP800-157], Sec. 2.1 – Derived PIV Credential Life Cycle Activities
MP(DC)-3 (NEW)
Assessment Determine that: (i) In the case of lost, stolen, damaged, or compromised credentials, the issuer has processes in place to collect the authenticator and destroy the private key or revoke the associated authentication certificate (review, observe, test). When a non-PKI-based derived PIV credential is lost, stolen, or damaged, the issuer invalidates the credential to prevent its further use. Assessment Determine that: (i) In the case of lost, stolen, damaged, or compromised credentials, the issuer has processes in place to invalidate the use of the credential so that it cannot be used to authenticate (review, observe, test).
104
[SP800-157], Sec. 2.4.1 – PKI-Based Derived PIV Credential Invalidation
Non-PKI-AAL2, Non-PKI-AAL3
[SP800-157], Sec. 2.1 – Derived PIV Credential Life Cycle Activities [SP800-157], Sec. 2.4.2 – Non-PKI-Based Derived PIV Credential Invalidation
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Identifier
Issuer Control
Applicability
MP(DC)-5
Upon derived PIV credential invalidation, the organization enforces a standard methodology for updating the PIV identity account to indicate the derived PIV credential status.
DPCI
[SP800-157], Sec. 2.4 – Invalidation
DPCI
SP 800-79, Sec. 5.4 – Monitoring Phase
MP(DC)-7
MP(DC)-11
MP(DC)-12 MP(DC)-13 MP(DC)-16
MP(DC)-17
Assessment Determine that: (i) The issuer has procedures to update the PIV identity account to indicate derived PIV credential invalidation (review). The organization has completed a life cycle walkthrough at one year intervals since the last authorization date, and the results are documented in a report to the DAO. Assessment Determine that: (i) The organization has completed a life cycle walkthrough to cover initial issuance, maintenance, and termination processes (interview). (ii) A life cycle walkthrough has been completed at one year intervals since the last authorization date (interview). (iii) The results of the issuer life cycle walkthrough have been documented and reviewed by the DAO (review, interview). When certificate rekeying or modification is performed remotely for a derived PIV credential, communication between the issuer and the cryptographic module in which the derived PIV authentication private key is stored occurs only over mutually authenticated secure sessions between tested and validated cryptographic modules. Assessment Determine that: (i) Remote updates for certificate rekeying and the modification of a derived PIV authentication certificate meet all required security controls to be implemented by the issuer and the issuer information systems (review). The intent of this control is covered by MP(DC)-22 and MP(DC)-23. The intent of this control is covered by MP(DC)-22 and MP(DC)-23. Reissuance of derived PIV credentials in cases of expiration, loss, damage, or compromise is performed in accordance with the initial issuance process. Assessment Determine that: (i) The issuer follows the initial issuance process while reissuing a derived PIV credential in cases of expiration, loss, damage, or compromise (review, observe). If the derived PIV authentication private key was created and stored on a hardware cryptographic token that permits export of the private key, then the derived PIV authentication certificate is revoked upon termination, even if the token is collected and either zeroized or destroyed.
105
PKI-AAL2, PKI-AAL3
Source
[SP800-157], Sec. 2.3.1 - PKIBased Derived PIV Credential Maintenance
-
-
-
-
DPCI
[SP800-157], Sec. 2.3 – Maintenance
PKI-AAL2, PKI-AAL3
[SP800-157], Sec. 2.4.1 – PKI-Based Derived PIV Credential Invalidation
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier
MP(DC)-18 (UPDATED)
MP(DC)-19 (NEW)
MP(DC)-22 (NEW)
MP(DC)-24 (NEW)
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Assessment Determine that: (i) The issuer has developed and follows compliant processes to terminate derived PIV credentials (review, observe). All derived PIV credentials associated with a given PIV Card are invalidated when the associated PIV identity account is terminated. Assessment Determine that: (i) The issuer has implemented a process to invalidate all issued derived PIV credentials when the PIV identity account is terminated (review, test). (ii) The issuer continuously monitors the associated PIV identity account to determine its termination status (review). If the subscriber’s PIV Card is reissued as a result of a change in the subscriber’s name and the subscriber’s name appears in the derived PIV authentication certificate, a new derived PIV authentication certificate is issued with the new name, and the previous certificate is invalidated. Assessment Determine that: (i) The issuer has procedures for updating a derived PIV authentication certificate as part of a reissuance of a subscriber’s PIV Card (review, observe). (ii) The existing derived PIV authentication certificate is revoked (review, observe, test). If the activation secret is forgotten or the permitted number of consecutive wrong attempts is reached, the organization is required to input the PIN unblocking key (PUK). If the PUK is not implemented by the authenticator or cannot be provided, the authenticator certificates are revoked, or the associated private keys are destroyed or zeroized. Assessment Determine that: (i) The PIN unblocking key is entered if the maximum number of consecutive wrong attempts is reached prior to resetting the memorized secret or the biometric activation factor (review, observe, test). (ii) If the PIN unblocking key cannot be entered, the authentication certificates are revoked, or the private keys are zeroized or destroyed (observe, test). If the memorized secret used for activation or the biometric activation factor needs to be changed, entry of the current memorized secret is required to change the value. Assessment Determine that: (i) Entry of the current activation secret is required prior to changing the memorized secret or the biometric activation factor (review, observe, test);
106
Source
DPCI
[SP800-157], Sec. 2.4 – Invalidation
PKI-AAL2, PKI-AAL3
[SP800-157], Sec. 2.3.1 – PKI-Based Derived PIV Credential Maintenance
PKI-AAL2, PKI-AAL3
[SP800-157], Sec. 3.1.4 – Activation Data
DPCI
[SP800-157], Sec. 3.1.4 – Activation Data [SP800-157], Sec. 3.2.3 – Activation Data
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023 Identifier MP(DC)-25 (NEW)
MP(DC)-26 (NEW)
2366
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Issuer Control
Applicability
Invalidation of a derived PIV credential is accomplished by Non-PKI-AAL2, invalidating the reference to the associated authenticator in Non-PKI-AAL3 the PIV identity account so that the authenticator cannot be used any longer. Assessment Determine that: (i) The issuer has developed and follows compliant processes to terminate derived PIV credentials (review, observe). (ii) Hardware-based authenticators (if used) are collected from the subscriber (observe). If the activation secret is forgotten or the permitted number of consecutive wrong attempts is reached, the activation secret and attempt counter can be reset by centralized management at the home agency. If centralized reset is not available, the authenticator is reset and will require rebinding to the PIV identity account. Assessment Determine that: (i) The organization has a method to reset the activation secret and the attempt counter (review, observe, test). (ii) If the activation secret and the attempt counter cannot be reset, the authenticator is reset and bound to the PIV identity account (observe, test).
107
Non-PKI-AAL2, Non-PKI-AAL3
Source [SP800-157], Sec. 2.4.2 – Non-PKI-Based Derived PIV Credential Invalidation
[SP800-157], Sec. 3.2.3 – Activation Data
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
2367 2368
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Appendix H. Assessment and Authorization Tasks Table 30. Initiation Phase, Task 1: Preparation
Subtask
2369
Role(s) Responsible
Subtask 1.1: Confirm that the operations of the issuer is fully described and documented in an operations plan.
EIMO
Subtask 1.2: Confirm that processes performed are conducted in accordance with the policies and procedures specified in the issuer’s operations plan and are documented in standard operating procedures.
EIMO, Issuing Facility Manager
Table 31. Initiation Phase, Task 2: Resource identification
Subtask
2370
Role(s) Responsible
Subtask 2.1: Identify the SAO, DAO, PO, issuing facility managers, assessor, and other key personnel at the facility level who are performing functions, such as identity proofing/registration, card/token production, and activation/issuance (of the PIV Card or derived PIV credential). Maintenance personnel also need to be contacted to provide requested assessment information to the assessor.
EIMO
Subtask 2.2: Determine the authorization boundary for the issuer.
EIMO, DAO
Subtask 2.3: Determine the resources and the time needed for the assessment of the issuer, and prepare a plan to execute the assessment.
EIMO, Assessor, DAO
Table 32. Initiation Phase, Task 3: Operations plan analysis and acceptance
Subtask
Role(s) Responsible
Subtask 3.1: Review the list of required issuer controls documented in the organization’s issuer operations plan, and confirm that they have been implemented properly.
DAO, EIMO
Subtask 3.2: Analyze the operations plan to determine whether there are deficiencies in satisfying all of the policies, procedures, and other requirements in [FIPS201] that could result in a DATO being issued. After discussing the discovered deficiencies in the documentation and operations plan with the EIMO, the organization may still want to continue with the assessment if it has determined that it can address all deficiencies within the time period of the current assessment. In this situation, the DAO either authorizes continuation of the assessment or terminates the assessment effort, depending on the evaluation of the issuer’s ability to address the deficiencies.
DAO, EIMO
Subtask 3.3: Verify that the operations plan is acceptable
DAO
108
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
2371
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Table 33. Assessment Phase, Task 4: Issuer control assessment
Subtask
2372
Role(s) Responsible
Subtask 4.1: Review the suggested and selected assessment methods for each issuer control in preparation for the assessment.
Assessor
Subtask 4.2: Assemble all documentation and the supporting materials necessary for the assessment of the issuer. If these documents include previous assessments, review the findings, and determine whether they are applicable to the current assessment.
EIMO, Assessor
Subtask 4.3: Assess the required issuer controls using the prescribed assessment procedures found in Appendices G.1 and G.2 based on the scope of the issuance functions.
Assessor
Subtask 4.4: Prepare the assessment report.
Assessor
Table 34. Assessment Phase, Task 5: Assessment documentation
Subtask
Role(s) Responsible
Subtask 5.1: Provide the EIMO with the assessment report.
Assessor
Subtask 5.2: Revise the operations plan (if necessary), and implement its new provisions.
EIMO
Subtask 5.3: Prepare the CAP
EIMO
Subtask 5.4: Assemble the authorization submission package, and EIMO submit it to the DAO.
2373
Table 35. Authorization Phase, Task 6: Authorization decision
Subtask
2374
Role(s) Responsible
Subtask 6.1: Review the authorization decision package to see if it is complete and if all applicable issuer controls are fully assessed using the designated assessment procedures.
DAO
Subtask 6.2: Determine whether the risk to the organization’s operations, assets, or potentially affected individuals is acceptable.
DAO
Subtask 5.3: Share the authorization package with an independent party for review, and arrive at an authorization decision
DAO
Table 36. Authorization Phase, Task 7: Authorization documentation
Subtask
Role(s) Responsible
Subtask 7.1: Provide copies of the authorization decision package in either paper or electronic form to the EIMO and any other organization officials who have interests, roles, or responsibilities in the issuer’s operations.
109
DAO
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Subtask
Role(s) Responsible
Subtask 7.2: Update the operations plan.
2375
EIMO
Table 37. Monitoring Phase, Task 8: Operations plan update
Subtask
2376
Role(s) Responsible
Subtask 8.1: Document all relevant changes in the issuance processes within the operations plan.
EIMO
Subtask 8.2: Analyze the proposed or actual changes to the issuer, and determine the impacts of such changes.
EIMO
Table 38. Monitoring Phase, Task 9: Annual life cycle walkthrough
Subtask
Role(s) Responsible
Subtask 9.1: Observe all of the processes involved in getting a PIV Card or a derived PIV credential, including those from sponsorship to maintenance. Observe each process, and compare EIMO (or designated appointee) its controls against the applicable list of required issuer controls. If an issuer has several facilities, this process needs to be repeated using randomly selected issuing facilities. Subtask 9.2: The results of the life cycle walkthrough are summarized in a report to the DAO. The report highlights any deficiencies and the corrective actions that need to be implemented to correct those deficiencies.
110
EIMO, DAO
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
2377
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Appendix I. Revision History Version SP 800-79 SP 800-79-1
SP 800-79-2
Release Date Updates July 2005 Initial Release June 2008 The major changes for this revision include: • Removal of attributes as the basis of reliability assessment, and replacing them with PCI controls, traceable to specific requirements from FIPS 201-1 and related documents; • Additional guidelines on how to determine the accreditation boundaries of a PCI; • Discussion of the risk involved in authorizing the operation of a PCI; • Removal of “Section 4.0 - PCI Functions and Operations” and “Section 5.0 - PIV Services and Operations,” which were narrative discussions of FIPS 201-1 requirements; • Clarification of the similarities and differences between the accreditation of computer systems for secure operation as specified in SP 800-37 and the accreditation of the reliability of an organization as specified in SP 800-79-1; • Changing the term “certification” to “assessment”; and • Use of “organization” instead of “department” or “agency. The major changes for this revision include additions and updates to issuer controls in response to new or changed requirements in FIPS 201-2. These are: • • • • • •
Inclusion of issuer controls for Derived PIV Credentials Issuers (DPCI); Addition of issuer controls for issuing PIV Cards under the grace period and for issuing PIV Cards to individuals under pseudonymous identity; Addition of issuer controls for the PIV Card’s visual topography; Provided detailed controls to address post-issuance updates for PIV Cards; Updated references to more recent credentialing guidance issued by Office of Personnel Management (OPM); Addition of issuer controls with respect to the chain-of-trust records maintained by a PIV Card issuer; and
111
NIST SP 800-79r3 ipd (Initial Public Draft) December 2023
Version SP 800-79-3
Guidelines for the Authorization of PIV Card and Derived PIV Credential Issuers
Release Date Updates • Modified process to include an independent review prior to authorization of issuer. [Insert Date] The major changes for this revision include additions and updates to issuer controls in response to new or changed requirements in [FIPS201] and [SP800-157]: •
•
•
Updates to issuer controls based on revisions to [FIPS201], which include: o Supervised remote identity-proofing o Inclusion of the concept of a PIV identity account Inclusion of additional issuer controls for derived PIV credentials based on updates to [SP800-157], which include: o PKI and non-PKI-based credentials issued at authentication assurance level (AAL) 2 or 3 Updates to issuer controls based on updated adjudicative guidelines for PIV credential eligibility issued by the Office of Personnel Management (OPM)
2378
112
Related documents
- NIST SP 800-119: Guidelines for the Secure Deployment of IPv6#2864
- Updated Specification of the IPv4 ID Field#144363
- An IPv6 Provider-Based Unicast Address Format#133839
- Nielson v Revenue and Customs () [2026] UKUT 193 (TCC) (18 May 2026)#195278
- IPv6 Global Unicast Address Format#222721
Retrieved via Conceptio: every document is proof-bundled with source, license, and retrieval metadata.
Read the Docs → · View CLI source on GitHub · Conceptio Open Knowledge Archive