NIST PIV and digital identity FIPS 201-2 → FIPS 201-3
Published 2022-01-24
Snapshot taken 2026-10-19 23:49 · fips-201 source
Snapshot taken 2026-10-19 23:49 · fips-201 source
+ 36 added: 1.3.6, 2.10.1, 2.10.2, 2.10.3, 2.7.1, 2.8.3, 2.9.3.1, 2.9.3.2, 3.3, 4.2.2.1…
~ 88 revised: 1, 1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.4…
Why this release, in the publisher's words
Appendix E Revision History: This appendix is informative. It provides an overview of the changes to FIPS 201 since its initial release. Version Release Date Updates Location FIPS 201 February 2005 Initial Release FIPS 201-1 March 2006 Added the requirement for electronically distinguishable from identity credentials issued to individuals who have a completed investigation (NACI Indictor). FIPS 201 -
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdfAll · 1241 Introduction · 112 Common Identification, Security, and Privacy Requirements · 263 PIV System Overview · 74 PIV Front-End Subsystem · 345 PIV Key Management Requirements · 96 PIV Cardholder Authentication · 187 Federation Considerations for PIV · 4Appendix A PIV Validation, Certification, and Accreditation · 6Appendix B PIV Object Identifiers and Certificate Extension · 3Appendix C Glossary of Terms, Acronyms, and Notations · 4Appendix D References · 1Appendix E Revision History · 1
Controls added, removed or revised 124
| Control | Title | Change |
|---|---|---|
| 1 | Introduction | Control text |
| 1.1 | Purpose | Control text |
| 1.2 | Scope | Control text |
| 1.3 | Change Management | Control text |
| 1.3.1 | Backward Compatible Change | Control text |
| 1.3.2 | Backward Incompatible Change | Control text, Title |
| 1.3.3 | New Features | Control text |
| 1.3.4 | Deprecated and Removed Features | Control text, Title |
| 1.3.5 | FIPS 201 Version Management | Control text |
| 1.3.6 | Section Number Stability | added |
| 1.4 | Document Organization | Control text |
| 2 | Common Identification, Security, and Privacy Requirements | Control text |
| 2.1 | Control Objectives | Control text |
| 2.10 | Derived PIV Credentials | Control text, Title |
| 2.10.1 | Derived PIV Credential Issuance Requirements | added |
| 2.10.2 | Derived PIV Credential Invalidation Requirements | added |
| 2.10.3 | Derived PIV Credential Reissuance and Post-Issuance Update Requirements | added |
| 2.11 | PIV Privacy Requirements | Control text |
| 2.2 | Credentialing Requirements | Control text |
| 2.3 | Biometric Data Collection for Background Investigations | Control text |
| 2.4 | Biometric Data Collection for PIV Card | Control text |
| 2.5 | Biometric Data Use | Control text |
| 2.6 | PIV Enrollment Records | Control text, Title |
| 2.7 | PIV Identity Proofing and Registration Requirements | Control text |
| 2.7.1 | Supervised Remote Identity Proofing | added |
| 2.8 | PIV Card Issuance Requirements | Control text |
| 2.8.1 | Special Rule for Pseudonyms | Control text |
| 2.8.2 | Grace Period | Control text |
| 2.8.3 | Remote Issuance | added |
| 2.9 | PIV Card Maintenance Requirements | Control text |
| 2.9.1 | PIV Card Reissuance Requirements | Control text |
| 2.9.1.1 | Special Rule for Name Change by Cardholder | Control text |
| 2.9.2 | PIV Card Post-Issuance Update Requirements | Control text, Title |
| 2.9.3 | PIV Card Activation Reset | Control text, Title |
| 2.9.3.1 | PIN Reset | added |
| 2.9.3.2 | OCC Reset | added |
| 2.9.4 | PIV Card Termination Requirements | Control text |
| 3 | PIV System Overview | Control text |
| 3.1 | Functional Components | Control text |
| 3.1.1 | PIV Front-End Subsystem | Control text |
| 3.1.2 | PIV Issuance and Management Subsystem | Control text, Title |
| 3.1.3 | PIV Relying Subsystem | Control text |
| 3.2 | PIV Card Lifecycle Activities | Control text |
| 3.3 | Connections Between System Components | added |
| 4 | PIV Front-End Subsystem | Control text |
| 4.1 | PIV Card Physical Characteristics | Control text |
| 4.1.1 | Printed Material | Control text |
| 4.1.2 | Tamper-proofing and Resistance | Control text, Title |
| 4.1.3 | Physical Characteristics and Durability | Control text |
| 4.1.4 | Visual Card Topography | Control text |
| 4.1.4.1 | Mandatory Items on the Front of the PIV Card | Control text |
| 4.1.4.2 | Mandatory Items on the Back of the PIV Card | Control text |
| 4.1.4.3 | Optional Items on the Front of the PIV Card | Control text |
| 4.1.4.4 | Optional Items on the Back of the PIV Card | Control text |
| 4.1.5 | Color Representation | Control text |
| 4.2 | PIV Card Logical Characteristics | Control text |
| 4.2.1 | Cardholder Unique Identifier (CHUID) | Control text |
| 4.2.2 | Cryptographic Specifications | Control text |
| 4.2.2.1 | PIV Authentication Key | added |
| 4.2.2.2 | Asymmetric Card Authentication Key | added |
| 4.2.2.3 | Symmetric Card Authentication Key (Deprecated) | added |
| 4.2.2.4 | Digital Signature Key | added |
| 4.2.2.5 | Key Management Key | added |
| 4.2.2.6 | PIV Card Application Administration Key | added |
| 4.2.2.7 | PIV Secure Messaging Key | added |
| 4.2.3 | Biometric Data Specifications | Control text, Title |
| 4.2.3.1 | Biometric Data Representation | Control text |
| 4.2.3.2 | Biometric Data Record Protection | Control text, Title |
| 4.2.3.3 | Biometric Data Record Access | Control text, Title |
| 4.2.4 | PIV Unique Identifiers | Control text |
| 4.3 | PIV Card Activation | Control text |
| 4.3.1 | Activation by Cardholder | Control text |
| 4.3.2 | Activation by Card Management System | Control text |
| 4.4 | Card Reader Requirements | Control text |
| 4.4.1 | Contact Reader Requirements | Control text |
| 4.4.2 | Contactless Reader Requirements | Control text |
| 4.4.3 | Reader Interoperability (Removed) | Control text, Title |
| 4.4.4 | Card Activation Device Requirements | Control text |
| 5 | PIV Key Management Requirements | Control text |
| 5.1 | Architecture | Control text |
| 5.2 | PKI Certificate | Control text |
| 5.2.1 | X.509 Certificate Contents | Control text |
| 5.3 | X.509 Certificate Revocation List (CRL) Contents | Control text, Title |
| 5.4 | Legacy PKIs (Removed) | Control text, Title |
| 5.5 | PKI Repository and Online Certificate Status Protocol (OCSP) | Control text, Title |
| 5.5.1 | Certificate and CRL Distribution | Control text |
| 5.5.2 | OCSP Status Responders | Control text |
| 6 | PIV Cardholder Authentication | Control text |
| 6.1 | PIV Assurance Levels | Control text |
| 6.1.1 | Relationship to Federal Identity Policy (Removed) | Control text, Title |
| 6.2 | PIV Card Authentication Mechanisms | Control text |
| 6.2.1 | Authentication Using O˙-Card Biometric One-to-One Comparison | Control text, Title |
| 6.2.1.1 | Unattended Authentication Using Biometric Data (BIO) | Control text, Title |
| 6.2.1.2 | Attended Authentication Using Biometric Data (BIO-A) | Control text, Title |
| 6.2.2 | Authentication Using On-Card Biometric One-to-One Comparison (OCC-AUTH) | Control text, Title |
| 6.2.3 | Authentication Using PIV Asymmetric Cryptography | Control text |
| 6.2.3.1 | Authentication with the PIV Authentication Certificate Credential (PKI-AUTH) | Control text |
| 6.2.3.2 | Authentication with the Card Authentication Certificate Credential (PKI-CAK) | Control text |
| 6.2.3.3 | Authentication Using Secure Messaging Key (SM-AUTH) | added |
| 6.2.4 | Authentication Using the Symmetric Card Authentication Key (SYM-CAK) | Control text, Title |
| 6.2.5 | Authentication Using the CHUID (Removed) | Control text, Title |
| 6.2.6 | Authentication Using PIV Visual Credentials (VIS) (Deprecated) | Control text, Title |
| 6.3 | PIV Support of Graduated Authenticator Assurance Levels | Control text, Title |
| 6.3.1 | Physical Access | Control text |
| 6.3.2 | Logical Access | Control text |
| 7 | Federation Considerations for PIV | added |
| 7.1 | Connecting PIV to Federation | added |
| 7.2 | Federation Assurance Level (FAL) | added |
| 7.3 | Benefits of Federation | added |
| Appendix A | PIV Validation, Certification, and Accreditation | added |
| A.1 | Accreditation of PIV Card Issuers (PCI) and Derived PIV Credential | added |
| A.2 | Application of Risk Management Framework to IT Systems | added |
| A.3 | Conformance Testing of PIV Card Application and Middleware | added |
| A.4 | Cryptographic Testing and Validation | added |
| A.5 | FIPS 201 Evaluation Program | added |
| Appendix B | PIV Object Identifiers and Certificate Extension | added |
| B.1 | PIV Object Identifiers | added |
| B.2 | PIV Background Investigation Indicator Certificate Extension | added |
| Appendix C | Glossary of Terms, Acronyms, and Notations | added |
| C.1 | Glossary of Terms | added |
| C.2 | Acronyms and Abbreviations | added |
| C.3 | Notations | added |
| Appendix D | References | added |
| Appendix E | Revision History | added |
Read every requirement in this version · All versions of NIST PIV and digital identity