BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1.4 Document Organization

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 1 Introduction part of 1

Title

Document Organization

Control changed

Before · FIPS 201-2

This Standard describes the minimum requirements for a Federal personal identification system that meets the control and security objectives of [HSPD-12], including identity proofing, registration, and issuance. It provides detailed technical specifications to support the control and security objectives of [HSPD-12] as well as interoperability among Federal departments and agencies. This Standard describes the policies and minimum requirements of a PIV Card that allows interoperability of credentials for physical and logical access. The physical card characteristics, storage media, and data elements that make up identity credentials are specified in this Standard. The interfaces and card architecture for storing and retrieving identity credentials from a smart card are specified in Special Publication 800-73 [SP 800-73], Interfaces for Personal Identity Verification . Similarly, the requirements for collection and formatting of biometric information are specified in Special Publication 800-76 [SP 800-76], Biometric Specifications for Personal Identity Verification . The requirements for cryptographic algorithms are specified in Special Publication 800-78 [SP 800-78], Cryptographic Algorithms and Key Sizes for Personal Identity Verification . The requirements for the accreditation of PIV Card issuers are specified in Special Publication 800-79 [SP 800-79], Guidelines for the Accreditation of Personal Identity Verification Card Issuers . The unique organizational codes for Federal agencies are assigned in Special Publication 800-87 [SP 800-87], Codes for the Identification of Federal and Federally-Assisted Organizations . The requirements for the PIV Card reader are provided in Special Publication 800-96 [SP 800-96], PIV Card to Reader Interoperability Guidelines . The format for encoding the chain-of-trust for import and export is specified in Special Publication 800-156 [SP 800-156], Representation of PIV Chain-of-Trust for Import and Export . The requirements for issuing derived PIV credentials are specified in Special Publication 800-157 [SP 800-157], Guidelines for Derived Personal Identity Verification (PIV) Credentials .

This Standard contains normative references to other documents, and to the extent described in each citation these documents are included by reference in this Standard. Should normative text in this Standard conflict with normative text in a referenced document the normative text in this Standard prevails for this Standard.

2 The CHUID data element has not been deprecated and continues to be mandatory. All sections in this document are normative (i.e., mandatory for compliance) unless specified as informative (i.e., non-mandatory). Following is the structure of this document:

+ Section 1, Introduction, provides background information for understanding the scope of this Standard. This section is informative .

+ Section 2, Common Identification, Security, and Privacy Requirements, outlines the requirements for identity proofing, registration, and issuance, by establishing the control and security objectives for compliance with [HSPD-12]. This section is normative .

+ Section 3, PIV System Overview, serves to provide a PIV system overview. This section is informative .

+ Section 4, PIV Front-End Subsystem, provides the requirements for the components of the PIV front-end subsystem. Specifically, this section defines requirements for the PIV Card, logical data elements, biometrics, cryptography, and card readers. This section is normative .

+ Section 5, PIV Key Management Requirements, defines the processes and components required for managing a PIV Card’s lifecycle. It also provides the requirements and specifications related to this subsystem. This section is normative .

+ Section 6, PIV Cardholder Authentication, defines a suite of authentication mechanisms that are supported by the PIV Card, and their applicability in meeting the requirements of graduated levels of identity assurance. This section is normative .

+ Appendix A, PIV Validation, Certification, and Accreditation, provides additional information regarding compliance with this document. This appendix is normative .

+ Appendix B, PIV Object Identifiers and Certificate Extension, provides additional details for the PIV objects identified in Section 4. This appendix is normative .

+ Appendix C, Glossary of Terms, Acronyms, and Notations, describes the vocabulary and textual representations used in the document. This appendix is informative .

+ Appendix D, References, lists the specifications and standards referred to in this document. This appendix is informative .

+ Appendix E, Revision History, lists changes made to this Standard from its inception. This appendix is informative .

After · FIPS 201-3

This Standard describes the minimum requirements for a Federalfederal personal identificationidentity verification system that meets the control and security objectives of [HSPD-12], including identity proofing, registration, and issuance. It provides detailed technical specifications to support the control and security objectives of [HSPD-12] as well as interoperability among Federalfederal departments and agencies. This Standard describes the policies and minimum requirements of a PIV Card and derived PIV credentials that allowsallow interoperability of credentials for physical and logical access. It specifies the use of federation protocols as a means of accepting PIV Card credentials and derived PIV credentials issued by other agencies. The physical card characteristics, storage media, and data elements that make up identity credentials are specified in this Standard. The interfaces and card architecture for storing and retrieving identity credentials from a smart card are specified in Special Publication 800-73 [SP 800-73], Interfaces for Personal Identity Verification . Similarly, the requirements for collection, formatting, and formattinguse of biometric informationdata records are specified in Special Publication 800-76 [SP 800-76], Biometric Specifications for Personal Identity Verification . The requirements for cryptographic algorithms are specified in Special Publication 800-78 [SP 800-78], Cryptographic Algorithms and Key Sizes for Personal Identity Verification . The requirements for the accreditation of PIV Card issuers are specified in Special Publication 800-79 [SP 800-79], Guidelines for the Accreditation of Personal Identity Verification Card Issuers . The unique organizational codes for Federalfederal agencies are assigned in Special Publication 800-87 [SP 800-87], Codes for the Identification of Federal and Federally-Assisted Organizations . The requirements for the PIV Card readerreaders are provided in Special Publication 800-96 [SP 800-96], PIV Card to Reader Interoperability Guidelines . The format for encoding thePIV chain-of-trustenrollment records for import and export is specified in Special Publication 800-156 [SP 800-156], Representation of PIV Chain-of-Trust for Import and Export . The requirements for issuing derived PIV credentials are specified in Special Publication 800-157 [SP 800-157],. Guidelines for Derivedthe Personaluse Identityof Verificationfederation (with PIV) Credentials will be specified in [SP 800-217].

This Standard contains normative references to other documents, and to the extent described in each citation these documents are included by reference in this Standard. Should normative text in this Standard conflict with normative text in a referenced document, the normative text in this Standard prevails for this Standard.

2 The CHUID data element has not been deprecated and continues to be mandatory. All sections in this document indicate whether they are normative (i.e., mandatoryprovide requirements for compliance) unless specified asor informative (i.e., non-mandatory).provide Followinginformation isdetails thethat structuredo ofnot thisaffect compliance). This document is structured as follows:

+• Section 1, Introduction, provides background information for understanding the scope of this Standard. This section is informative unless otherwise marked as normative.

+
• Section 2, Common Identification, Security, and Privacy Requirements, outlines the requirements for identity proofing, registration, and issuance, by establishing the control and security objectives for compliance with [HSPD-12]. This section is normative .

+
• Section 3, PIV System Overview, servesprovides toan provideoverview aof the different components of the PIV system overview. This section is informative .

+
• Section 4, PIV Front-End Subsystem, provides the requirements for the components of the PIV front-end subsystem. Specifically, this sectionIt defines requirements for the PIV Card, logical data elements, biometricsbiometric data records, cryptography, and card readers. This section is normative .

+
• Section 5, PIV Key Management Requirements, defines the processes and components required for managing a PIV Card’s lifecycle. It also provides the requirements and specifications related to thiskey subsystemmanagement. This section is normative .

+
• Section 6, PIV Cardholder Authentication, defines a suite of authentication mechanisms that are supported by the PIV Card, and their applicability in meeting the requirements of graduated levels of identity assurance. This section is normative .

+
• Section 7, Federation, defines a set of mechanisms for using federation technologies to interoperate with PIV credentials issued by other agencies. This section is normative .
• Appendix A, PIV Validation, Certification, and Accreditation, provides additional information regarding compliance with this document. This appendix is normative .

+
• Appendix B, PIV Object Identifiers and Certificate Extension, provides additional details for the PIV objects identified in Section 4. This appendix is normative .

+
• Appendix C, Glossary of Terms, Acronyms, and Notations, describes the vocabulary and textual representations used in the document. This appendix is informative .

+
• Appendix D, References, lists the specifications and standards referred to in this document. This appendix is informative .

+
• Appendix E, Revision History, lists changes made to this Standard from its inception. This appendix is informative .