BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.11 PIV Privacy Requirements

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 2 Common Identification, Security, and Privacy Requirements part of 2

Title

PIV Privacy Requirements

Control changed

Before · FIPS 201-2

HSPD-12 explicitly states that “protect[ing] personal privacy” is a requirement of the PIV system. As such, all departments and agencies shall implement the PIV system in accordance with the spirit and letter of all privacy controls specified in this Standard, as well as those specified in Federal privacy laws and policies including but not limited to the E-Government Act of 2002 [E-Gov], the Privacy Act of 1974 [PRIVACY], and OMB Memorandum M-03-22 [OMB0322], as applicable.

Departments and agencies may have a wide variety of uses of the PIV system and its components that were not intended or anticipated by the President in issuing [HSPD-12]. In considering whether a proposed use of the PIV system is appropriate, departments and agencies shall consider the aforementioned control objectives and the purpose of this Standard, namely “to enhance security, increase Government efficiency, reduce identity fraud, and protect personal privacy” [HSPD-12]. No department or agency shall implement a use of the identity credential inconsistent with these control objectives.

To ensure the privacy throughout PIV lifecycle, departments and agencies shall do the following:

• Assign an individual to the role of privacy official. 15 The privacy official is the individual who oversees privacy-related matters in the PIV system and is responsible for implementing the privacy

15 Privacy official refers to the Senior Agency Official for Privacy (SAOP) or Chief Privacy Officer (CPO). requirements in the Standard. The individual serving in this role shall not assume any other operational role in the PIV system.

• Conduct a comprehensive Privacy Impact Assessment (PIA) on systems containing PII for the purpose of implementing PIV, consistent with the methodology of [E-Gov] and the requirements of [OMB0322]. Consult with appropriate personnel responsible for privacy issues at the department or agency (e.g., Chief Information Officer) implementing the PIV system.

• Write, publish, and maintain a clear and comprehensive document listing the types of information that will be collected (e.g., transactional information, PII), the purpose of collection, what information may be disclosed to whom during the life of the credential, how the information will be protected, and the complete set of uses of the credential and related information at the department or agency. Provide PIV applicants full disclosure of the intended uses of the information associated with the PIV Card and the related privacy implications.

• Assure that systems that contain PII for the purpose of enabling the implementation of PIV are handled in full compliance with fair information practices as defined in [PRIVACY].

• Maintain appeals procedures for those who are denied a credential or whose credentials are revoked.

• Ensure that only personnel with a legitimate need for access to PII in the PIV system are authorized to access the PII, including but not limited to information and databases maintained for registration and credential issuance. 16

• Coordinate with appropriate department or agency officials to define consequences for violating privacy policies of the PIV system.

• Assure that the technologies used in the department or agency’s implementation of the PIV system allow for continuous auditing of compliance with stated privacy policies and practices governing the collection, use, and distribution of information in the operation of the program.

• Utilize security controls described in [SP 800-53], Recommended Security Controls for Federal Information Systems , to accomplish privacy goals, where applicable.

• Ensure that the technologies used to implement PIV sustain and do not erode privacy protections relating to the use, collection, and disclosure of PII. Agencies may choose to deploy PIV Cards with electromagnetically opaque holders or other technology to protect against any unauthorized contactless access to information stored on a PIV Card.

16 Agencies may refer to NIST SP 800-122 [SP 800-122], Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) , for a best practice guideline on protection of PII.

After · FIPS 201-3

[HSPD-12] explicitly states that “protect[ing] personal privacy” is a requirement of the PIV system. As such, all departments and agencies shallSHALL implement the PIV system in accordance with the spirit and letter of all privacy controls specified in this Standard, as well as those specified in Federalfederal privacy laws and policies including but not limited to the E-Government Act of 2002 [E-Gov], the Privacy Act of 1974 [PRIVACY], and OMB Memorandum M-03-22 [OMB0322M-03-22], as applicable.

Departments and agencies may have a wide variety of uses offor the PIV system and its components that were not intended or anticipated by the President in issuing [HSPD-12]. In considering whether a proposed use of the PIV system is appropriate, departments and agencies shallSHALL consider the aforementioned control objectives and the purpose of this Standard, namely “to enhance security, increase Government efficiency, reduce identity fraud, and protect personal privacy” as per [HSPD-12]. No department or agency shallSHALL implement a use of the identity credential inconsistent with these control objectives.

To ensure the privacy throughout the PIV lifecycle, departments and agencies shallSHALL do the following:

• Assign an individual to the role of privacy official. 1518 The privacy official is the individual who oversees privacy-related matters in the PIV system and is responsible for implementing the privacy

15 Privacy official refers to the Senior Agency Official for Privacy (SAOP) or Chief Privacy Officer (CPO). requirements in the Standard. The individual serving in this role shallSHALL notNOT assume any other operational role in the PIV system.


• Conduct a comprehensive Privacy Impact Assessment (PIA) and a periodic review and update of the assessment on systems containing PII for the purpose of implementing PIV, consistent with the methodology of [E-Gov] and the requirements of [OMB0322M-03-22]. Consult with appropriate personnel responsible for privacy issues at the department or agency (e.g., Chief Information Officer) implementing the PIV system.


• Write, publish, and maintain a clear and comprehensive document listing the types of information that will be collected (e.g., transactional information, PII), the purpose of collection, what information may be disclosed to whom during the life of the credential, how the information will be protected, and the complete set of uses of the credential and related information at the department or agency.
• Provide PIV applicants with full disclosure of the intended uses of the information associated with the PIV Card and the related privacy implications.


• AssureEnsure that systems that contain PII for the purpose of enabling the implementation of PIV are handled in full compliance with fair information practices, as defined in [PRIVACY].

18 Privacy official refers to the Senior Agen cy Official for Privacy (SAOP) or Chief Privacy Officer (CPO).
• Maintain appealsappeal procedures for those who are denied a credential or whose credentials are revoked.


• Ensure that only personnel with a legitimate need for access to PII in the PIV system are authorized to access the PII, including but not limited to information and databases maintained for registration and credential issuance. 16

19
• Coordinate with appropriate department or agency officials to define consequences for violating privacy policies of the PIV system.


• AssureEnsure that the technologies used in the department or agency’s implementation of the PIV system allow for continuous auditing of compliance with stated privacy policies and with practices governing the collection, use, and distribution of information in the operation of the program.


• Utilize security controls described in [SP 800-53], Recommended Security Controls for Federal Information Systems , to accomplish privacy goals, where applicable.


• Ensure that the technologies used to implement PIV sustain and do not erode privacy protections relating to the use, collection, and disclosure of PII. Agencies mayMAY choose to deploy PIV Cards with electromagnetically opaque holders or other technology to protect against any unauthorized contactless access to information stored on a PIV Card.

1619 Agencies may refer to NIST SP 800-122 [SP 800-122], Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) , for a best practice guidelineguidelines on protection of PII.