BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.6 PIV Enrollment Records (was: Chain-of-Trust)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 2 Common Identification, Security, and Privacy Requirements part of 2

Title changed

Before · FIPS 201-2

Chain-of-Trust

After · FIPS 201-3

Chain-of-TrustPIV Enrollment Records

Control changed

Before · FIPS 201-2

A card issuer may optionally maintain, for each PIV Card issued, a documentary chain-of-trust for the identification data it collects. The chain-of-trust is a sequence of related enrollment data records that are created and maintained through the methods of contemporaneous acquisition of data within each enrollment data record, and biometric matching of samples between enrollment data records. 6

It is recommended that the following data be included in the chain-of-trust:

+ A log of activities that documents who took the action, what action was taken, when and where the action took place, and what data was collected.

+ An enrollment data record that contains the most recent collection of each of the biometric data collected. The enrollment data record describes the circumstances of biometric acquisition including the name and role of the acquiring agent, the office and organization, time, place, and acquisition method. The enrollment data record may also document unavailable biometric data or failed attempts to collect biometric data. The enrollment data record may contain historical biometric data.

+ The most recent unique identifiers (i.e., Federal Agency Smart Credential Number (FASC-N) and Universally Unique IDentifier (UUID)) issued to the individual. The record may contain historical unique identifiers.

+ Information about the authorizing entity who has approved the issuance of a credential.

6 For example, ten fingerprints for law enforcement checks may be collected at one time and place, and two fingerprints for PIV Card templates may be collected at a later time and different place, provided that the two fingerprints are verified as among the ten original fingerprints. + Current status of the background investigation, including the results of the investigation once completed.

+ The evidence of authorization if the credential is issued under a pseudonym.

+ Any data or any subsequent changes in the data about the cardholder. If the changed data is the cardholder’s name, then the issuer should include the evidence of a formal name change.

The biometric data in the chain-of-trust shall be valid for at most 12 years. In order to mitigate ageing effects and thereby maintain operational readiness of a cardholder's PIV Card, agencies may require biometric enrollment more frequently than 12 years.

The chain-of-trust contains personally identifiable information (PII). If implemented, it shall be protected in a manner that protects the individual’s privacy and maintains the integrity of the chain-of-trust record both in transit and at rest. A card issuer may import and export a chain-of-trust in the manner and representation described in [SP 800-156].

The chain-of-trust can be applied in several situations to include:

+ Extended enrollment: a PIV applicant enrolls a full set of fingerprints for background investigations at one place and time, and two fingerprints for the PIV Card at another place and time. The chain-of- trust would contain identifiers and two enrollment data records, one with a full-set fingerprint transaction, and one with two fingerprint templates. The two fingerprint templates would be matched against the corresponding fingers in the ten-fingerprint data set to link the chain.

+ Reissuance: a PIV cardholder loses his/her card. Since the card issuer has biometric enrollment data records, the cardholder can perform a 1:1 biometric match to reconnect to the card issuer’s chain-of- trust. The card issuer need not repeat the identity proofing and registration process. The card issuer proceeds to issue a new card as described in Section 2.9.1.

+ Interagency transfer: a Federal employee is transferred from one agency to another. When the employee leaves the old agency, he/she surrenders the PIV Card and it is destroyed. When the employee arrives at the new agency and is processed in, the card issuer in the new agency requests the employee’s chain-of-trust from the card issuer in the old agency, and receives the chain-of-trust. The employee performs a 1:1 biometric match against the chain-of-trust, and the interaction proceeds as described in Section 2.8.2.

After · FIPS 201-3

ANote: This section was formerly entitled “Chain-of-Trust”.

The card issuer may optionallySHALL maintain, the enrollment record for each issued PIV Card. issued,These aenrollment documentaryrecords chain-of-trustare forcreated and maintained through the identificationmethods dataof itcontemporaneous collectsacquisition at each step of the PIV issuance process—typically including identity proofing, registration, and biometric enrollment.

PIV Theenrollment chain-of-trustrecords isSHALL amaintain an auditable sequence of related enrollment dataevents recordsto facilitate binding an applicant to multiple transactions that aremight createdtake place at different times and maintainedlocations. through6 theThese methodsrecords ofare contemporaneousgenerally acquisitionstored ofas datapart withinof eachthe enrollmentcardholder’s dataPIV recordidentity account, andeither biometricas matchingpart of samplesthe betweenissuer’s enrollmentIDMS dataor through links to records. 6

Itin isother recommendedrelated thatsystems the(e.g., followingcard datamanagement besystems).

PIV includedenrollment inrecords SHOULD include the chain-of-trustfollowing data:

+• A log of activities that documents who took the action, what action was taken, when and where the action took place, and what data was collected.

+
• An enrollment data record that contains the most recent collection of each of the biometric data collected. The enrollment data record describes the circumstances of biometric acquisition including the name and role of the acquiring agent, the office and organization, time, place, and acquisition method. The enrollment data record mayMAY also document unavailable biometric data or failed attempts to collect

6 biometricFor data.example, Theten enrollmentfingerprints datafor recordlaw mayenfo containrcement historicalchecks biometricmay data.

+be Thecollected mostat recentone uniquetime identifiersand (i.e.place, Federaland Agencytwo Smartfingerprints Credentialfor NumberPIV (FASC-N)Card andtemplates Universallymay Uniquebe IDentifiercollected (UUID))at issueda tolater thetime individual.and Thedifferent recordplace, mayprovided containthat historicala uniquebiometric identifiers.

+comparison Informationconfirms aboutthat the authorizing entitytwo whofingerprints hasbelong approvedto the issuanceoriginal set of aten credentialfingerprints.

6 Forbiometric example,data. tenThe fingerprintsenrollment fordata lawrecord enforcementMAY checkscontain mayhistorical bebiometric collecteddata atrecords.
• oneUnique timeidentifiers andissued placeto the individual, andsuch twoas fingerprintsthe forFederal PIVAgency CardSmart templatesCredential mayNumber be(FASC-N), collectedthe atcardholder aUniversally laterUnique timeIdentifier (UUID), and differentthe place,card providedUUID. thatThe therecord twoMAY fingerprintscontain arehistorical verifiedunique asidentifiers.
• amongInformation about the tenauthorizing originalentity fingerprints.that +has approved the issuance of a credential.
• Current status of the background investigation, including the results of the investigation once completed.

+
• The evidence of authorization if the credential is issued under a pseudonym.

+
• Any data or any subsequent changes in the data about the cardholder. If, theincluding changedsubsequent datachanges isin the cardholder’sdata name(e.g., then the issuer should include the evidencecardholder ofname achanges formalper nameSection change2.9.1.1).

The biometric data records in the chain-of-trustPIV shallenrollment records SHALL be valid for ata mostmaximum of 12 years. In order to mitigate ageingaging effects and thereby maintain operational readiness of a cardholder'scardholder’s PIV Card, agencies mayMAY require biometric enrollment more frequently than 12 years.

ThePIV chain-of-trustenrollment containsrecords personallycontain identifiablePersonally informationIdentifiable Information (PII). If implemented, itPII shallSHALL be protected in a manner that protects the individual’s privacy and maintains the integrity of the chain-of-trust recordrecords both in transit and at rest. A card issuer may import and export a chain-of-trust in the manner and representation described in [SP 800-156].

ThePIV chain-of-trustenrollment records can be applied in several situations, toincluding includethe following:

+ Extended enrollment: aA PIV applicant enrolls a full set of fingerprints for background investigations at one place and time, and two fingerprints for the PIV Card at another place and time. The chain-of-enrollment trustrecord would contain identifiers and two enrollment data records,: one with athe full-setfull set of fingerprint transaction,images collected for background investigations and one with two fingerprint templates collected for the PIV Card. The two fingerprint templates would be matchedcompared againstto the corresponding fingers in the ten-fingerprint data set to linkin the chainPIV enrollment record.

+ Reissuance: a PIV cardholder losesof his/herlost card. Since the card issuer has biometric enrollment data records from enrollment, the cardholder can perform a 1:1 biometric matchcomparison toagainst reconnectthe tobiometric thedata cardstored issuer’sin chain-of-the trustPIV enrollment record. The card issuer needNEED notNOT repeat the identity proofing and registration process on a positive biometric verification decision. TheInstead, the card issuer revokes the lost card and proceeds to issue a new card as described in Section 2.9.1.

+ Interagency transfer: aA Federalfederal employee is transferred from one agency to another. When the employee leaves the old agency, he/shethey surrenderssurrender thetheir PIV Card and it is destroyed. When the employee arrives at the new agency and is processed in, the card issuer in the new agency requests and receives the employee’s chain-of-trustPIV enrollment record from the card issuer in the old agency, andin receivesa thesecure chain-of-trustmanner. The employee performs a 1:1 biometric matchcomparison against the chain-of-trustbiometric data stored in this record, and the interaction proceeds as described in Section 2.8.2.

To facilitate interagency transfer of enrollment data, systems may import and export enrollment records in the manner and representation described in [SP 800-156].