BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.8 PIV Card Issuance Requirements

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 2 Common Identification, Security, and Privacy Requirements part of 2

Title

PIV Card Issuance Requirements

Control changed

Before · FIPS 201-2

Departments and agencies shall meet the requirements defined below when issuing PIV Cards. The issuance process used when issuing PIV Cards shall be accredited by the department or agency as satisfying the requirements below and approved in writing by the head or deputy secretary (or equivalent) of the Federal department or agency.

+ PIV Cards are issued after a proper authority has authorized issuance of the credential.

+ The organization shall use an approved PIV credential issuance process in accordance with [SP 800-79].

+ Before issuing the PIV Card, the process shall ensure that a previously completed and favorably adjudicated NACI (or equivalent or higher) or Tier 1 or higher federal background investigation is on record. In the absence of a record, the required federal background investigation shall be initiated. 10 The PIV Card should not be issued before the results of the NAC are complete. However, if the results of the NAC have not been received in 5 days, the PIV Card may be issued based on the FBI NCHC. In the absence of an FBI NCHC

10 The identity management system (IDMS) should reflect the adjudication status of each PIV cardholder. (e.g., due to unclassifiable fingerprints) the NAC results are required prior to issuing a PIV Card. The PIV Card shall be terminated if the results of the background investigation so justify.

+ Biometrics used to personalize the PIV Card must be those captured during the identity proofing and registration process.

+ During the issuance process, the issuer shall verify that the individual to whom the PIV Card is to be issued is the same as the intended applicant/recipient as approved by the appropriate authority. Before the card is provided to the applicant, the issuer shall perform a 1:1 biometric match of the applicant against biometrics available on the PIV Card or in the chain-of-trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data that are available. Minimum accuracy requirements for the biometric match are specified in [SP 800-76]. On successful match, the PIV Card shall be released to the applicant. If the match is unsuccessful, or if no biometric data is available, the cardholder shall provide two identity source documents (as specified in Section 2.7), and an attending operator shall inspect these and compare the cardholder with the facial image printed on the PIV Card.

+ The organization shall issue PIV credentials only through systems and providers whose reliability has been established by the agency and so documented and approved in writing (i.e., accredited) in accordance with [SP 800-79].

+ The PIV Card shall be valid for no more than six years.

PIV Cards that contain topographical defects (e.g., scratches, poor color, fading, etc.) or that are not properly printed shall be destroyed. The PIV Card issuer is responsible for the card stock, its management, and its integrity.

After · FIPS 201-3

Departments and agencies shallSHALL meet the requirements defined below when issuing PIV Cards. The issuance process used when issuing PIV Cards shallSHALL be accredited by the department or agency as satisfying the requirements below and approved in writing by the head or deputy secretary (or equivalent) of the Federalfederal department or agency.

+• PIV Cards areSHALL be issued only after athe properadjudicative authorityentity has authorized issuance of the credential.

+
• The organizationdepartment shallor agency SHALL use an approved PIV credential issuance process in accordance with [SP 800-79].

+
• Before issuing the PIV Card, the processissuer shallSHALL ensure that a previously completed and favorably adjudicated NACI (or equivalent or higher) or Tier 1 or higher federal background investigation is on record. In the absence of a record, the required federal background investigation shall be initiated. 10 The PIV Card should not be issued before the results of the NAC are complete. However, if the results of theindividual NACreceiving haveit nothas been received in 5 days, the PIV Card may be issued basedproperly onprocessed theper FBISection NCHC2. In the absence of an FBI NCHC

10 The identity management system (IDMS) should reflect the adjudication status of each PIV1, cardholder.Section (e.g2.2, due to unclassifiable fingerprints) the NAC results are required prior to issuing aand PIVSection Card2. The PIV Card shall be terminated if the results of the background investigation so justify7.

+
• BiometricsBiometric data used to personalize the PIV Card mustSHALL be those captured during the identity proofing and registration process.

+
• During the issuance process, the issuer shallSHALL verify that the individual to whom the PIV Card is to be issued is the same as the intended applicant/recipient as approved by the appropriate authority. Before the cardPIV Card is provided to the applicant, the issuer shallSHALL perform a 1:1 biometricone-to-one matchcomparison of the applicant against biometricsbiometric data records available on the PIV Card or in the chain-of-trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data thatPIV areenrollment availablerecord. Minimum accuracy requirements for the biometric matchverification and presentation attack detection are specified in [SP 800-76]. On successfula matchpositive biometric verification decision, the PIV Card shallSHALL be released to the applicant. If the matchbiometric verification decision is unsuccessfulnegative, or if no biometric data isrecords are available, the cardholder shallSHALL provide two identity source documents (as specified in Section 2.7), and an attending operator shallSHALL inspect these and compare the cardholder with the facial imagephotograph printed on the PIV Card.

+
• The organizationdepartment shallor agency SHALL issue PIV credentials only through systems and providers whose reliability has been established by the agency and so documented and approved in writing (i.e., accredited) in accordance with [SP 800-79].

+
• The PIV Card shallSHALL be valid for no more than six years.

PIV Cards that contain topographical defects (e.g., scratches, poor color, fading, etc.) or that are not properly printed shallSHALL be destroyed. The PIV Card issuer is responsible for the card stock, its management, and its integrity.

12 A reasonable basis to believe occurs whe n a disinterested observer with knowledge of the same facts and circumstances would reasonably reach the same conclusion.