BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.8.2 Grace Period

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 2 Common Identification, Security, and Privacy Requirements part of 2.8

Title

Grace Period

Control changed

Before · FIPS 201-2

In some instances an individual's status as a Federal employee or contractor will lapse for a brief time period. For example, a Federal employee may leave one Federal agency for another Federal agency and thus occur a short employment lapse period, or an individual who was under contract to a Federal agency may receive a new contract from that agency shortly after the previous contract expired. In these instances, the card issuer may issue a new PIV Card without repeating the identity proofing and

11 See, for example, Section 10.5.7 of the Internal Revenue Service Manual (http://www.irs.gov/irm/index.html), which authorizes approval by an employee's supervisor of the use of a pseudonym to protect the employee's personal safety. registration process if the issuer has access to the applicant’s chain-of-trust record and the applicant can be reconnected to the chain-of-trust record. 12

When issuing a PIV Card under the grace period, the card issuer shall verify that PIV Card issuance has been authorized by a proper authority and that the employee’s or contractor’s background investigation is valid. Re-investigations shall be performed if required, in accordance with OPM guidance. At the time of issuance, the card issuer shall perform a 1:1 biometric match of the applicant to reconnect to the chain- of-trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data that are available. On successful match, the new PIV Card shall be released to the applicant. If the match is unsuccessful, or if no biometric data is available, the cardholder shall provide two identity source documents (as specified in Section 2.7), and an attending operator shall inspect these and compare the cardholder with the facial image retrieved from the enrollment data record and the facial image printed on the new PIV Card.

After · FIPS 201-3

In some instances, an individual'sindividual’s status as a Federalfederal employee or contractor will lapse for a brief time period. For example, a Federalfederal employee may leave one Federalfederal agency for another Federalfederal agency and thus occurincur a short employment lapse period, or an individual who was under contract to a Federalfederal agency may receive a new contract from that agency shortly after the previous contract expired. 14 In these instances, the card issuer mayMAY issue a new PIV Card without repeating the identity proofing and

11 See, for example, Sectionregistration 10.5.7process ofif the Internal Revenue Service Manual (http://www.irs.gov/irm/index.html), which authorizes approval by an employee'sissuer supervisorcan ofobtain the use of a pseudonym toapplicant’s protectPIV theenrollment employee'srecord personalcontaining safety.biometric registrationdata processrecords iffrom the issuer has access toof the applicant’s chain-of-trust record and the applicant can be reconnected to theprevious chain-of-trustPIV recordCard. 12

When issuing a PIV Card under the grace period, the card issuer shallSHALL verify that PIV Card issuance has been authorized by a proper authority and that the employee’semployee or contractor’s background investigation is valid. Re-investigations shallSHALL be performed, if required, in accordance with OPMthe guidancefederal investigative standards. At the time of issuance, the card issuer shallSHALL perform a 1:1 biometric matchverification of the applicant to reconnect to the chain- of-trust. The 1:1 biometric matchdata requiresrecords eitherin athe matchapplicant’s ofprevious fingerprint(s)PIV or,enrollment ifrecord. unavailable,On othera optionalpositive biometric data that are available. On successfulverification matchdecision, the new PIV Card shallSHALL be released to the applicant. If the matchbiometric verification decision is unsuccessfulnegative, or if no biometric data isrecords are available, the cardholder shallSHALL provide two identity source documents (as specified in Section 2.7), and an attending operator shallSHALL inspect these and compare the cardholder with the electronic facial image retrieved from the enrollment data record and the facial imagephotograph printed on the new PIV Card.

13 An example can be seen in Section 10.5.7 of the Internal Revenue Service Manual (https://www.irs.gov/ irm/part10/irm_10-005-007), which authorizes approval by an employee’s supervisor of the use of a pseudonym to protect the employee’s personal safety. 14 For the purposes of this section, a lapse is considered to be brief if it is not long enough to require that a new or updated background investigation be performed consistent with Executive Agents’ guidance.