BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.9.1 PIV Card Reissuance Requirements

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 2 Common Identification, Security, and Privacy Requirements part of 2.9

Title

PIV Card Reissuance Requirements

Control changed

Before · FIPS 201-2

Reissuance is the process by which a new PIV Card is issued to a cardholder without the need to repeat the entire identity proofing and registration procedure. The reissuance process may be used to replace a PIV Card that is nearing expiration, in the event of an employee status or attribute change, or to replace a PIV Card that has been compromised, lost, stolen, or damaged. The cardholder may also apply for reissuance of a PIV Card if one or more logical credentials have been compromised. The entire identity proofing, registration, and issuance process, as described in Sections 2.7 and 2.8, shall be repeated if the issuer does not maintain a chain-of-trust record for the cardholder or if the reissuance process was not started before the old PIV Card expired.

If the expiration date of the new PIV Card is later than the expiration date of the old card, or if any data about the cardholder is being changed, the card issuer shall ensure that a proper authority has authorized the issuance of the new PIV Card. The issuer shall ensure that the proper authority has verified that the employee’s or contractor’s background investigation is valid before reissuing the card and associated credentials. 13 If the expiration date of the new PIV Card is later than the expiration date of the old card then re-investigations shall be performed if required, in accordance with OPM guidance.

The issuer shall perform a 1:1 biometric match of the applicant to reconnect to the chain-of-trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data

12 For the purposes of this section, a lapse is considered to be brief if it is not long enough to require that a new background investigation be performed. OPM currently requires a new background investigation to be performed when there has been a break in service of greater than two years. 13 The identity management system (IDMS) should reflect the adjudication status of each PIV cardholder. that are available (either on the PIV Card or in the chain-of-trust). Minimum accuracy requirements for the biometric match are specified in [SP 800-76]. On successful match, the new PIV Card shall be released to the applicant. If the match is unsuccessful, or if no biometric data is available, the cardholder shall provide two identity source documents (as specified in Section 2.7), and an attending operator shall inspect these and compare the cardholder with the facial image retrieved from the enrollment data record and the facial image printed on the new PIV Card.

The old PIV Card shall be revoked when the new PIV Card is issued:

+ The old PIV Card shall be collected and destroyed, if possible.

+ Any databases maintained by the PIV Card issuer that contain FASC-N or UUID values from the old PIV Card must be updated to reflect the change in status.

+ If the old PIV Card cannot be collected and destroyed, or if the old PIV Card has been compromised or damaged, then the certification authority (CA) shall be informed and the certificates corresponding to the PIV Authentication key and asymmetric Card Authentication key on the old PIV Card shall be revoked. If present, the certificates corresponding to the digital signature key and the key management key shall also be revoked.

In the case of a lost, stolen, or compromised card, normal revocation procedures shall be completed within 18 hours of notification. In certain cases, 18 hours is an unacceptable delay and in those cases emergency procedures must be executed to disseminate the information as rapidly as possible. Departments and agencies are required to have procedures in place to issue emergency notifications in such cases.

If there is any data change about the cardholder, the issuer will record this in the chain-of-trust, if applicable. If the changed data is the cardholder’s name, then the issuer shall meet the requirements in Section 2.9.1.1, Special Rule for Name Change by Cardholder.

Previously collected biometric data may be reused with the new PIV Card if the expiration date of the new PIV Card is no later than 12 years after the date that the biometric data was obtained. As biometric authentication accuracy degrades with the time elapsed since initial collection, issuers may elect to refresh the biometric data after reconnecting the applicant to their chain-of-trust. Even if the same biometric data is reused with the new PIV Card, the digital signature must be recomputed with the new FASC-N and UUID.

A new PIV Authentication certificate and a new Card Authentication certificate shall be generated. The corresponding certificates shall be populated with the new FASC-N and UUID. For cardholders who are required to have a digital signature certificate, a new digital signature certificate shall also be generated. Key management key(s) and certificate(s) may be imported to the new PIV Card.

After · FIPS 201-3

Reissuance is the process by which a new PIV Card is issued to a cardholder without the need to repeat the entire identity proofing and registration procedureprocess. The reissuance process may be used to replace a PIV Card that is nearing expiration, in the event of an employee status or attribute change, or to replace a PIV Card that has been compromised, lost, stolen, or damaged. The cardholder may also apply for reissuance of a PIV Card

15 A reasonable basis to believe occurs whe n a disinterested observer with knowledge of the same facts and circumstances would reasonably reach the same conclusion. if one or more logical credentials have been compromised. The entire identity proofing, registration, and issuance processprocesses, as described in SectionsSection 2.7 and Section 2.8, shallSHALL be repeated if the issuer does not maintain a chain-of-trust record for the cardholder orPIV ifenrollment therecord reissuancethat processincludes wasbiometric notdata startedrecords beforefor the old PIV Card expiredcardholder.

If the expiration date of the new PIV Card is later than the expiration date of the old card, or if any data about the cardholder is being changed, the card issuer shallSHALL ensure that aan properadjudicative authorityentity has authorized the issuance of the new PIV Card. The issuer shallSHALL ensure that the properadjudicative authorityentity has verified that the employee’s or contractor’s background investigationthere is valid before reissuing the card and associated credentials. 13 If the expiration date of the newa PIV Cardeligibility isdetermination laterin thanan theauthoritative expirationrecord, datesuch ofas the old card then re-investigations shall beagency’s performedIDMS ifor required,the inCentral accordanceVerification withSystem OPM(or guidancesuccessor).

The issuer shallSHALL perform a 1:1 biometric matchverification of the applicant to reconnect to the chain-of-trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data

12 For the purposesrecords of this section, a lapse is considered to be brief if it is not long enough to require that a new background investigation be performed. OPM currently requiresthe aPIV newenrollment backgroundrecord investigationor to be performed when there has been athe breakbiometric indata servicerecords of greater than two years. 13 The identity management system (IDMS) should reflect the adjudication status of each PIV cardholder. that are available (eitherCard onusing the PIV CardBIO-A or inOCC-AUTH theauthentication chain-of-trust)mechanisms. Minimum accuracy requirements for the biometric matchverification are specified in [SP 800-76]. On successfula matchpositive biometric verification decision, the new PIV Card shallSHALL be released to the applicant. If the matchbiometric verification decision is unsuccessfulnegative, or if no biometric data isrecords are available, the cardholder shallSHALL provide two identity source documents (as specified in Section 2.7), and an attending operator shallSHALL inspect these and compare the cardholder with the electronic facial image retrieved from the enrollment data record and the facial imagephotograph printed on the new PIV Card.

The old PIV Card shallSHALL be revoked when the new PIV Card is issued. The revocation process SHALL include the following:

+• The old PIV Card shallSHALL be collected and destroyed, if possible.

+
• Any databases maintained by the PIV Card issuer that contain FASC-N or card UUID values from the old PIV Card must be updated to reflect the change in status.

+
• If the old PIV Card cannot be collected and destroyed, or if the old PIV Card has been compromised or damaged, then the certificationCertification authorityAuthority (CA) shallSHALL be informed and the certificates corresponding to the PIV Authenticationauthentication key (Section 4.2.2.1) and asymmetric Cardcard Authenticationauthentication key (Section 4.2.2.2) on the old PIV Card shallSHALL be revoked. If present, the certificates corresponding to the digital signature key (Section 4.2.2.1) and the key management key shall(Section 4.2.2.5) SHALL also be revoked.

In the case of a lost, stolen, or compromised card, normal revocation procedures shallSHALL be completed within 18 hours of notification. In certain cases, 18 hours is an unacceptable delay, and in those cases emergency procedures mustSHOULD be executed to disseminate the information as rapidly as possible. Departments and agencies are required to have procedures in place to issue emergency notifications in such cases.

If there is any data change about the cardholder, the issuer willSHALL record this data change in the chain-of-trustPIV enrollment record, if applicable. If the changed data is the cardholder’s name, then the issuer shallSHALL meet the requirements in Section 2.9.1.1, Special Rule for Name Change by Cardholder.

 Previously collected biometric data mayMAY be reused with the new PIV Card if the expiration date of the new PIV Card is no later than 12 years after the date that the biometric data was obtained. As biometric authenticationsystem accuracyerror degradesrates generally increase with the time elapsed since initial collection (reference aging, issuers[ISO may2382-37]), electissuers toMAY refresh the biometric data after reconnectingin the applicantPIV toenrollment theirrecord chain-of-trustduring the re-issuance process. Even if the same biometric data is reused with the new PIV Card, the digital signature must be recomputed with the new FASC-N and card UUID.

A new PIV Authenticationauthentication certificate and a new Cardcard Authenticationauthentication certificate shallSHALL be generated. The corresponding certificates shallSHALL be populated with the new FASC-NFASC - N and card UUID. For cardholders who arewith requiredgovernment-issued toemail haveaccounts, athe digital signature certificate,and akey management keys and associated certificates SHALL be populated. A new digital signature certificatekey shalland alsoassociated certificate SHALL be generated. Keyon managementthe new PIV Card, while key(s) management keys and certificate(s)associated maycertificates MAY be imported to the new PIV Card.