BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.3.1 Activation by Cardholder

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 4 PIV Front-End Subsystem part of 4.3

Title

Activation by Cardholder

Control changed

Before · FIPS 201-2

PIV Cards shall implement user-based cardholder activation to allow privileged operations using PIV credentials held by the card. At a minimum, the PIV Card shall implement PIN-based cardholder activation in support of interoperability across departments and agencies. Other card activation mechanisms (e.g., OCC card activation), only as specified in [SP 800-73], may be implemented and shall be discoverable. For PIN-based cardholder activation, the cardholder shall supply a numeric PIN. The verification data shall be transmitted to the PIV Card and checked by the card. If the verification data check is successful, the PIV Card is activated. The PIV Card shall include mechanisms to block activation of the card after a number of consecutive failed activation attempts. The number of allowable consecutive failed activation attempts may vary by activation mechanism.

The PIN should not be easily guessable or otherwise individually identifiable in nature (e.g., part of a Social Security Number, phone number). The required PIN length shall be a minimum of six digits.

After · FIPS 201-3

PIV Cards shallSHALL implement user-based cardholder activation to allow privileged operations using PIV credentials held by the card. At a minimum, the PIV Card shallSHALL implement PIN-based cardholder activation in support of interoperability across departments and agencies. Other card activation mechanisms as specified in [SP 800-73] (e.g., OCC card activation), only as specified in [SP 800-73], mayMAY be implemented and shallSHALL be discoverable. For PIN-based cardholder activation, the cardholder shallSHALL supply a numeric PIN. The verification dataPIN shallSHALL be transmitted to the PIV Card and checked by the card. If the verification dataPIN check is successful, the PIV Card is activated. The PIV Card shallSHALL include mechanisms to block activation of the card after a number of consecutive failed activation attempts. TheA numbermaximum of allowable10 consecutive failedPIN activationretries attemptsSHALL maybe varypermitted unless a lower limit is imposed by activationthe mechanismdepartment or agency.

The cardholder SHALL be guided in selecting a strong PIN shouldvalue. notThe bePIN easilySHALL guessablebe ora otherwiseminimum individuallyof identifiablesix digits in naturelength and SHOULD NOT be easily guessable, individually identifiable (e.g., part of a Social Security Number, or phone number). The required PIN length shall, beor acommonly minimumused of(e.g., six000000, digits123456).