BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.4.4 Card Activation Device Requirements

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 4 PIV Front-End Subsystem part of 4.4

Title

Card Activation Device Requirements

Control changed

Before · FIPS 201-2

When the PIV Card is used with OCC data or a PIN for physical access, the input device shall be integrated with the PIV Card reader. When the PIV Card is used with OCC data or a PIN for logical access (e.g., to authenticate to a Web site or other server), the input device is not required to be integrated with the PIV Card reader. If the input device is not integrated with the PIV Card reader, the OCC data or the PIN shall be transmitted securely and directly to the PIV Card for card activation.

The specifications for fingerprint capture devices for on-card comparison are given in [SP 800-76].

Malicious code could be introduced into the PIN capture and biometric reader devices for the purpose of compromising or otherwise exploiting the PIV Card. General good practice to mitigate malicious code threats is outside the scope of this document. 29

29 See SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations [SP 800-53].

After · FIPS 201-3

When the PIV Card is used with OCCa dataPIN or aOCC PINdata for physical access, the input device shallSHALL be integratedintegral withto (i.e., built into) the PIV Card reader. When the PIV Card is used with OCCa dataPIN or aOCC PINdata for logical access (e.g., to authenticate to a Web sitewebsite or other server), the input device is not required to be integrated with the PIV Card reader. If the input device is not integrated with the PIV Card reader, the OCC dataPIN or theOCC PINdata shallSHALL be transmitted securely and directly to the PIV Card for card activation.

The specifications for fingerprint biometric capture devices for on-card comparisonOCC are given in [SP 800-76].

Malicious code could be introduced into the PIN capture and biometric readercapture devices for the purpose of compromising or otherwise exploiting the PIV Card. General good practice to mitigate malicious code threats is outside of the scope of this document. 29

29 See(see [SP 800-53,] Recommendedfor Securitya Controlscatalog forof Federalsecurity Informationand Systemsprivacy andcontrols Organizationsfor [SPfederal 800-53]information systems).