BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.1 PIV Assurance Levels

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6

Title

PIV Assurance Levels

Control changed

Before · FIPS 201-2

This Standard defines four levels of assurance for identity authentication supported by the PIV Card Application. Each assurance level sets a degree of confidence established in the identity of the holder of the PIV Card. The entity performing the authentication establishes confidence in the identity of the PIV cardholder through the following:

1) the rigor of the identity proofing process conducted prior to issuing the PIV Card;

2) the security of the PIV Card issuance and maintenance processes; and

3) the strength of the technical mechanisms used to verify that the cardholder is the owner of the PIV Card.

Section 2 of this Standard defines requirements for the identity proofing, registration, issuance, and maintenance processes for PIV Cards and establishes a common level of assurance in these processes. The PIV identity proofing, registration, issuance, and maintenance processes meet or exceed the requirements for E-Authentication Level 4 [OMB0404]. The PIV Card contains a number of visual and logical credentials. Depending on the specific PIV data used to authenticate the holder of the PIV Card to an entity that controls access to a resource, varying levels of assurance that the holder of the PIV Card is the owner of the card can be achieved. This is the basis for the following PIV assurance levels defined in this Standard:

• LITTLE or NO Confidence—Little or no assurance in the identity of the cardholder;

• SOME Confidence—A basic degree of assurance in the identity of the cardholder;

• HIGH Confidence—A strong degree of assurance in the identity of the cardholder;

• VERY HIGH Confidence—A very strong degree of assurance in the identity of the cardholder.

Parties responsible for controlling access to Federal resources (both physical and logical) shall determine the appropriate level of identity assurance required for access, based on the harm and impact to individuals and organizations as a result of errors in the authentication of the identity of the PIV cardholder. Once the required level of assurance has been determined, the authentication mechanisms specified within this section may be applied to achieve the required degree of confidence in the identity of the PIV cardholder.

After · FIPS 201-3

This Standard defines fourmultiple levels of assurance for identity authentication supported by thelogical PIVand Cardphysical Applicationaccess. Each assurance level setsestablishes a degree of confidence established inthat the identitypresenter of the holderPIV ofCard is the person referred to by the PIV Cardcredential. The entity performing the authentication further establishes confidence inthat the identityperson ofreferred to by the PIV cardholdercredential throughis thea following:

1)specific person identified through the rigor of the identity proofing process conducted prior to issuing the PIV Card;

2) the securityissuance of the PIV Card issuance and maintenance processes; and

3) the strength of the technical mechanisms used to verify that the cardholder is the ownersecurity of the PIV Card.

Section 2 of this Standard defines requirements for the identity proofing, registration,and issuance, and maintenance processes for PIV Cards and establishes a common level of assurancespecified in theseSection processes2. The PIV identity proofing, registration, issuance, and maintenance processes meet or exceed36 the requirements for E-AuthenticationIAL3, Levelas 4defined in [OMB0404SP 800-63A].

The PIV Card contains a number of visual and logical credentials. Depending on the specific PIVthat dataare used to authenticate the holder ofby the PIVauthentication Cardmechanisms tospecified anin entitySection that6.2. controlsPIV accessassurance tolevels amay resource,vary varyingdepending levelson ofthe assurancePIV thatauthentication themechanism holderused. ofThe theassurance PIVlevels Cardfor isphysical theand ownerlogical ofaccess theare cardspecified canin beSection achieved6. This3.1 isand theSection basis6.3.2, forrespectively.

36 theAs followingdescribed PIVin assuranceSection levels2.7, definedcompensatin ing thiscontrols Standard:

•can LITTLEbe orapplied NOfor Confidence—Littleidentity orsource nodocument assuranceevidence into theachieve identityIAL3 ofsince the cardholder;

•Standard SOMEonly Confidence—Aspecifies basicone degreepiece of assurance inStrong theevidence identityand ofone theother cardholder;

•piece HIGHof Confidence—AFair strongevidence. degreeIssuance of assurancePIV inCard themeets identityIAL3 ofsince the cardholder;

•federal VERYbackground HIGHinvestigation Confidence—Aserves veryas stronga degreecomparable ofcompensating assurancecontrol infor theIAL3 identity of the cardholderproofing.

 Parties responsible for controlling access to Federalfederal resources (both physical and logical) shallSHALL determine the appropriate level of identity assurance levels required for access, based on the harm and impact to individuals and organizations that could occur as a result of errors in the authentication of the identity of the PIV cardholder. Once the required level of assurance level has been determined, one of the authentication mechanisms specified withinin thisSection section6.2 maySHALL be applied to achieve the required degree of confidence in the identity of thethat PIVassurance cardholderlevel.