BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.1.1 Relationship to Federal Identity Policy (Removed) (was: Relationship to OMB’s E-Authentication Guidance)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6.1

Title changed

Before · FIPS 201-2

Relationship to OMB’s E-Authentication Guidance

After · FIPS 201-3

Relationship to OMB’sFederal E-AuthenticationIdentity GuidancePolicy (Removed)

Control changed

Before · FIPS 201-2

The levels of identity authentication assurance defined within this Standard are closely aligned with Section 2 of OMB’s E-Authentication Guidance for Federal Agencies, M-04-04 [OMB0404]. Specifically, Table 6-1 shows the notional relationship between the PIV assurance levels and the M-04-04 E-Authentication assurance levels.

Table 6-1. Relationship Between PIV and E-Authentication Assurance Levels

PIV Assurance Levels Comparable OMB E-Authentication Levels

Level Number Description

LITTLE or NO confidence Level 1 Little or no confidence in the asserted identity’s validity SOME confidence Level 2 Some confidence in the asserted identity’s validity HIGH confidence Level 3 High confidence in the asserted identity’s validity VERY HIGH confidence Level 4 Very high confidence in the asserted identity’s validity

[OMB0404] addresses “four levels of identity assurance for electronic transactions requiring authentication” and prescribes a methodology for determining the level of identity assurance required based on the risks and potential impacts of errors in identity authentication. In the context of the PIV Card, owners of logical resources shall apply the methodology defined in [OMB0404] to identify the level of identity authentication assurance required for their electronic transaction. Parties that are responsible for access to physical resources may use a methodology similar to that defined in [OMB0404] to determine the PIV assurance level required for access to their physical resource; they may also use other applicable methodologies to determine the required level of identity assurance for their application.

After · FIPS 201-3

The levels of identity authentication assurance defined within this StandardNote: areThis closelysection alignedwas withformerly Sectionentitled 2“Relationship ofto OMB’s E-Authentication Guidance for Federal Agencies, M-04-04 [OMB0404]. Specifically, Table 6-1 shows the notional relationship between the PIV assurance levels and the M-04-04 E-AuthenticationE- assuranceAuthentication levelsGuidance.”

Table 6-1. Relationship BetweenThe PIVcontent andof E-Authenticationthis Assurancesection Levels

PIVhas Assurancebeen Levelsremoved Comparablesince OMB E-Authentication Levels

Level Number Description

LITTLE or NO confidence Level 1 Little or no confidence in the asserted identity’s validity SOME confidence Level 2 Some confidence in the asserted identity’s[M-04-04] validityhas HIGHbeen confidencerescinded Levelby 3OMB High[M-19-17], confidencewhich inrecognizes the asserted identity’s validity VERY HIGH confidence Level 4IALs Veryand highAALs confidencedefined in the asserted identity’sNIST validity

[OMB0404] addresses “four levels of identity assurance for electronic transactions requiring authentication”SP and800-63] prescribesas athe methodologyframework for determining the levelmanaging ofdigital identity assurance required based on the risks and potential impacts of errors in identity authentication. In the context ofwithin the PIV Card, owners of logical resources shallFederal applyGovernment. theThe methodologypolicy definedestablished inby [OMB0404HSPD-12] to identify the level of identity authentication assurancestill requiredapplies forunder theirthis electronicnew transactionmemorandum. Parties that are responsible for access to physical resources may use a methodology similar to that defined in [OMB0404] to

A determinemapping thebetween PIV assurance level required for access to their physical resource; they may also use otherauthentication applicablemechanisms methodologiesand toSP determine800-63 theauthenticator requiredassurance levellevels ofcan identitybe assurancefound forin theirSection application6.3.2.