BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.3.1 Physical Access

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6.3

Title

Physical Access

Control changed

Before · FIPS 201-2

The PIV Card may be used to authenticate the identity of the cardholder in a physical access control environment. For example, a Federal facility may have physical entry doors that have human guards at checkpoints, or may have electronic access control points. The PIV-supported authentication mechanisms for physical access control systems are summarized in Table 6-2. An authentication mechanism that is suitable for a higher assurance level can also be applied to meet the requirements for a lower assurance level. Moreover, the authentication mechanisms in Table 6-2 can be combined to achieve higher assurance levels. 35

Table 6-2. Authentication for Physical Access

35 Combinations of authentication mechanisms are specified in [SP 800-116]. PIV Assurance Level Required by Application/Resource Applicable PIV Authentication Mechanism

LITTLE or NO confidence VIS, CHUID SOME confidence PKI-CAK, SYM-CAK HIGH confidence BIO VERY HIGH confidence BIO-A, OCC-AUTH, PKI-AUTH

After · FIPS 201-3

The PIV Card maycan be used to authenticate the identity of the cardholder in a physical access control environment. Forusing example,the aauthentication Federalmechanisms facilitydescribed mayin haveSection physical6.2. entryEach doorsauthentication thatmechanism haveprovides humana guardsdegree atof checkpointsassurance, oras maysummarized havein electronicTable access6-1, controlbased pointson its characteristics outlined in Section 6.2.

Table The6-1. PIV-supportedPIV authenticationAuthentication mechanismsMechanisms for physicalPhysical accessAccess

PIV controlAuthentication systemsMechanism areAssurance summarizedProvided PKI-CAK Some confidence in Tablethe 6-2.asserted Anidentity authenticationSM-AUTH mechanismSome thatconfidence isin suitablethe forasserted aidentity higherBIO assuranceMedium levelconfidence canin alsothe beasserted appliedidentity toBIO-A meetHigh confidence in the requirementsasserted foridentity aOCC-AUTH lowerHigh assuranceconfidence level.in Moreover,the asserted identity PKI-AUTH High confidence in the authenticationasserted mechanismsidentity VIS (deprecated) Little or no confidence in Tablethe 6-2asserted identity SYM-CAK (deprecated) Some confidence in the asserted identity

Each PIV authentication mechanism provides one or two factors of authentication. The mechanisms can be combined 42 to achieve higherup assuranceto levels.three 35

Tableauthentication 6-2factors (e.g., Authenticationto foraccess Physicalexclusion Access

35security Combinationsareas). The number of factors afforded by each authentication mechanismsmechanism and the required factors to access the controlled, limited, or exclusion security areas are specifiedfurther detailed in [SP 800-116].

The PIVselection Assuranceof Levelauthentication Requiredassurance bylevels Application/ResourceSHALL Applicablebe made in accordance with the applicable policies for a facility’s security level [RISK-MGMT-FACILITIES]. Additional guidelines for the selection and use of PIV Authenticationauthentication Mechanism

LITTLEmechanisms orfor NOfacility confidenceaccess VIS,can CHUIDbe SOMEfound confidencein PKI-CAK,NIST SYM-CAK[SP HIGH800-116]. confidence42 BIOCombinations VERYof HIGHauthentication confidencemechanis BIO-A,ms OCC-AUTH,are PKI-AUTHspecified in [SP 800-116].