1 Introduction (was: INTRODUCTION)
All changes in this version
Title changed
Before · SP 800-79-1
INTRODUCTION
After · SP 800-79-2
INTRODUCTIONIntroduction
Control changed
Before · SP 800-79-1
In order to enhance security, increase Government efficiency, reduce identity fraud, and protect personal privacy, the President issued Homeland Security Presidential Directive 12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractor s, dated August 27, 2004. This Directive established a Federal policy to create and use a government- wide secure and reliable form of identification for Federal employees and contractors. It further defined secure and reliable identification as one that —
• Is issued based on sound criteria for verifying an individual’s identity;
• Is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation;
• Can be rapidly authenticated electronically; and
• Is issued only by providers whose reliability has been established by an official accreditation process.
NIST developed and published Federal Information Processing Standard (FIPS) 201-1, entitled Personal Identity Verification (PIV) of Federal Employees and Contractors, and several Special Publications providing additional specifications and supporting information in response to HSPD-12. These documents provide the foundation for Government personal identification, verification, and access control systems.
Appendix B.1 of FIPS 201-1 states the following:
“… [HSPD-12] requires that all cards be issued by providers whose reliability has been established by an official accreditation process. Funding permitting, NIST will establish detailed criteria that PIV Card Issuers must meet for accreditation. Additionally, NIST will (again, funding permitting) establish a government-wide program to accredit official issuers of PIV Cards against these accreditation criteria. Until such time as these are completed, agencies must self-certify their own issuers of PIV Cards ...”
In order to satisfy HSPD-12 and FIPS 201-1, NIST undertook the development of the Guidelines for the Certification and Accreditation of PIV Card Issuers and published them as NIST Special Publication (SP) 800-79. This document is the first revision to the original. The revised SP 800- 79-1 provides a more technically-based approach to assure that a PCI is fulfilling all the requirements of FIPS 201-1 and its supporting documents, and doing so reliably. In this revised document, a PCI is considered to be owned and managed by an organization which may be a Federal department, agency, state or local government, private entity, or other enterprise that desires to issue reliable PIV Cards. Ensuring the reliability of a PCI is of critical importance in light of the security and privacy implications of HSPD-12 and its far-reaching objective of issuing PIV Cards to millions of employees and contractors. HSPD-12 and its implementing standards and guidelines were developed to address a range of security concerns, including those posed by terrorists in a post-9/11 world. Providing a comprehensive set of standards for controlling access to the physical and logical resources through the use of a standard PIV Card assures that certain pre-defined levels of security can be achieved. However, it requires organizations to implement and use the standards in a consistent and reliable manner. An organization must have confidence in the cards it issues to its own employees and contractors, but possibly more importantly, since HSPD-12 requires a common inter-operable standard, all organizations need to have confidence in the cards issued by other organizations. This confidence can come about only if the PCI functions in those other organizations are assessed and accredited. Thus, PCI accreditation forms an important task in meeting the end- goals of HSPD-12.
NIST has considerable experience in the development of accreditation methodology, most significantly with the widely accepted approach to accreditation in SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems, and its family of related documents. While SP 800-37 is focused on the accreditation of the security of information systems, rather than the accreditation of the reliability of PCIs, it does offer a practical foundation for accreditation programs in general. This document utilizes various aspects of SP 800-37 and applies them to accrediting the reliability of PCIs. Accreditation of a PCI requires prior accreditation of the security of all information systems used by the PCI in accordance with SP 800-37.
One difference between the accreditation of the security of information systems and the accreditation of the reliability of a PCI is that an organization has considerable flexibility in how they prepare for a SP 800-37 accreditation (particularly in implementing security controls), but have little room for variation under SP 800-79-1. Much of the flexibility in SP 800-37 comes from the necessity of acceptable variations in security controls, since individual information systems within varied environments may have significantly different security requirements. Conversely, the desire for standardization that is implicit in HSPD-12 has led to the development of a stable set of requirements. There may be some flexibility in how a requirement is met, but a majority of requirements must be satisfied in a uniform manner in order to deem a PCI as reliable. Allowing too much latitude in how a requirement is met undermines this reliability.
Although organizations may feel constrained by the uniformity required by FIPS 201-1, standardization greatly contributes to achieving the objectives of HSPD-12 across PIV Card Issuer implementations. For all organizations to accept the PIV Cards of other organizations, one set of rules (i.e., FIPS 201-1) must be followed by all PIV system participants. This Special Publication provides a way of determining if the participants are following these rules. Accreditation efforts that are consistent, reliable, and repeatable provide a basis for determining the reliability and capability of providers who issue PIV Cards, which herein is defined as consistent adherence to the PIV standards. In particular, if PCIs meet the requirements of FIPS 201-1 and relevant documents as verified through applicable assessment procedures and maintain consistency of their operations with respect to meeting these criteria, they can be considered reliable as is required by HSPD-12.
The objectives of the guidelines in this document are to—
• Outline the requirements to be met by a PCI, the rationale for the requirements and the assessment procedures required to determine the satisfaction of those requirements by a PCI through a combination of policies, procedures, and operations.
• Describe an accreditation methodology that provides a framework for organizing the requirements and assessment procedures stated above and at the same time provides coverage for all the control objectives stated in HSPD-12.
• Demonstrate the fact that the application of the methodology will result in assessment outcomes that are consistent, reliable, and repeatable.
• Emphasize the role of risk in arriving at an accreditation decision, based on assessment outcomes that takes into account the organization’s mission.
After · SP 800-79-2
In order to enhance security, increase Government efficiency, reduce identity fraud, and protect personal privacy, the President issued Homeland Security Presidential Directive 12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractor s, dated August 27, 2004. This Directive established a Federal policy to create and use a government- wide secure and reliable form of identification for Federal employees and contractors. It further defined secure and reliable identification as one that —In order to enhance security, increase Federal Government efficiency, reduce identity fraud, and protect personal privacy, Homeland Security Presidential Directive 12 ( [HSPD-12] ), Policy for a Common Identification Standard for Federal Employees and Contractor s was issued on August 27, 2004. This Directive established a federal policy to create and use government-wide secure and reliable forms of identification for federal employees and contractors. It further defined secure and reliable forms of identification as ones that —
• Is issued based on sound criteria for verifying an individual’s identity;
• Is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation;
• Can be rapidly authenticated electronically; and
• Is issued only by providers whose reliability has been established by an official accreditation process.
NIST developed and published Federal Information Processing Standard (FIPS) 201-1, entitled Personal Identity Verification (PIV) of Federal Employees and Contractors, and several Special Publications providing additional specifications and supporting information in response to HSPD-12. These documents provide the foundation for Government personal identification, verification, and access control systems.
Appendix B.1 of FIPS 201-1 states the following:
“… [HSPD-12] requires that all cards be issued by providers whose reliability has been established by an official accreditation process. Funding permitting, NIST will establish detailed criteria that PIV Card Issuers must meet for accreditation. Additionally, NIST will (again, funding permitting) establish a government-wide program to accredit official issuers of PIV Cards against these accreditation criteria. Until such time as these are completed, agencies must self-certify their own issuers of PIV Cards ...”
In order to satisfy HSPD-12 and FIPS 201-1, NIST undertook the development of the Guidelines for the Certification and Accreditation of PIV Card Issuers and published them as NIST Special Publication (SP) 800-79. This document is the first revision to the original. The revised SP 800- 79-1 provides a more technically-based approach to assure that a PCI is fulfilling all the requirements of FIPS 201-1 and its supporting documents, and doing so reliably. In this revised document, a PCI is considered to be owned and managed by an organization which may be a Federal department, agency, state or local government, private entity, or other enterprise that desires to issue reliable PIV Cards. Ensuring the reliability of a PCI is of critical importance in light of the security and privacy implications of HSPD-12 and its far-reaching objective of issuing PIV Cards to millions of employees and contractors. HSPD-12 and its implementing standards and guidelines were developed to address a range of security concerns, including those posed by terrorists in a post-9/11 world. Providing a comprehensive set of standards for controlling access to the physical and logical resources through the use of a standard PIV Card assures that certain pre-defined levels of security can be achieved. However, it requires organizations to implement and use the standards in a consistent and reliable manner. An organization must have confidence in the cards it issues to its own employees and contractors, but possibly more importantly, since HSPD-12 requires a common inter-operable standard, all organizations need to have confidence in the cards issued by other organizations. This confidence can come about only if the PCI functions in those other organizations are assessed and accredited. Thus, PCI accreditation forms an important task in meeting the end- goals of HSPD-12.
NIST has considerable experience in the development of accreditation methodology, most significantly with the widely accepted approach to accreditation in SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems, and its family of related documents. While SP 800-37 is focused on the accreditation of the security of information systems, rather than the accreditation of the reliability of PCIs, it does offer a practical foundation for accreditation programs in general. This document utilizes various aspects of SP 800-37 and applies them to accrediting the reliability of PCIs. Accreditation of a PCI requires prior accreditation of the security of all information systems used by the PCI in accordance with SP 800-37.
One difference between the accreditation of the security of information systems and the accreditation of the reliability of a PCI is that an organization has considerable flexibility in how they prepare for a SP 800-37 accreditation (particularly in implementing security controls), but have little room for variation under SP 800-79-1. Much of the flexibility in SP 800-37 comes from the necessity of acceptable variations in security controls, since individual information systems within varied environments may have significantly different security requirements. Conversely, the desire for standardization that is implicit in HSPD-12 has led to the development of a stable set of requirements. There may be some flexibility in how a requirement is met, but a majority of requirements must be satisfied in a uniform manner in order to deem a PCI as reliable. Allowing too much latitude in how a requirement is met undermines this reliability.
Although organizations may feel constrained by the uniformity required by FIPS 201-1, standardization greatly contributes to achieving the objectives of HSPD-12 across PIV Card Issuer implementations. For all organizations to accept the PIV Cards of other organizations, one set of rules (i.e., FIPS 201-1) must be followed by all PIV system participants. This Special Publication provides a way of determining if the participants are following these rules. Accreditation efforts that are consistent, reliable, and repeatable provide a basis for determining the reliability and capability of providers who issue PIV Cards, which herein is defined as consistent adherence to the PIV standards. In particular, if PCIs meet the requirements of FIPS 201-1 and relevant documents as verified through applicable assessment procedures and maintain consistency of their operations with respect to meeting these criteria, they can be considered reliable as is required by HSPD-12.
The objectives of the guidelines in this document are to—
• Outline the requirements to be met by a PCI, the rationale for the requirements and the assessment procedures required to determine the satisfaction of those requirements by a PCI through a combination of policies, procedures, and operations.
• Describe an accreditation methodology that provides a framework for organizing the requirements and assessment procedures stated above and at the same time provides coverage for all the control objectives stated in HSPD-12.
• Demonstrate the fact that the application of the methodology will result in assessment outcomes that are consistent, reliable, and repeatable.
• Emphasize the role of risk in arriving at an accreditation decision, based on assessment outcomes that takes into account the organization’s mission.
Are issued based on sound criteria for verifying an individual’s identity;
Are strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation;
Can be rapidly authenticated electronically; and
Are issued only by providers whose reliability has been established by an official accreditation process.
NIST developed and published Federal Information Processing Standard (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, and several Special Publications providing additional specifications in response to [HSPD-12] . These documents provide the foundation for Government personal identification, verification, and access control systems.
Appendix A.1 of FIPS 201-2 states the following:
“… [HSPD-12] requires that all cards be issued by providers whose reliability has been established by an official accreditation process.”
To determine consistency in operations of issuers of PIV Cards, NIST developed a set of attributes as the basis of reliability assessment and published the first version of this document in July 2005. Subsequent lessons learned in various agencies’ implementation, experience in credential management and PIV Card issuance together with the evolution of PIV Card issuing organizations motivated NIST to develop an updated methodology that is objective, efficient, and resulted in a consistent and repeatable authorization decisions. These developments led NIST to publish the first revision to SP 800-79 (i.e., SP 800-79-1) in June 2008. In 2013, FIPS 201 was superseded by FIPS 201 revision 2 (FIPS 201-2). FIPS 201-2 incorporates additional lessons learned from PIV Card issuers and allows for mobile device-integrated PIV credentials. This revision reflects the update to FIPS 201-2 and its new associated publication SP 800-157, Guidelines for Derived Personal Identity Verification (PIV) Credentials [SP800-157] , which details the issuance and use of Derived PIV Credentials 3 that are integrated in mobile devices.
3 The Derived PIV Credential is an additional common identity credential under HSPD-12 and FIPS 201-2 that is issued by a Federal department or agency and used with mobile devices. Derived PIV Credentials are based on the general concept of derived credential in SP 800-63-2, Electronic Authentication Guideline [SP 800-63-2] , which leverages identity proofing and vetting results of current and valid credentials. When applied to PIV, identity proofing and vetting processes do not have to be repeated to issue a Derived PIV Credential. Instead, the user proves possession of a valid PIV Card to receive a Derived PIV Credential. To achieve interoperability with the PIV infrastructure and its applications, a Derived PIV Credential is a subset of Unless there is a need to differentiate between PCIs and DPCIs, this document uses the common term issuer to refer to both types of issuers. Similarly, Derived PIV Credential and the PIV Card’s credentials are collectively referred to as credentials, unless a distinction is made. An issuer is considered to be owned and managed by an organization which may be a federal department, agency, or a private entity authorized by a federal department or agency. Ensuring the reliability of an issuer is of critical importance in light of the security and privacy implications of credentials used for meeting the objective of secure and reliable forms of identification to millions of employees and contractors. [HSPD-12] and its standards and guidelines were developed to address a range of security concerns, including those posed by terrorists in a post-9/11 world. Providing a comprehensive set of standards for controlling access to the physical and logical resources through the use of standard credentials, provides the assurance that certain pre-defined levels of security can be achieved. However, it requires organizations to implement and use the standards in a consistent and reliable manner. An organization must have confidence in the credentials it issues to its own employees and contractors. Possibly more importantly, since [HSPD-12] requires a common inter-agency- interoperable standard, all organizations need to have confidence in the identity credentials issued by other organizations. This confidence can only be established if the issuer’s functions in those other organizations are assessed and authorized. Thus, authorization of the issuer plays a key role in meeting the objectives of [HSPD-12] .
NIST has considerable experience in the development of assessment and authorization methodologies, most significantly with the widely accepted approach to authorization in SP 800- 37-1, Guide for Applying the Risk Management Framework to Federal Information Systems [SP 800-37-1] , and its family of related documents. While [SP 800-37-1] is focused on the authorization of the security of information systems, rather than the authorization of the reliability of an issuer, it does offer a practical foundation for the authorization programs envisioned by [HSPD-12] . This document utilizes the various aspects of [SP 800-37-1] and applies them to authorizing the reliability of an issuer. Authorization of an issuer requires prior assessment of the security of all information systems used by that issuer in accordance with [SP 800-37-1] . PIV Cards and Derived PIV Credentials are typically issued through the use of information systems and hence an assessment of their security (through the methodology in [SP 800-37-1] ) is critical in determining the ability to comply with [FIPS 201-2] requirements.
One difference between the authorization of the security of information systems and the authorization of the reliability of an issuer is that an organization has considerable flexibility in how they prepare for an [SP 800-37-1] authorization (particularly in implementing security controls), but have little room for variation for an SP 800-79-2 authorization. Much of the flexibility in [SP 800-37-1] comes from the necessity of acceptable variations in security controls, since individual information systems within varied environments may have significantly different security requirements. Conversely, the desire for standardization in [HSPD-12] has led to the development of a stable set of requirements. There may be some flexibility in how a requirement is met, but a majority of requirements must be satisfied in a uniform manner in order to deem an issuer as reliable. Allowing too much latitude in how a requirement is met undermines its reliability.
PIV Credential and restricted to Public Key Infrastructure (PKI) Credentials. Although organizations may feel constrained by the uniformity required by FIPS 201-2, standardization greatly contributes to achieving the objectives of [HSPD-12] across issuer implementations. For all organizations to accept PIV Cards or Derived PIV Credentials of other organizations, one set of rules (i.e., FIPS 201-2) must be followed by all PIV system participants. This Special Publication provides a way of determining if the participants are following these rules. Assessment methods that are consistent, reliable, and repeatable provide a basis for determining the reliability and capability of issuers of PIV Cards and Derived PIV Credentials, which herein is defined as consistent adherence to the PIV standards. In particular, if an issuer meets the requirements of FIPS 201-2 and relevant documents as verified through applicable assessment procedures and maintain consistency of their operations with respect to meeting these criteria, they can be considered reliable as is required by [HSPD-12] .
The objectives of the guidelines in this document are to—
Outline the requirements for PIV Card Issuers and for the Derived PIV Credentials Issuers, the rationale for the requirements and the assessment procedures required to determine the satisfaction of those requirements through a combination of policies, procedures, and operations.
Describe an authorization methodology that provides a framework for organizing the requirements and assessment procedures stated above and at the same time provides coverage for all the control objectives stated in [HSPD-12] . Emphasize the role of risk associated with an authorization decision, based on assessment outcomes that take into account the organization’s mission.