1.1 Applicability, Intended Audience, and Usage
All changes in this version
Title
Applicability, Intended Audience, and Usage
Control changed
Before · SP 800-79-1
This document is applicable to, and shall be used by, all Federal organizations for all their employees and contractors for authorizing their physical access to Federal facilities (e.g., buildings, leased offices) and logical access to Federal information systems. It may also be used by any other organization (e.g., state and local government, educational, non-profit) desiring compliance with FIPS 201-1.
All Federal organizations are required to adopt HSPD-12, implement FIPS 201-1, and use SP 800-79-1 to assess the adequacy of their implementations and accredit the reliability of the directly-controlled or sub-contracted services involved in creating and issuing PIV Cards. All non-Federal organizations (e.g., state governments) and private organizations specifying mandatory conformance with FIPS 201-1 in a procurement contract should use these guidelines to assess and accredit the services of their PIV Card Issuers.
SP 800-79-1 is consistent and compatible with HSPD-12, FIPS 201-1, and SP 800-37. SP 800- 79-1 includes a number of roles, requirements, definitions, specifications, and procedures needed to adequately assess and accredit the reliability of a PIV Card Issuing organization (PCI). All PCIs should issue PIV Cards only after they have been authorized to operate based on this document. In situations where a PCI that has already started issuing cards fails a SP 800-79-1 accreditation, it must immediately halt operations. Similarly, if the PCI that has already started issuing cards obtains a SP 800-79-1 accreditation subject to some terms and conditions, those restrictions must be immediately enforced in its operations.
Once a PCI is accredited using the guidelines within this document, trust can be established in the PIV Cards it issues. However, organizations that accept PIV Cards issued by PCIs that are not accredited are doing so at their own risk, since no assurance has been obtained about the reliability of operations for those PCIs.
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this specification are to be interpreted as described in IETF RFC 2119.
After · SP 800-79-2
This document is applicable to, and shall be used by, all Federalfederal organizations for all their employees and contractors for authorizing their physical access to Federal facilities (e.g., buildings, leased offices) and logical access to Federal information systems. It may also be used by any other organization (e.g., state and local government, educational, non-profit) desiring complianceclose alignment with FIPS 201-1201-2 and associated PIV credentials.
All Federalfederal organizations are required to adopt [HSPD-12,] and implement FIPS 201-1,201-2. andThey must use SP 800-79-1800-79-2 to assess the adequacy of their implementations andas accreditwell as the reliability of either the directly-controlled or sub-contracted services involved in creating and issuing PIV Cards. All non-Federal organizations (e.g., state governments) and private organizations specifyingthe mandatory conformance with FIPS 201-1 in a procurement contract should use these guidelines toPIV assessCards and accredit the services ofoptional theirDerived PIV CardCredentials Issuers(if implemented).
SP 800-79-1800-79-2 is consistent and compatible with the control objectives in [HSPD-12] , [FIPS 201-1201- 2] , and [SP 800-37800-37-1] . SP 800- 79-1800-79-2 includes a number of roles, requirements, definitions, specifications, and procedures needed to adequately assess and accredit the reliability of a PIV Cardan Issuingissuing organization (PCI). All PCIs should issue PIV Cards only after they have been authorized to operate based on this document. In situations where a PCI that has already started issuingan cardsissuer fails a SP 800-79-1 accreditation, it must immediately halt operations. Similarly,to ifmeet the PCI that has already started issuing cardsassessment obtainscriteria ain SP 800-79-1 accreditation subject to some terms and conditions800-79-2, those restrictionsthey must be immediately enforced in itshalt operations.
Once aan PCIissuer is accreditedauthorized to operate using the guidelines within thisfrom document800-79-2, trust can be established in the issued PIV CardsCard itor issuesDerived PIV Credential throughout its lifecycle. HoweverHence, organizations that accept PIV Cards issuedor byDerived PCIsPIV Credentials that aredo not accreditedfollow these guidelines, are doing so at their own risk, since no assurance has been obtained about the reliability of their operations forcannot thosebe PCIsassured.