BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1.2 Changes for this Revision (was: History of this Revision)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 1 Introduction part of 1

Title changed

Before · SP 800-79-1

History of this Revision

After · SP 800-79-2

HistoryChanges offor this Revision

Control changed

Before · SP 800-79-1

In order to satisfy HSPD-12, SP 800-79 was developed in July 2005, shortly after publication of FIPS 201, in order to provide organizations with an initial set of guidelines for accreditation of their PIV Card Issuers. While the original version had a clear idea of the functions needed for deployment of a PIV Card, it was impossible to foresee how the organization and management of these functions and the structuring of the PCI would evolve. The experience gained since then has provided the knowledge and perspective needed to develop a new accreditation methodology that is objective, efficient, and will result in consistent and repeatable accreditation decisions.

The major changes for this revision include:

• Removal of attributes as the basis of reliability assessment, and replacing them with PCI controls, traceable to specific requirements from FIPS 201-1 and related documents;

• Additional guidelines on how to determine the accreditation boundaries of a PCI;

• Discussion of the risk involved in authorizing the operation of a PCI;

• Removal of “Section 4.0 - PCI Functions and Operations” and “Section 5.0 - PIV Services and Operations,” which were narrative discussions of FIPS 201-1 requirements;

• Clarification of the similarities and differences between the accreditation of computer systems for secure operation as specified in SP 800-37 and the accreditation of the reliability of an organization as specified in SP 800-79-1;

• Changing the term “certification” to “assessment”; and

• Use of “organization” instead of “department” or “agency.”

After · SP 800-79-2

In order to satisfy HSPD-12, SPThe 800-79major waschanges developedfor inthis Julyrevision 2005,include shortlyadditions afterand publicationupdates ofto FIPSissuer 201,controls in orderresponse to providenew organizationsor withchanged anrequirements initialin setFIPS of201-2. guidelinesThese forare:

 accreditationInclusion of their PIV Cardissuer Issuers.controls Whilefor theDerived originalPIV versionCredentials hadIssuers a(DPCI), clear ideaAddition of the functionsissuer neededcontrols for deployment of aissuing PIV Card, it was impossible to foreseeCards howunder the organization and management of thesegrace functionsperiod and the structuring of the PCI would evolve. The experience gained since then has provided the knowledgefor andissuing perspectivePIV neededCards to develop a new accreditation methodology thatindividuals isunder objective,pseudonymous efficientidentity, and will result in consistent and repeatable accreditationAddition decisions.

Theof majorissuer changescontrols for this revision include:

• Removal of attributes as the basisPIV ofCard’s reliabilityvisual assessmenttopography, and replacing them withProvided PCIdetailed controls, traceable to specific requirements from FIPSaddress 201-1post-issuance andupdates relatedfor documents;

•PIV AdditionalCards, guidelines onUpdated howreferences to determine the accreditation boundaries of a PCI;

• Discussion of the risk involved in authorizingmore therecent operationcredentialing ofguidance aissued PCI;

•by RemovalOffice of “Section 4.0 - PCI Functions and Operations” and “Section 5.0 - PIV ServicesPersonnel andManagement Operations(OPM),” which were narrative discussions of FIPS 201-1 requirements;

• ClarificationAddition of theissuer similaritiescontrols andwith differencesrespect betweento the accreditation of computer systems for secure operationchain-of-trust asrecords specifiedmaintained inby SPa 800-37PIV andCard theissuer, accreditation ofModified theprocess reliabilityto ofinclude an organization as specified in SP 800-79-1;

• Changing theindependent termreview “certification”prior to “assessment”; and

• Use of “organization” insteadauthorization of “department” or “agencyissuer.”