BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1.3 Timelines for using the revised Guidelines

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 1 Introduction part of 1

Title

Timelines for using the revised Guidelines

Control changed

Before · SP 800-79-1

These revised guidelines for accrediting PCIs will take effect immediately following publication of SP 800-79-1. Hence, organizations shall use these revised guidelines for accrediting any new PCI, any PCI whose accreditation is currently in progress, or any PCI that previously has gone through accreditation (under SP 800-79) and failed (with or without being issued a Denial of Authorization to Operate (DATO) or Interim Authorization to Operate (IATO)). Any PCI that has already been accredited and currently holds the Authorization to Operate (ATO) under SP 800-79 must be re-accredited based on these revised guidelines no later than one year after the final publication date.

After · SP 800-79-2

TheseThis revisedpublication guidelinesis foreffective accreditingimmediately PCIsand willit takesupersedes effectthe immediatelyprevious followingversion.

FIPS publication201-2 mandates the implementation of SPsome 800-79-1PIV Card features that were previously optional to implement. Hence,The organizationsstandard shallalso userequires that all new or replacement PIV Cards include these revisedpreviously guidelinesoptional forfeatures accreditingbeginning anySeptember new2014 PCI(i.e., anyone PCIyear whosepublication accreditationof isFIPS currently201-2). These new FIPS 201-2 requirements result in progress,the orfollowing anyre-authorization PCIscenarios:

 thatOrganizations previouslywhose hascurrent goneAuthorization throughto accreditationOperate (ATO) (under SP 800-79800-79-1) andcovers failedissuance (withof orPIV withoutCards beingwith issuedthe anew Denialmandatory features of AuthorizationFIPS 201-2 do not have to Operatebe re-authorized under SP 800-79-2; 4

 Organizations whose current ATO (DATOunder SP 800-79-1) orcovers Interimissuance Authorizationof PIV Cards without the new mandatory features are required to Operatebe (IATO))re-authorized under SP 800-79-2.

Derived AnyPIV PCICredentials thatare hasoptional alreadyPIV beencredentials accreditedintroduced in FIPS 201-2 and currentlydetailed holdsin theSP Authorization800-157 toGuidelines Operatefor Derived Personal Identity Verification (ATOPIV) underCredentials [SP 800-79800- must157] be. re-accreditedThe timeline for their use on mobile devices depends on Department and Agencies to achieve the ATO to issue Derived PIV Credential based on thesethis reviseddocument and on the availability of validated Derived PIV Credential tokens. No Derived PIV Credentials shall be issued unless the issuer has met the requirements of and is operating in accordance to the guidelines noof laterSP than800- one79-2.

4 yearRe-Authorization afterusing the finalrevised publicationguidelines date(SP 800-79-2) is required within three (3) years of current Authorization to Operate (ATO).