BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.1 Issuer (was: PCI)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 2 PREPARATION FOR ASSESSMENT AND AUTHORIZATION part of 2

Title changed

Before · SP 800-79-1

PCI

After · SP 800-79-2

PCIIssuer

Control changed

Before · SP 800-79-1

At the highest level, a PCI includes all functions required to produce, issue, and maintain PIV Cards for an organization. A PCI is considered operational if all relevant roles and responsibilities have been defined and appointed; suitable policies and compliant procedures have been implemented for processes, including sponsorship, enrollment/identity proofing, adjudication, card production, card activation/issuance, and maintenance; and information system components that are utilized for performing the above-mentioned functions (processes) have been assessed and shown to meet all technical and operational requirements prescribed in FIPS 201-1 and related documents.

In order to comply with Homeland Security Presidential Directive 12 (HSPD-12), an organization must first establish a PCI that conforms to and satisfies the requirements of FIPS 201-1 and related documents. The PCI must then be accredited (i.e., using the guidelines specified in SP 800-79-1). An organization has certain flexibility in establishing a PCI. It may outsource some of the required processes within its PCI. Large organizations with widely varying missions for its operating units may even establish multiple PCIs. Regardless of how a PCI is structured, the organization (e.g., Federal agency, Federal contractor) is responsible for the management and oversight of the PCI and maintains full responsibility for the accreditation of the PCI as required in HSPD-12.

A PCI must be completely described in its PCI operations plan. This comprehensive document incorporates all the information about the PCI that is needed for any independent party to review it and assess the capability and reliability of the PCI’s operations. A PCI operations plan includes a description of the structure of the PCI, its facilities, any external service providers, the roles and responsibilities within the PCI, policies and procedures which govern its operations, and a description of how requirements of FIPS 201-1 are being met. A template for a PCI operations plan is provided in Appendix D.

After · SP 800-79-2

At the highest level, an issuer provides a PCIfull includesset allof functions required to produce, issue, and maintain PIV Cards or Derived PIV Credentials for an organization. A PCI or DPCI is considered operational if all relevant roles and responsibilities have been defined and appointed; suitable policies and compliant procedures have been implemented for all relevant PIV processes, 5 including sponsorship, enrollment/identity proofing/registration, adjudication, card/token production, card activation/issuance, and maintenance; and information system components that are utilized for performing the above-mentioned functions (processes) have been assessed and shown to meet all technical and operational requirements prescribed in FIPS 201-1201-2 and related documents.

In order to comply with Homeland Security Presidential Directive 12 ( [HSPD-12] ), an organization must first establish aan PCIissuer, thatto issue PIV Cards or Derived PIV Credentials, which conforms to and satisfies the requirements of FIPS 201-1201-2 and related documents. The PCIissuer must then be accreditedauthorized (i.e., using the guidelines specified in SPthis 800-79-1document). An organization has certain flexibility in establishingimplementing aits PCIissuance functions. It may outsource some of the required processes within its PCI. Large organizations with widely varying missions foror itsestablish operatingmultiple units may evenfor establishfulfilling multiplethese PCIsprocesses. Regardless of how a PCI isits structuredstructure, the organization (e.g., Federal agency, Federal contractor) is responsible for the management and oversight of the PCI and maintains full responsibility for theits accreditationfunctions ofas thean PCIissuer as required in [HSPD-12] .

AThe PCIorganization must be completely described indescribe its PCIPIV Card and/or Derived PIV Credential issuance functions in an operations plan. This comprehensive document incorporates all the information about the PCIissuer that is needed for any independent party to review it and assess the capability and reliability of the PCI’sits operations. A PCIAn operations plan includes a description of the structure of the PCIissuer, its facilities, any external service providers, the roles and responsibilities within the PCI, policies and procedures which govern its operations, and a description of how requirements of FIPS 201-1201-2 are being met. A template for a PCIan operations plan is provided in Appendix D .