BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.3 Outsourcing of Issuing Functions (was: Outsourcing of PCI Functions)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 2 PREPARATION FOR ASSESSMENT AND AUTHORIZATION part of 2

Title changed

Before · SP 800-79-1

Outsourcing of PCI Functions

After · SP 800-79-2

Outsourcing of PCIIssuing Functions

Control changed

Before · SP 800-79-1

An organization may out-source its PCI functions to one or more organizations. As the complexity and cost of new technology increase, the organization may decide that the most efficient and cost-effective solution for implementing HSPD-12 is to seek the services of an external service provider. An external service provider may be a Government agency, a private entity, or some other organization that offers services or functions necessary to issue PIV Cards.

Figure 1 provides an illustration of the functions that can be outsourced. Only the organization which “owns” (i.e., manages, controls, or privately owns) the PCI can decide which of its employees and contractors are required to apply for a PIV Card (Sponsorship – a responsible official of the organization providing the biographic and organizational affiliation of the PIV card applicant) and under what conditions the application will be approved (Adjudication – the kind of background information that will form the basis for authorization for PIV Card Issuance). Therefore, these two functions cannot be outsourced.

Figure 1 - Outsourcing of PCI Functions A PCI which out-sources services to an external provider must make sure that all privacy-related requirements are satisfied. The PCI is responsible for ensuring that privacy requirements are being met both internally and by every external service provider.

If an organization’s management is considering using the services of a PCI set up by another organization, the operations plan and associated documents, the accreditation decision and evidence of implementation of FIPS 201-1 requirements of that PCI (service provider PCI) must be reviewed. Similarly, if a PCI is using the services of an external service provider selectively for one or more of its PCI processes, the provider’s capability to meet FIPS 201-1 requirements for those processes must be reviewed as well. In both cases, the information gathered as part of this review activity must be included as part of the PCI’s assessment leading to accreditation. Outsourced functions must be assessed prior to accreditation of the PCI.

After · SP 800-79-2

An organization may out-sourceoutsource its PCIissuing functions to one or more organizations. As the complexity and cost of new technology increase, the organization may decide that the most efficient and cost-effective solution for implementing [HSPD-12] is to seek the services of an external service provider. An external service provider may be a Federal Government agency, a private entity, or some other organization that offers services or functions necessary to issue PIV Cards or Derived PIV Credentials.

Figure 1 provides an illustration of the functions that can be outsourced. Only the organization which “owns” (i.e., manages, controls, or privately owns) the PCI can decide which of its employees and contractors are required to apply for a PIV Card and a Derived PIV Credential (Sponsorship – a responsible official of the organization providing the biographic and organizational affiliation of the PIV card applicant) and under what conditions the application will be approved (Adjudication – the kind of background information that will form the basis for authorization forto issue the PIV Card Issuance). Therefore, these two functions cannot be outsourced.

Figure 1 - Outsourcing of PCIIssuer Functions 8

7 In the case of Derived PIV Credentials issued at Level of Assurance (LOA) 3. 8 The term token is used in this document to refer to the various Derived PIV Credential tokens detailed in [SP 800-157] . A PCI or DPCI which out-sources services to an external provider must make sure that all privacy-related requirements are satisfied. Theand PCIas such is responsible for ensuring that privacy requirements are being met both internally and by every external service provider.

If an organization’s managementissuer is considering using thePIV services of a PCI set up by another organization, the operations plan and associated documents, the accreditationauthorization decision and evidence of implementation of FIPS 201-1201-2 requirements of that PCIissuer (PCI or DPCI service provider PCI) must be reviewed by the Designated Authorizing Official (DAO) of the issuer. Similarly, if aan PCIissuer is using the services of an external service provider selectively for one or more of its PCI processes, the provider’s capability to meet FIPS 201-1201-2 requirements for those processes must be reviewed as well. In both cases, the information gathered as part of this review activity must be included as part ofin the PCI’sissuer’s assessment leading to accreditationauthorization. Outsourced functions must be assessed prior to accreditationauthorization of thean PCIissuer.