2.4 Assessment and Authorization (was: Assessment and Accreditation)
All changes in this version
Title changed
Before · SP 800-79-1
Assessment and Accreditation
After · SP 800-79-2
Assessment and AccreditationAuthorization
Control changed
Before · SP 800-79-1
HSPD-12 mandates that PIV Cards be “issued only by providers whose reliability has been established by an official accreditation process.” This document contains guidelines for satisfying the requirements for an official accreditation and provides a methodology that any organization can utilize to formally accredit a PCI. This methodology consists of two major elements–assessment and accreditation. While assessment and accreditation are very closely related, they are two very distinct activities.
Assessment, which occurs before accreditation, is the process of gathering evidence regarding a PCI’s satisfaction of the requirements of FIPS 201-1, both at the organization and facility level. Assessment activities include interviews with PCI and PCIF personnel, a review of documentation, observation of processes, and execution of tests to determine reliability of the PCI. The result of the assessment is a report that serves as the basis for an appropriate accreditation decision. The report is also the basis for developing corrective actions for removing or mitigating discovered deficiencies.
Distinct from assessment, accreditation is the decision to authorize the operation of a PCI once it has been established that the requirements of FIPS 201-1 have been met and the risks regarding security and privacy are acceptable. The individual making the accreditation decision must be knowledgeable of HSPD-12 and aware of the potential risks to the organization’s operations, assets, and personnel (e.g., applicants, PCI Facility staff).
The assessment and the accreditation are both carried out by the organization that owns the PCI.
In order to make an informed, risk-based accreditation decision, the assessment process should seek to answer the following questions:
• Has the PCI implemented the requirements of FIPS 201-1 in the manner consistent with the standard?
• Do personnel understand the responsibilities of their roles and/or positions, and reliably perform all required activities as described in the PCI’s documentation?
• Are services and functions throughout the PCI and its facilities (e.g., enrollment/identity proofing, card activation/issuance) carried out in a consistent, reliable, and repeatable manner?
• Have deficiencies identified during the assessment been documented, current and potential impact on security and privacy been highlighted, and the recommendations and timelines for correction or mediation been included in the assessment report?
After · SP 800-79-2
[HSPD-12] mandates that PIVidentification Cardscredentials be “ issued only by providers whose reliability has been established by an official accreditation process .” This document contains guidelines for satisfying the requirements for an official accreditationauthorization and provides a methodology that any organization can utilizebe utilized to formally accreditauthorize aan PCIissuer. This methodology consists of two major elementssets of activities–assessment and accreditationauthorization. While assessment and accreditationauthorization are very closely related, they are two very distinct activities.
Assessment, which occurs before accreditation,authorization and is the process of gathering evidence regarding aan PCI’sissuer’s satisfaction of the requirements of FIPS 201-1201-2, both at the organization and facility level. Assessment activities include interviews with PCIthe issuer and PCIFthe issuing facility’s personnel, a review of documentation, observation of processes, and execution of tests to determine overall reliability of the PCIissuer. The result of the assessment is a report that serves as the basis for an appropriate accreditationauthorization decision. The report is also the basis for developing corrective actions for removing or mitigating discovered deficiencies.
Distinct from assessment, accreditationauthorization is the decision to authorizepermit the operation of athe PCIissuer once it has been established that the requirements of FIPS 201-1201-2 have been met and the risks regarding security and privacy are acceptable. The individual making the accreditationauthorization decision must be knowledgeable of [HSPD-12] and aware of the potential risks to the organization’s operations, assets, and personnel (e.g., applicants, PCIissuing Facilityfacility staff).
The assessment and the accreditationauthorization are both carried out by the organization (as per Section 5.3) that “owns” (i.e., manages, controls, or privately owns) the PCIissuance of PIV Cards and/or Derived PIV Credentials 9 .accreditationauthorization decision, the assessment process should seek to answer the following questions:• Has the PCIissuer implemented the requirements of FIPS 201-1201-2 in the manner consistent with the standard?•9 The trust in PIV Cards and Derived PIV Credentials stems from the guidelines in Task 6 of Section 5.3 . Do personnel understand the responsibilities of their roles and/or positions, and reliably perform all required activities as described in the PCI’sissuer’s documentation?• Are services and functions throughoutat the PCIissuer and its facilities (e.g., enrollment/identity proofing/registration, card/token production, activation/issuance) carried out in a consistent, reliable, and repeatable manner?• Have deficiencies identified during the assessment been documented, current and potential impact on security and privacy been highlighted, and the recommendations and timelines for correction or mediation been included in the assessment report?