2.5 Authorization Boundary of the Issuer (was: Accreditation Boundary for the PCI)
All changes in this version
Title changed
Before · SP 800-79-1
Accreditation Boundary for the PCI
After · SP 800-79-2
AccreditationAuthorization Boundary forof the PCIIssuer
Control changed
Before · SP 800-79-1
An organization preparing to accredit a PCI must first identify the appropriate accreditation boundary. The accreditation boundary defines the specific PCI operations that are to be the target of the assessment and accreditation. A PCI comprises the complete set of functions required for the issuance and maintenance of PIV Cards. In determining the accreditation boundary, the organization may consider if the functions are being performed identically in all PCI facilities, are using identical information technology components, and are under the same direct management control. For instance, an organization may have two sub-organizations, each of which has distinct processes and management structures. The organization may decide to establish two separate PCIs, each with its own accreditation boundary. In this example, two separate PCI assessments would be undertaken. Each assessment would result in an independent accreditation decision.
In drawing an accreditation boundary, an organization may want to include only a subset of PCI facilities. For example, if a PCI has several facilities, some of which are ready for operation and some that are still in the development stage, the organization may choose to define the accreditation boundary to include the PCI and only those facilities that are ready to be assessed. If the accreditation is successful, the PCI and a subset of its facilities will be authorized to operate and begin issuing cards. The remaining PCIFs can continue with implementation and be included in the accreditation boundary at a later date.
In the case of outsourcing PCI services that are not under direct management control of the organization nor physically located within its facilities, the organization must include the functions provided by external service providers within the accreditation boundary to make certain that they are included within the scope of accreditation. This assures that no matter how and where the functions are performed, the organization maintains complete accountability for the reliability of its PIV program.
Care should be used in defining the accreditation boundary for a PCI. A boundary that is unnecessarily expansive (i.e., including too many dissimilar processes and business functions or geographically dispersed facilities) makes the assessment and accreditation process extremely unwieldy and complex. On the other hand, a boundary that is unnecessarily limited increases the number of needed assessments and accreditations and thus drives up the total cost for an organization. Establishing a boundary for a PCI and its subsequent accreditation are organization-level activities that should include participation of all key personnel. An organization should strive to define the accreditation boundary for a PCI that strikes a balance between the costs and benefits of assessment and accreditation.
While the above considerations should be useful to an organization in determining the boundary for its PCI for purposes of accreditation, they should not limit the organization’s flexibility in establishing a practical boundary that promotes an effective HSPD-12 compliant implementation. The scope of an accreditation is a PCI (whose boundaries are formed by included facilities) and not individual facilities (PCIFs).
After · SP 800-79-2
AnThe organizationfirst preparingstep toin accreditauthorizing aan PCIissuer mustis firstto identify the appropriate accreditationauthorization boundary. The accreditationauthorization boundary defines the specific PCI operations that are to be the target of the assessment and accreditationauthorization. A PCI comprises the complete set of functions required for the issuance and maintenance of PIV Cards while a DPCI comprises of the complete set of functions required for the issuance and maintenance of Derived PIV Credentials. In determining the accreditationauthorization boundary, the organization maymust consider if the functions are being performed identically in all PCIissuing facilities, are using identical information technology components, and are under the same direct management control. For instance, an organization may have two sub-organizations, each of which has distinct processes and management structures. The organization may decide to establish two separate PCIsissuers, each with its own accreditationauthorization boundary. In this example, two separate PCI assessments would be undertaken. Each assessment would result in an independent accreditationauthorization decision.
In drawing an accreditationauthorization boundary, an organization may want to include only a subset of PCIits issuing facilities. For example, if a PCI has several facilities, some of which are ready for operation and some that are still in the development stage, the organization may choose to define the accreditationauthorization boundary to include the PCI and only those facilities that are ready to be assessed. If the accreditationauthorization is successful, the PCI and a subset of its issuing facilities will be authorized to operate and begin issuing cardsPIV Cards. The remaining PCIFsissuing facilities can continue with implementation and be included in the accreditationauthorization boundary at a later date.
In the case of outsourcing PCIissuance services that are not under direct management control of the organization nor physically located within its facilities, the organization must include the functions provided by external service providers within the accreditationauthorization boundary to make certain that they are included within the scope of accreditationauthorization. This assures that no matter how and where the functions are performed, the organization maintains complete accountability for the reliability of its PIV program. From an Issuer point of view, this translates to applying the necessary due diligence process with respect to assessment of controls to ensure outsourced functions are conducted in an acceptable and compliant manner.
Care should be used in defining the accreditationauthorization boundary for athe PCIissuer. A boundary that is unnecessarily expansive (i.e., including too many dissimilar processes and business functions or geographically dispersed facilities) makes the assessment and accreditationauthorization process extremely unwieldy and complex. On the other hand, a boundary that is unnecessarily limited increases the number of needed assessments and accreditations and thus drives up the total cost for an organization. Establishing a boundary for a PCI and its subsequent accreditationauthorization are organization-level activities that should include participation of all key personnel. An organization should strive to define the accreditationauthorization boundary forof atheir PCIissuer such that it strikes a balance between the costs and benefits of assessment and accreditationauthorization.
While the above considerations should be useful to an organization in determining the boundary for its PCI for purposes of accreditationauthorization, they should not limit the organization’s flexibility in establishing a practical boundary that promotes an effective [HSPD-12] compliant implementation. The scope of an accreditationauthorization is an issuer - that is a PCI or DPCI (whose boundaries are formed by included issuing facilities) and not individual facilitiesissuing (PCIFs)facilities.