3.1 Introducing Issuer Controls (was: Introducing PCI Controls)
All changes in this version
Title changed
Before · SP 800-79-1
Introducing PCI Controls
After · SP 800-79-2
Introducing PCIIssuer Controls
Control changed
Before · SP 800-79-1
Accreditation of a PCI is a broader endeavor than accreditation of the security of an information system under SP 800-37. The requirements specified in Federal Information Processing Standard (FIPS) 201-1 cover all major aspects of a PCI, including organizational preparedness; security management and data protection; infrastructure; and PCI processes. Each broad area is defined herein as a PCI Accreditation Topic (PAT). In addition to providing structure to the assessment, PATs are also used to summarize the assessment results for reporting. In addition, they are used to structure the report to senior organization management that provides an analysis of the strengths and weaknesses within the PCI.
The PCI Accreditation Topics:
• Organizational Preparedness relates to the capability, knowledge, and understanding of senior management regarding the formation and operation of the PCI. Roles and responsibilities must be clearly identified, and policies and procedures must be defined, documented, implemented, and enforced.
• Security Management & Data Protection involves implementing and operating appropriate security management procedures, operational controls, and technical protection measures to ensure that privacy requirements are satisfied, the rights of individuals are assured, and personal data is protected.
• Infrastructure Elements represents the activities required to procure, deploy, and maintain the PCI information system components. PCI information system components (e.g., PKI, biometrics, and card production) must meet the technical specifications defined in FIPS 201-1 and related documents. Additionally, information systems used within the PCI need to be certified and accredited under Special Publication (SP) 800-37 for FISMA compliance.
• Processes are classes of functions that collectively span the entire PIV lifecycle activities, such as sponsorship, enrollment/identity proofing, adjudication, card production, card activation/issuance, and maintenance.
Each PAT is sub-divided into one or more Accreditation Focus Areas. Each focus area is a set of closely-related requirements that need to be met by the PCI and its facilities. Each requirement and the procedure, process, or technical product (termed a “PCI control”) used to satisfy each requirement listed under a focus area needs to be satisfied by a PCI. However, the manner in which the requirement is satisfied and how its specifications are implemented and managed may vary from organization to organization.
For instance, each PCI is required to identity-proof their applicants (i.e., use due diligence in validating the claimed identity of the applicant, using all documents provided by the applicant) prior to enrollment. This process can be implemented in one of several ways, depending upon the structure, size, and geographical distribution of an organization’s facilities. The process could be conducted at a central location or could be distributed throughout the country within regional centers. It could be operated directly by the organization or by an outside service provider. However, irrespective of the implementation approach, this enrollment/identity-proofing activity needs to be reliably and accurately performed.
PCI controls are designed to satisfy specific requirements in FIPS 201-1 and its related documents. If the underlying specification requirements are mandatory, then the corresponding PCI controls are mandatory as well. There are also PCI controls associated with optional requirements in FIPS 201-1. This category of PCI controls also becomes mandatory if the PCI is implementing those optional requirements. An example is an optional requirement to store the electronic facial image of the card holder in the PIV Card. If the PCI’s card activation/issuance’s process implements this option, then the associated PCI control should be assessed with an acceptable result.
The evidence that ensures the presence of PCI controls that are derived from FIPS 201-1 requirements and its related documents as well as OMB Memoranda, and verified through appropriate assessments, establishes the capability of a PCI. However, accreditation is generally based not merely on the demonstration of capability, but also on the presence of certain organizational characteristics that will provide a high degree of confidence to the Assessor that the demonstrated capabilities will be carried out in a dependable and sustainable manner. This dependability measure, or reliability (as it is generally called), has to be established by adequately assessing that a PCI has the desired organizational characteristics, including adequate facilities, appropriate equipment, trained personnel, adequate resources, trustworthy management, and properly vetted operations staff. Hence, the accreditation methodology includes a set of PCI controls, verification of which establishes the reliability of a PCI. This set of controls is grouped under the accreditation focus area “Facility and Personnel Readiness”. These reliability-relevant PCI controls are formulated, based on “commonly accepted security readiness measures” that have evolved in response to lessons learned in security incidents that have taken place due to threats, such as insider attacks, and risks, such as physical security lapses. In addition to the controls provided herein, an organization may develop additional mission-specific controls that will contribute towards the overall reliability of the PCI to meet the organization’s mission needs.
Table 1 provides a listing of the four PIV Accreditation Topics (PATs) and the Accreditation Focus Areas under each topic:
Organizational Preparedness Preparation and Maintenance of Documentation (DO) Assignment of Roles and Responsibilities (RR) Facility and Personnel Readiness (FP) Security Management & Data Protection Protection of Stored and Transmitted Data (ST) Enforcement of Applicable Privacy Requirements (PR) Infrastructure Elements Deployed Products & Information Systems (DP) Implementation of Credential Infrastructures (CI) Processes Sponsorship Process (SP) Enrollment/Identity-Proofing Process (EI) Adjudication Process (AP) Card Production Process (CP) Card Activation/Issuance Process (AI) Maintenance Process (MP)
Table 1 - PATs and Associated Accreditation Focus Areas
Appendix G contains required PCI controls grouped by PAT and Accreditation Focus Area. Each PCI control represents how one or more requirements from FIPS 201-1 and its related documents can be satisfied. PCI controls are sequentially numbered using the two-character identifier assigned to the Accreditation Focus Area under which they are listed. Table 2 shows the relationships between PATs, Accreditation Focus Areas, and PCI controls.
DO-1 The organization develops and implements a PCI operations plan according to the template in Appendix D. The operations plan references other documents as needed. SP 800-79-1, Section 2.11 – Accreditation Package and Supporting Documentation Preparation and Maintenance of Documentation (DO) DO-2 The organization has a written policy and procedures for enrollment/identity proofing that has been approved by the head of the organization. FIPS 201-1, Section 2.2– PIV Identity Proofing and Table 2 - PAT, Accreditation Focus Area, and PCI Control Relationships
Irrespective of whether the information systems utilized within the PCI and its facilities are categorized at low, moderate, or high impact levels according to FIPS 199, the same set of PCI controls apply, regardless of an individual system’s impact level. Furthermore, nothing precludes a PCI from implementing additional controls to ensure a higher level of confidence in mitigating risks associated with issuing PIV Cards.
After · SP 800-79-2
Accreditation of a PCI is a broader endeavor than accreditation of the security of an information system under SP 800-37. The requirements specified in Federal Information Processing Standard (FIPS) 201-1 cover all major aspects of a PCI, including organizational preparedness; security management and data protection; infrastructure; and PCI processes. Each broad area is defined herein as a PCI Accreditation Topic (PAT). In addition to providing structure to the assessment, PATs are also used to summarize the assessment results for reporting. In addition, they are used to structure the report to senior organization management that provides an analysis of the strengths and weaknesses within the PCI.Assessment of a PIV Card or Derived PIV Credential Issuer is a broader endeavor than assessment of the security of an information system under [SP 800-37-1] . The requirements specified in [FIPS201-2] cover all major aspects of an issuer, including organizational preparedness; security management and data protection; infrastructure; and issuance processes. Each broad area is defined herein as an Issuer Authorization Topic (IAT). In addition to providing structure to the assessment, IATs are also used to summarize the assessment results for reporting. In addition, they are used to structure the report to senior organization management that provides an analysis of the strengths and weaknesses within an issuer organization.
The PCI Accreditation Topics:
• Organizational Preparedness relates to the capability, knowledge, and understanding of senior management regarding the formation and operation of the PCI. Roles and responsibilities must be clearly identified, and policies and procedures must be defined, documented, implemented, and enforced.
• Security Management & Data Protection involves implementing and operating appropriate security management procedures, operational controls, and technical protection measures to ensure that privacy requirements are satisfied, the rights of individuals are assured, and personal data is protected.
• Infrastructure Elements represents the activities required to procure, deploy, and maintain the PCI information system components. PCI information system components (e.g., PKI, biometrics, and card production) must meet the technical specifications defined in FIPS 201-1 and related documents. Additionally, information systems used within the PCI need to be certified and accredited under Special Publication (SP) 800-37 for FISMA compliance.
• Processes are classes of functions that collectively span the entire PIV lifecycle activities, such as sponsorship, enrollment/identity proofing, adjudication, card production, card activation/issuance, and maintenance.
Each PAT is sub-divided into one or more Accreditation Focus Areas. Each focus area is a set of closely-related requirements that need to be met by the PCI and its facilities. Each requirement and the procedure, process, or technical product (termed a “PCI control”) used to satisfy each requirement listed under a focus area needs to be satisfied by a PCI. However, the manner in which the requirement is satisfied and how its specifications are implemented and managed may vary from organization to organization.
For instance, each PCI is required to identity-proof their applicants (i.e., use due diligence in validating the claimed identity of the applicant, using all documents provided by the applicant) prior to enrollment. This process can be implemented in one of several ways, depending upon the structure, size, and geographical distribution of an organization’s facilities. The process could be conducted at a central location or could be distributed throughout the country within regional centers. It could be operated directly by the organization or by an outside service provider. However, irrespective of the implementation approach, this enrollment/identity-proofing activity needs to be reliably and accurately performed.
PCI controls are designed to satisfy specific requirements in FIPS 201-1 and its related documents. If the underlying specification requirements are mandatory, then the corresponding PCI controls are mandatory as well. There are also PCI controls associated with optional requirements in FIPS 201-1. This category of PCI controls also becomes mandatory if the PCI is implementing those optional requirements. An example is an optional requirement to store the electronic facial image of the card holder in the PIV Card. If the PCI’s card activation/issuance’s process implements this option, then the associated PCI control should be assessed with an acceptable result.
The evidence that ensures the presence of PCI controls that are derived from FIPS 201-1 requirements and its related documents as well as OMB Memoranda, and verified through appropriate assessments, establishes the capability of a PCI. However, accreditation is generally based not merely on the demonstration of capability, but also on the presence of certain organizational characteristics that will provide a high degree of confidence to the Assessor that the demonstrated capabilities will be carried out in a dependable and sustainable manner. This dependability measure, or reliability (as it is generally called), has to be established by adequately assessing that a PCI has the desired organizational characteristics, including adequate facilities, appropriate equipment, trained personnel, adequate resources, trustworthy management, and properly vetted operations staff. Hence, the accreditation methodology includes a set of PCI controls, verification of which establishes the reliability of a PCI. This set of controls is grouped under the accreditation focus area “Facility and Personnel Readiness”. These reliability-relevant PCI controls are formulated, based on “commonly accepted security readiness measures” that have evolved in response to lessons learned in security incidents that have taken place due to threats, such as insider attacks, and risks, such as physical security lapses. In addition to the controls provided herein, an organization may develop additional mission-specific controls that will contribute towards the overall reliability of the PCI to meet the organization’s mission needs.
Table 1 provides a listing of the four PIV Accreditation Topics (PATs) and the Accreditation Focus Areas under each topic:
Organizational Preparedness Preparation and Maintenance of Documentation (DO) Assignment of Roles and Responsibilities (RR) Facility and Personnel Readiness (FP) Security Management & Data Protection Protection of Stored and Transmitted Data (ST) Enforcement of Applicable Privacy Requirements (PR) Infrastructure Elements Deployed Products & Information Systems (DP) Implementation of Credential Infrastructures (CI) Processes Sponsorship Process (SP) Enrollment/Identity-Proofing Process (EI) Adjudication Process (AP) Card Production Process (CP) Card Activation/Issuance Process (AI) Maintenance Process (MP)
Table 1 - PATs and Associated Accreditation Focus Areas
Appendix G contains required PCI controls grouped by PAT and Accreditation Focus Area. Each PCI control represents how one or more requirements from FIPS 201-1 and its related documents can be satisfied. PCI controls are sequentially numbered using the two-character identifier assigned to the Accreditation Focus Area under which they are listed. Table 2 shows the relationships between PATs, Accreditation Focus Areas, and PCI controls.
DO-1 The organization develops and implements a PCI operations plan according to the template in Appendix D. The operations plan references other documents as needed. SP 800-79-1, Section 2.11 – Accreditation Package and Supporting Documentation Preparation and Maintenance of Documentation (DO) DO-2 The organization has a written policy and procedures for enrollment/identity proofing that has been approved by the head of the organization. FIPS 201-1, Section 2.2– PIV Identity Proofing and Table 2 - PAT, Accreditation Focus Area, and PCI Control Relationships
Irrespective of whether the information systems utilized within the PCI and its facilities are categorized at low, moderate, or high impact levels according to FIPS 199, the same set of PCI controls apply, regardless of an individual system’s impact level. Furthermore, nothing precludes a PCI from implementing additional controls to ensure a higher level of confidence in mitigating risks associated with issuing PIV Cards.
The Issuer Authorization Topics (IAT):
Organizational Preparedness relates to the capability, knowledge, and understanding of senior management regarding the formation and operation of the issuer. Roles and responsibilities must be clearly identified, and policies and procedures must be defined, documented, implemented, and enforced.
Security Management & Data Protection involves implementing and operating appropriate security management procedures, operational controls, and technical protection measures to ensure that privacy requirements are satisfied, the rights of individuals are assured, and personal data is protected.
Infrastructure Elements represents the activities required to procure, deploy, and maintain the information system components used for issuance of PIV Cards or Derived PIV Credentials tokens. These information system components (e.g., PKI, biometrics, card or token personalization, etc.) must meet the technical specifications defined in [FIPS 201-2] and related documents and need to be authorized under [SP 800-37-1] for FISMA compliance.
Processes are classes of functions that collectively span the entire lifecycle activities, 15 such as sponsorship, identity proofing/registration, adjudication, card /token production, activation/issuance, and maintenance of the PIV Card and the Derived PIV Credential.
Each IAT is sub-divided into one or more Authorization Focus Areas. A focus area is a set of closely-related requirements that need to be met by an issuer. Under each focus area is a procedure or technical product (termed an “Issuer Control”) that is used to satisfy a particular requirement listed under a focus area. However, the manner in which the requirements are satisfied and how the specifications are implemented and managed may vary from organization to organization.
15 Note: Some of the processes may not apply to Derived PIV Credential issuers. For instance, each issuer (but not DPCI) is required to identity-proof their applicants (i.e., use due diligence in validating the claimed identity of the applicant). This process can be implemented in one of several ways, depending upon the structure, size, and geographical distribution of the organization’s facilities. The process could be conducted at a central location or distributed throughout the country within regional centers. It could be operated directly by the organization or by an outside service provider. However, irrespective of the implementation approach, this identity proofing/registration activity must be reliably and accurately performed.
The evidence that ensures the presence of issuer controls that are derived from FIPS 201-2 requirements and its related documents as well as OMB Memoranda, and verified through appropriate assessments, establishes the capability of the issuer. However, authorization is generally based not merely on the demonstration of capability, but also on the presence of certain organizational characteristics that will provide a high degree of confidence to the Assessor that the demonstrated capabilities will be carried out in a dependable and sustainable manner. This dependability measure, or reliability (as it is generally called), has to be established by adequately assessing that an issuer has the desired organizational characteristics, including adequate issuing facilities, appropriate equipment, trained personnel, adequate resources, trustworthy management, and properly vetted operations staff. Hence, the assessment and authorization methodology includes a set of issuer controls, verification of which establishes the reliability of the issuer. This set of controls is grouped under the IAT’s Authorization Focus Area called - “Facility and Personnel Readiness”. These reliability-relevant issuer controls are formulated, based on “commonly accepted security readiness measures” that have evolved in response to lessons learned in security incidents that have taken place due to threats, such as insider attacks, and risks, such as physical security lapses. In addition to the controls provided herein, an organization may develop additional mission-specific controls that will contribute towards the overall reliability of the issuer to meet the organization’s mission needs. Table 1 provides a listing of the four Issuer Authorization Topics (IATs) and associated Authorization Focus Areas under each topic:
Organizational Preparedness Preparation and Maintenance of Documentation (DO) Assignment of Roles and Responsibilities (RR) Facility and Personnel Readiness (FP) Security Management & Data Protection Protection of Stored and Transmitted Data (ST) Enforcement of Applicable Privacy Requirements (PR) Infrastructure Elements Deployed Products & Information Systems (DP) Implementation of Credential Infrastructures (CI) Processes Sponsorship Process (SP) Identity Proofing/Registration Process (EI) Adjudication Process (AP) Card/Token Production Process (CP) Activation/Issuance Process (AI) Maintenance Process (MP)
Table 1 - IATs and Associated Authorization Focus Areas
Table G.1 and Table G.2 contain required issuer controls grouped by IAT and associated Authorization Focus Area for a PCI and a DPCI respectively. Each issuer control represents how one or more requirements from FIPS 201-2 and its related documents can be satisfied. Issuer controls are sequentially numbered using the two-character identifier assigned to the Authorization Focus Area under which they are listed. Identifiers for issuer controls applicable to both PCIs and DPCIs are aligned for ease of reference. In addition, controls for DPCIs are marked with (DC) for quick identification. For example, DO-1 applies to a PCI and DO(DC)-1 applies to a DPCI. Both these issuer controls are targeted at assessing the same requirement.
Table 2 shows the relationships between IATs, Authorization Focus Areas, and issuer controls for a PIV Card Issuer.
Authorization Focus Area Identifier Issuer Control Source Preparation and Maintenance of Documentation (DO) DO-1 The organization develops and implements an operations plan according to the template in Appendix D.1 . The operations plan references other documents as needed. SP 800-79-2, Section 2.11 – Authorization Package and Supporting Documentation
DO-2 The organization has a written policy and procedures for identity proofing and registration that are approved by the head or deputy secretary (or equivalent) of the Federal department or agency. FIPS 201-2, Section 2.7 – PIV Identity Proofing and Registration Requirements
Table 2 - IAT, Authorization Focus Area, and Issuer Control Relationships for PCIs Unlike for a PIV Card Issuer, not all issuer controls are applicable to a Derived PIV Credential Issuer. Certain issuer controls are applicable to only Level of Assurance 3 (LOA-3) or to only LOA-4 Derived PIV Credentials and therefore must be implemented by the issuer only if they are issuing that level of a Derived PIV Credential. This is represented via the “ applicability ” column within Table G.2 for DPCIs as seen in Table 3 . Controls with an applicability column marked with DPCI (e.g., without LOA-4 or 3 postfix) applies to both LOA-3 and LOA-4 Derived PIV Credential.
Authorization Focus Area Identifier Issuer Control Applicability Source Maintenance Process MP(DC)-17 If the Derived PIV Authentication private key was created and stored on a hardware cryptographic token that does not permit the user to export the private key, then termination of the Derived PIV Credential is performed by collecting and either zeroizing the private key or destroying the token. Otherwise, termination is performed by revoking the Derived PIV Authentication certificate. DPCI – LOA 4 Only [SP 800-157] , Section 2.3 – Maintenance
Table 3 - IAT, Authorization Focus Area, Issuer Control and Applicability Relationships for DPCIs
All issuer controls apply, regardless of an individual system’s FIPS 199 Standards for Security Categorization of Federal Information and Information Systems [FIPS199] impact level. Furthermore, nothing precludes an issuer from implementing additional controls to ensure a higher level of confidence in mitigating risks associated with issuing PIV Cards or Derived PIV Credentials.