BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2.1 Issuer Controls implemented at the Organization or Facility Level (was: PCI Controls implemented at the Organization or Facility Level)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 3 T AXONOMY OF I SSUER C ONTROLS part of 3.2

Title changed

Before · SP 800-79-1

PCI Controls implemented at the Organization or Facility Level

After · SP 800-79-2

PCIIssuer Controls implemented at the Organization or Facility Level

Control changed

Before · SP 800-79-1

The nature of each PCI control dictates where it is implemented. Controls that are common to or impact multiple PCI processes are implemented at the organization level. The development of the PCI operations plan is an example of a PCI control implemented at the organizational level. Generally, controls specific to a process are implemented at the facility where that process or function is carried out. For example, the control that states that a “1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record must be performed before releasing the PIV Card to the applicant” is implemented at a card activation/issuance facility.

After · SP 800-79-2

The nature of each PCIissuer control dictates where it is implemented. Controls that are common to or impact multiple PCIPIV processes are implemented at the organization level. The development of the PCI operations plan is an example of aan PCIissuer control implemented at the organizational level. Generally, controls specific to a process are implemented at the issuing facility where that process or function is carried out. For example, the control that states that a “1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record must be performed before releasing the PIV Card to the applicant” is implemented at a cardan activation/issuance facility.

For Derived PIV Credentials issued at LOA-3, an issuer may implement all the requirements necessary to issue these credentials remotely. In such a case, the issuer may not need to have an issuing facility and issuing facility-specific controls may not be applicable. Regardless of the system and process architecture on how PIV Card and Derived PIV Credentials are issued, it is the responsibility of issuer organization to ensure that all applicable controls are implemented.