4 I SSUER C ONTROLS A SSESSMENT & A UTHORIZATION D ECISION P ROCESS (was: ASSESSMENTS)
All changes in this version
Title changed
Before · SP 800-79-1
ASSESSMENTS
After · SP 800-79-2
ASSESSMENTSI SSUER C ONTROLS A SSESSMENT & A UTHORIZATION D ECISION P ROCESS
Control changed
Before · SP 800-79-1
An assessment is a set of activities performed by the Assessor to gain assurance that the PIV Card Issuer (PCI) controls have been implemented properly and meet their required function or purpose. Understanding the overall effectiveness of the PCI controls implemented in the PCI and its facilities is essential in determining the risk to the organization’s overall mission, and forms the basis for the accreditation decision by the Designated Accreditation Authority (DAA).
An Assessor must– (i) compile evidence that the PCI controls employed in the PCI are implemented correctly, operating as intended, and producing the desired results; and (ii) present this evidence in a manner such that the DAA can make a credible, risk-based decision about the operation of the PCI.
The focus of an assessment is the PCI controls, each of which is designed to satisfy one or more specific requirements from FIPS 201-1 and related documents. The objective for the Assessor is to use the assessment procedures associated with each PCI control (described in Appendix G) as a means to measure if the PCI being assessed meets the requirements. The assessment procedures are designed to facilitate the gathering of evidence that PCI controls are implemented correctly, operating as intended, and producing the desired outcome.
In preparation for a PCI assessment, the Assessor performs the following two preparatory steps:
• Determination of the accreditation boundary to understand the target of the assessment. The accreditation boundary dictates which PCIFs and outsourced services are to be included in the assessment.
• Review of the PCI operations plan to determine which PCI controls are implemented at the organizational level and which at the facility level. This analysis should provide the Assessor with an understanding of where different responsibilities lie within the PCI and how to address them during the assessment.
In cases where a PCI has outsourced functions, the PCI is responsible for ensuring that the external service provider has implemented the control. During the assessment, it is the service provider’s responsibility to provide documentation to the Assessor regarding the implementation of that control. If results from a previous assessment of the service provider (provided the current assessment is part of re-accreditation after substantial changes) can be referenced, the Assessor may elect to incorporate these results (not exceeding one year) or re-do part or all of the assessment. The extent of re-use of the results of the previous assessment is entirely at the discretion of the Assessor.
PCI controls implemented at the organizational level generally need to be assessed only once, since these controls span across the entire PCI and its facilities. In other words, these controls may not be re-assessed when the accreditation boundary changes (e.g., due to addition of facilities). Examples of organizational level controls include the set of controls under the accreditation focus areas Preparation and Maintenance of Documentation (DO) and Assignment of Roles and Responsibilities (RR). There are certain controls that although they are put in place at the organizational level, they need to be reviewed at the PCIF level. An example of such a control artifact is “contingency/disaster recovery plan for information systems”. Though the development of the contingency/disaster recovery plan is an organizational level control, a review of this control artifact is needed whenever new information systems in the existing facilities or new facilities are added to ensure that these new systems are brought within the scope of the plan.
Unlike organization level PCI controls, facility level PCI controls need to be assessed individually at each facility. A facility is often designated based on the type of PCI process it performs (exceptions are the Sponsorship Process and Adjudication Process). Hence, for example, if there are multiple facilities for enrollment/identify proofing (e.g., multiple enrollment centers), assessment of the PCI controls under the focus area Enrollment/Identity Proofing should take place in each of the enrollment centers. However, if all facilities are operating using uniform operational procedures and underlying information systems, it is acceptable to perform assessments at facilities that are selected randomly or through some other established criteria (e.g., geographical region or service provider).
Prior assessments may be used as a starting point for the assessment of a PCI. While past assessments provide insight into the implementation and operation of the PCI, a number of factors affect the validity of past assessments. These include updates in policies and procedures, changes in systems/technology, and turnover in employees and contractors. Any significant changes in one or more of these factors should trigger a new assessment of the PCI. The Assessor must validate whether a PCI is currently operating as expected using the given assessment procedures, including specially tailored or augmented procedures. It is only through a current valid assessment of PCI controls that the Assessor and Organization Identity Management Official (OIMO) will have confidence in the reliability of the PCI and its facilities.
The use of automated security controls, if reliably implemented and maintained in information systems, results in a high assurance of the protection of information and other organizational assets. Human involvement results in more variability in how PCI controls are implemented and operated, as security and reliability depend on many factors, including an individual’s training, knowledge, motivation, experience, and management. Relying on humans for data protection, rather than on reliable, automated security mechanisms, makes it critical that trust and reliability assessments of management, operators, and maintenance personnel are current and up-to-date. Many of the assessment procedures rely on interactions among the Assessor, PCI management, and facilities staff. Interviews with all involved personnel and observations of all PCI processes are required. On-site visits, real-time observations, and reviews of processes are essential, as the Assessor must not rely solely on documentation to determine if a given PCI control has been implemented.
After · SP 800-79-2
An assessment is a set of activities performed by the Assessor to gain assurance that the PIV Card Issuer (PCI) controls have been implemented properly and meet their required function or purpose. Understanding the overall effectiveness of the PCI controls implemented in the PCI and its facilities is essential in determining the risk to the organization’s overall mission, and forms the basis for the accreditation decision by the Designated Accreditation Authority (DAA).An assessment is a set of activities performed by the Assessor to gain assurance that the issuer controls for a PIV Card Issuer or a Derived PIV Credential Issuer have been implemented properly and meet their required function or purpose. Understanding the overall effectiveness of the issuer controls implemented by the issuer and its facilities is essential in determining the risk to the organization’s overall mission, and forms the basis for the authorization decision by the Designated Authorizing Official.
An Assessor must– (i) compile evidence that the PCI controls employed in the PCI are implemented correctly, operating as intended, and producing the desired results; and (ii) present this evidence in a manner such that the DAA can make a credible, risk-based decision about the operation of the PCI.
The focus of an assessment is the PCI controls, each of which is designed to satisfy one or more specific requirements from FIPS 201-1 and related documents. The objective for the Assessor is to use the assessment procedures associated with each PCI control (described in Appendix G) as a means to measure if the PCI being assessed meets the requirements. The assessment procedures are designed to facilitate the gathering of evidence that PCI controls are implemented correctly, operating as intended, and producing the desired outcome.
In preparation for a PCI assessment, the Assessor performs the following two preparatory steps:
• Determination of the accreditation boundary to understand the target of the assessment. The accreditation boundary dictates which PCIFs and outsourced services are to be included in the assessment.
• Review of the PCI operations plan to determine which PCI controls are implemented at the organizational level and which at the facility level. This analysis should provide the Assessor with an understanding of where different responsibilities lie within the PCI and how to address them during the assessment.
In cases where a PCI has outsourced functions, the PCI is responsible for ensuring that the external service provider has implemented the control. During the assessment, it is the service provider’s responsibility to provide documentation to the Assessor regarding the implementation of that control. If results from a previous assessment of the service provider (provided the current assessment is part of re-accreditation after substantial changes) can be referenced, the Assessor may elect to incorporate these results (not exceeding one year) or re-do part or all of the assessment. The extent of re-use of the results of the previous assessment is entirely at the discretion of the Assessor.
PCI controls implemented at the organizational level generally need to be assessed only once, since these controls span across the entire PCI and its facilities. In other words, these controls may not be re-assessed when the accreditation boundary changes (e.g., due to addition of facilities). Examples of organizational level controls include the set of controls under the accreditation focus areas Preparation and Maintenance of Documentation (DO) and Assignment of Roles and Responsibilities (RR). There are certain controls that although they are put in place at the organizational level, they need to be reviewed at the PCIF level. An example of such a control artifact is “contingency/disaster recovery plan for information systems”. Though the development of the contingency/disaster recovery plan is an organizational level control, a review of this control artifact is needed whenever new information systems in the existing facilities or new facilities are added to ensure that these new systems are brought within the scope of the plan.
Unlike organization level PCI controls, facility level PCI controls need to be assessed individually at each facility. A facility is often designated based on the type of PCI process it performs (exceptions are the Sponsorship Process and Adjudication Process). Hence, for example, if there are multiple facilities for enrollment/identify proofing (e.g., multiple enrollment centers), assessment of the PCI controls under the focus area Enrollment/Identity Proofing should take place in each of the enrollment centers. However, if all facilities are operating using uniform operational procedures and underlying information systems, it is acceptable to perform assessments at facilities that are selected randomly or through some other established criteria (e.g., geographical region or service provider).
Prior assessments may be used as a starting point for the assessment of a PCI. While past assessments provide insight into the implementation and operation of the PCI, a number of factors affect the validity of past assessments. These include updates in policies and procedures, changes in systems/technology, and turnover in employees and contractors. Any significant changes in one or more of these factors should trigger a new assessment of the PCI. The Assessor must validate whether a PCI is currently operating as expected using the given assessment procedures, including specially tailored or augmented procedures. It is only through a current valid assessment of PCI controls that the Assessor and Organization Identity Management Official (OIMO) will have confidence in the reliability of the PCI and its facilities.
The use of automated security controls, if reliably implemented and maintained in information systems, results in a high assurance of the protection of information and other organizational assets. Human involvement results in more variability in how PCI controls are implemented and operated, as security and reliability depend on many factors, including an individual’s training, knowledge, motivation, experience, and management. Relying on humans for data protection, rather than on reliable, automated security mechanisms, makes it critical that trust and reliability assessments of management, operators, and maintenance personnel are current and up-to-date. Many of the assessment procedures rely on interactions among the Assessor, PCI management, and facilities staff. Interviews with all involved personnel and observations of all PCI processes are required. On-site visits, real-time observations, and reviews of processes are essential, as the Assessor must not rely solely on documentation to determine if a given PCI control has been implemented.
An Assessor must– (i) compile evidence that the issuer controls are implemented correctly, operating as intended, and producing the desired results; and (ii) present this evidence in a manner such that the DAO can make a credible, risk-based decision about the operation of the issuer.
The focus of an assessment is the issuer controls, each of which is designed to satisfy one or more specific requirements from FIPS 201-2 and related documents. The objective for the Assessor is to use the assessment procedures associated with each issuer control (described in Appendix G ) as a means to measure conformance to the requirements. The assessment procedures are designed to facilitate the gathering of evidence that issuer controls are implemented correctly, operating as intended, and producing the desired outcome.
In preparation for an assessment, the Assessor performs the following two preparatory steps:
Determination of the authorization boundary to understand the target of the assessment. The authorization boundary dictates which issuing facilities and outsourced services are to be included in the assessment.
Review of the operations plan to determine which issuer controls are implemented at the organizational level and which at the facility level. This analysis should provide the Assessor with an understanding of where different responsibilities lie within the issuer organization and how to address them during the assessment.
In cases where PIV functions have been outsourced, the issuer is responsible for ensuring that the external service provider has implemented the control. During the assessment, it is the service provider’s responsibility to provide documentation to the Assessor regarding the implementation of that control. If results from a previous assessment of the service provider (provided the current assessment is part of re- authorization after substantial changes) can be referenced, the Assessor may elect to incorporate these results (not exceeding one year) or re-do part or all of the assessment. The extent of re-use of the results of the previous assessment is entirely at the discretion of the Assessor.
Issuer controls implemented at the organizational level generally need to be assessed only once, since these controls span across the entire issuer and its issuing facilities. In other words, these controls may not be re-assessed when the authorization boundary changes (e.g., due to addition of facilities). Examples of organizational level controls include the set of controls under the authorization focus areas Preparation and Maintenance of Documentation (DO) and Assignment of Roles and Responsibilities (RR). There are certain controls that although they are put in place at the organizational level, they need to be reviewed at the issuing facility level. An example of such a control artifact is “contingency/disaster recovery plan for information systems”. Though the development of the contingency/disaster recovery plan is an organizational level control, a review of this control artifact is needed whenever new information systems in the existing facilities or new facilities are added to ensure that these new systems are brought within the scope of the plan.
Unlike organization level issuer controls, facility level issuer controls need to be assessed individually at each facility. A facility is often designated based on the type of PIV process it performs (exceptions are the Sponsorship Process and Adjudication Process). Hence, for example, if there are multiple facilities for identify proofing/registration (e.g., multiple registration centers), assessment of the issuer controls under the focus area identity proofing/registration, should take place in each of the enrollment centers. However, if all facilities are operating using uniform operational procedures and underlying information systems, it is acceptable to perform assessments at facilities that are selected randomly or through some other established criteria (e.g., geographical region or service provider).
Prior assessments may be used as a starting point for the assessment of an issuer. While past assessments provide insight into the implementation and operation of an issuer, a number of factors affect the validity of past assessments. These include updates in policies and procedures, changes in systems/technology, and turnover in employees and contractors. Any significant changes in one or more of these factors should trigger a new assessment. The Assessor must validate whether the issuer is currently operating as expected using the given assessment procedures, including specially tailored or augmented procedures. It is only through a current valid assessment of issuer controls that the Assessor and Organization Identity Management Official will have confidence in the reliability of the issuer and its issuing facilities.
The use of automated security controls, if reliably implemented and maintained in information systems, results in a high assurance of the protection of information and other organizational assets. Human involvement results in more variability in how issuer controls are implemented and operated, as security and reliability depend on many factors, including an individual’s training, knowledge, motivation, experience, and management. Relying on humans for data protection, rather than on reliable, automated security mechanisms, makes it critical that trust and reliability assessments of management, operators, and maintenance personnel are current and up- to-date. Many of the assessment procedures rely on interactions among the Assessor, issuer management, and facilities staff. Interviews with all involved personnel and observations of all PIV processes are required. On-site visits, real-time observations, and reviews of processes are essential, as the Assessor must not rely solely on documentation to determine if a given issuer control has been implemented.