BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1 Assessment Methods

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 4 I SSUER C ONTROLS A SSESSMENT & A UTHORIZATION D ECISION P ROCESS part of 4

Title

Assessment Methods

Control changed

Before · SP 800-79-1

One or more assessment procedures are associated with each PCI control listed in Appendix G. An assessment procedure is carried out using one or more of the following assessment methods. (The assessment methods associated with an assessment procedure are given in parenthesis in Appendix G)
• Review – An evaluation of documentation that describes plans, policies, and procedures in order to verify that they are adequate, understood by the PCI management and operations personnel, and that they are in accordance with applicable policies, regulations, standards, technical guidelines, and organizational guidance.

• Interview – a directed conversation with one or more PCI personnel in which both pre- established and follow-on questions are asked, responses documented, discussion encouraged, and conclusions reached.

• Observe – a real-time viewing of PCI processes in operation, including all information system components of the PCI involved in creation, issuance, maintenance, and replacement of PIV Cards.

• Test – an evaluation of a component against a set of relevant PIV specifications using applicable test methods and metrics (as given in the associated assessment procedure in Appendix G).

These methods are intended to provide the Assessor with sufficient, precise, accurate, and relevant evidence regarding an accreditation topic and focus area. One or more assessment methods may be required to determine if the PCI has satisfactorily met the objective outlined for that assessment procedure. Assessment results are used by the Assessor to determine the overall effectiveness of the PCI control.

Table 3 shows an example of the relationships among a PAT, an Accreditation Focus Area, several PCI controls, and their assessment procedures.

Preparation and Maintenance of Documentation DO-1 The organization develops and implements a PCI operations plan according to the template in Appendix D. The operations plan references other documents as needed. Determine that: (i.) the operations plan includes the relevant elements from the template in Appendix D (review); (ii.) the operations plan includes the list of PCI controls and included with each is the PCI control owner, how they were implemented and whether they are organization or facility specific (review); (iii.) documentation that is not included in the operations plan is referenced accurately (review); (iv.) the operations plan is reviewed and approved by the DAA within the organization (review, interview). SP 800-79-1, Section 2.11 – Accreditation Package and Supporting Documentation DO-2 The organization has written policies and procedures for enrollment/identity proofing that are approved by the head of the organization. Determine that : (i) the organization has developed and documented written policy and procedures for identity proofing and enrollment for personnel requiring a PIV Card (e.g. employees, contractors and foreign nationals) (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPS 201-1, Section 2.2– PIV Identity Proofing and

Table 3 - Sample PCI Controls with Assessment Procedures

Some organizations may need to customize some of the PCI controls to meet their specific characteristics and mission needs. In such cases, the associated assessment procedures may also have to be customized/augmented to ensure proper implementation of these controls.

After · SP 800-79-2

OneIn order to assess the capability and reliability of an issuer, one or more assessment procedures are associated with each PCIissuer control listedhave into Appendixbe Gcompleted. An assessment procedure is carried out using one or more of the following assessment methods. (The assessment methods associated with an assessment procedure are given in parenthesis in AppendixTable G.1 and Table G.2 .)
• Review – An evaluation of documentation that describes plans, policies, and procedures in order to verify that they are adequate, understood by the PCI management and operations personnel, and that they are in accordance with applicable policies, regulations, standards, technical guidelines, and organizational guidance.

• Interview – a directed conversation with one or more PCIissuer personnel in which both pre- established and follow-on questions are asked, responses documented, discussion encouraged, and conclusions reached.

• Observe – a real-time viewing of PCIPIV processes in operation, including all information system components of the PCIissuer involved in creation, issuance, maintenance, and replacementtermination of PIV Cards or Derived PIV Credentials.

• Test – an evaluation of a component against a set of relevant PIV specifications using applicable test methods and metrics (as given in the associated assessment procedure in AppendixTable G.1 and Table G.2 ).

These methods are intended to provide the Assessor with sufficient, precise, accurate, and relevant evidence regarding an accreditationIAT topic and its focus areaareas. One or more assessment methods may be required to determine if the PCIissuer has satisfactorily met the objective outlined for that assessment procedure. Assessment results are used by the Assessor to determine the overall effectiveness of the PCIissuer control.

Table 34 shows an example of the relationships among aan PATIAT, an AccreditationAuthorization Focus Area, several PCIissuer controls, and their assessment procedures. Controls with an applicability column marked with DPCI (e.g., without LOA-4 or 3 postfix) applies to both LOA-3 and LOA-4 Derived PIV Credentials.

Authorization Focus Area Identifier Issuer Control Applicability Source

Preparation and Maintenance of Documentation DO-1DO(DC):1 The organization develops and implements aan PCIissuer operations plan according to the template in Appendix D.2 . The operations plan references other documents as needed.

Assessment Determine that: (i.) the operations plan includes the relevant elements from the template in Appendix D.2 (review); (ii.) the operations plan includes the list of PCIissuer controls and included with each is the PCIissuer control owner for each, how they were implemented and whether they are organization or facility specific (review); (iii.) documentation that is not included in the operations plan is referenced accurately (review); DPCI SP 800-79-2, Section 2.11 – Authorization Package and Supporting Documentation Authorization Focus Area Identifier Issuer Control Applicability Source (iv.) the operations plan ishas been reviewed and approved by the DAADAO within the organization (review, interview). SP 800-79-1, Section 2.11 – Accreditation Package and Supporting Documentation DO-2

DO(DC):3 The organization has a written policiespolicy and procedures for enrollment/identityinitial proofingissuance that are approved by the head or deputy secretary (or equivalent) of the organizationFederal department or agency.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for identity proofing and enrollment for personnel requiring a PIV Card (e.g. employees, contractors and foreign nationals)issuance (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1201-2 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head or deputy secretary (or equivalent) of the organizationFederal department or agency (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPSDPCI 201-1[SP 800-157] , Section 2.2– PIV IdentityLifecycle ProofingActivities and Related

[SP 800-157] , Section 2.2 –

Table 34 -– Sample PCIIssuer Controls with Assessment Procedures (for DPCI)

Some organizations may need to customize some of the PCIissuer controls to meet their specific characteristics and mission needs. In such cases, the associated assessment procedures may also have to be customized/augmented to ensure proper implementation of these controls.