`4.2` The Issuer Assessment Report (was: The Assessment Report)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version

modified 4 I SSUER C ONTROLS A SSESSMENT & A UTHORIZATION D ECISION P ROCESS part of 4

Title changed

Before · SP 800-79-1

The Assessment Report

After · SP 800-79-2

The Issuer Assessment Report

Control changed

Before · SP 800-79-1

After · SP 800-79-2

The Assessment report contains the results of the assessment in a format that facilitates reviewing by the DAA. The DAA must evaluate the information in the Assessment report in order to make a sound, credible decision regarding the residual risk of authorizing the operations of the PCI.

An Assessment report template is provided in Appendix E. The report is organized by Accreditation Focus Area. For each PCI control, it must be documented as to which entity is responsible for the implementation of that control (the organization or an external service provider) and if the PCI control is at the organizational or facility level. Card Activation/Issuance Process

PCI Control Identifier— AI-7

PCI Control Description — The issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the enrollment record. On successful match, the PIV Card shall be released to the applicant

PCI Control Owner/ Control Level — External Service Provider/Facility Level

Assessment Result — Partially Satisfied

Assessment Findings — There is operational evidence that a 1:1 biometric match is carried out before the card is released to the applicant.

Assessment Deficiency and Potential Impact — The requirement to carry out this task is not documented clearly enough in the operations plan. Although personnel are knowledgeable about this requirement, and the task was observed to be performed correctly during card issuance, the lack of documentation could be a problem if there is turnover in staff.

Recommendation — Update the issuance process description within the operations plan to include a clear description of this task in the process.

Figure 4 - Sample Assessment Report

The assessment result associated with each PCI control shall be one of the following:
• Satisfied
• Partially Satisfied
• Not Satisfied
• Not Applicable

After carrying out an assessment procedure, the Assessor records his/her conclusion in one of two ways: MET, NOT MET. Using the list of conclusions pertaining to assessment procedures associated with a PCI control, the assessment result (which is one of the 4 outcomes listed above) is arrived at as follows:

• If the conclusion from all assessment procedures is MET, then the assessment result for the PCI control is “Satisfied”

• If some of the conclusions are NOT MET, then the assessment result for the PCI control is marked as either “Partially Satisfied” or “Not Satisfied”, depending on whether or not any of the underlying tasks in the assessment procedures are critical (i.e., they represent the only way to meet the PCI control’s objective). An example of an assessment that resulted in “Partially Satisfied” is given in Figure 4. In this instance, there is an awareness of a task requirement, and the task itself is being carried out, but the reference to the task is missing in the document. In drawing a conclusion after carrying out an assessment procedure, the Assessor must consider the potential subjective and objective aspects of the assessment methods used (e.g., interviews, document reviews, observations, and tests) for that assessment procedure. Deficiencies that result in “Partially Satisfied” or “Not Satisfied” must be reported by the Assessor. The Assessor must also outline the potential adverse impacts if the PCI control is deployed with the identified deficiencies.

The assessment report template provides the means for recording the assessment result for each PCI control. The assessment results for all PCI controls are aggregated to generate the assessment report for a PCI accreditation focus area. The set of PCI Accreditation Focus Area Reports is aggregated to generate a PCI accreditation topic report. Finally, the group of PCI Accreditation Topic Reports is used to generate the overall PCI Assessment Report and an accompanying Executive Summary (intended for Senior Management). 5.0 ACCREDITATION

The accreditation of a PIV Card Issuer (PCI) consists of four phases: (i) Initiation; (ii) Assessment; (iii) Accreditation; and (iv) Monitoring. Each phase consists of tasks and sub-tasks that are to be carried out by the responsible officials (e.g., the Designated Accreditation Authority (DAA), Assessor, Organization Identity Management Official (OIMO), and PCI Facility (PCIF) Manager(s)). Figure 5 provides a view of the accreditation phases, including the tasks associated with each phase. A table of accreditation phases, tasks, sub-tasks, and the official responsible for each is provided in Appendix H.

• Preparation
• Resource Identification
• Operations Plan Analysis and Acceptance INITIATION PHASE

Figure 5 - Accreditation Phases

5.1 Initiation Phase

The Initiation Phase consists of three tasks: (i) preparation; (ii) resource identification; and (iii) operations plan analysis and acceptance. The primary purpose of this phase is to ensure that the PCI is prepared for the assessment, including having all the resources and documentation in place. The other purpose of this phase is to include the DAA early in the process in order to assure success of the assessment and accreditation. Task 1: Preparation The objectives of this task are to prepare for accreditation by reviewing the PCI operations plan and confirming that the plan is consistent with Federal Information Processing Standard (FIPS) 201-1 and the template provided herein.

Subtask 1.1: Confirm that the PCI and its operations have been fully described and documented in the PCI’s operations plan. ASSESSMENT PHASE

ACCREDITATION PHASE
• PCI Control Assessment
• Assessment Documentation

• Accreditation Decision
• Accreditation Documentation

MONITORING PHASE
• Operations Plan Update
• Annual Lifecycle Walkthrough Responsibility: OIMO Guidance: The PCI operation plan includes, at a minimum, the sections defined in the operations plan template in Appendix D. It is the OIMO’s responsibility to ensure that the organization’s PCI operations plan incorporates a complete and accurate description of the PCI’s operations. If a process or function is provided by an external service provider, their operating procedures should be documented and incorporated by reference in the PCI operations plan. In this case, the operations plan includes a pointer, guiding the reader to additional documentation and information.

Subtask 1.2: Confirm that processes followed at the PCI Facility are conducted in accordance with the policies and procedures specified in the PCI operations plan and are documented in standard operating procedures.

Responsibility: OIMO, PCIF Manager Guidance: Even though PCI Facilities may be following requirements from FIPS 201-1, their processes need to be consistent with those prescribed by the PCI’s operations plan and documented in standard operating procedures.

Task 2: Resource Identification The objectives of the resource identification task are to– (i) identify and document the resources required for assisting with the assessment; (ii) identify the scope of the assessment and accreditation boundary; and (ii) prepare a plan of assessment activities indicating the proposed schedule and key milestones.

Subtask 2.1: Identify the Senior Authorizing Official (SAO), Designated Accreditation Authority (DAA), Privacy Official (PO), PCIF Managers, Assessor, and other key personnel at the facility level who are performing functions, such as enrollment/identity proofing, card production, and card activation/issuance. Maintenance personnel also should be contacted to provide requested assessment information to the Assessor.

Responsibility: OIMO

Guidance: Notify these individuals of the upcoming assessment, and inform them of the need for their participation during the process.

Subtask 2.2: Determine the accreditation boundary for the PCI.

Responsibility: OIMO; DAA

Guidance: The accreditation boundary determines the target of the assessment. In preparation for a PCI assessment, the OIMO and DAA should identify which PCIFs and external service providers are to be included. This ensures that functions performed and processes managed by the external service provider are considered during the accreditation process. An organization may want to include only those PCIFs that are ready to operate; other facilities can be assessed at a later date.

Subtask 2.3: Determine the resources and the time needed for the accreditation of the PCI, and prepare a plan for execution of the assessment.

Responsibility: OIMO; DAA

Guidance: The level of effort required for an assessment depends on numerous factors— (i) the size the PCI; (ii) the location and number of its facilities; (iii) the level of outsourcing utilized by the PCI; and (iv) the number of cards being, or to be issued. By examining factors that could influence the complexity of the assessment, the organization can make informed judgments about the size of the assessment team, the resources needed to support the assessment, and the time- frame for completing it.

Task 3: Operations Plan Analysis and Acceptance The objectives of the operations plan analysis and acceptance task are: (i) determine if the requirements of FIPS 201-1 have been implemented; (ii) evaluate the PCI operations plan and revise as needed; and (iii) obtain acceptance of the plan by the DAA prior to conducting an assessment of the PCI controls.

Subtask 3.1: Review the list of required PCI controls documented in the organization’s PCI operation plan and then confirm that they have been implemented properly.

Responsibility: DAA; OIMO

Guidance: Since the PCI controls serve as the basis for the assessment, review the PCI’s documentation and operations plan to identify the controls that must be implemented before investing time in assessment activities such as interviews or testing. The operations plan must document each PCI control, whether it is organization or facility specific, the owner of the PCI control, and how the PCI control is implemented.

Subtask 3.2: Analyze the PCI operations plan to determine if there are deficiencies in satisfying all the policies, procedures, and other requirements in FIPS 201-1 that could result in a Denial of Authorization to Operate (DATO) being issued. After discussing the discovered deficiencies in the documentation and operations plan with the OIMO, the organization may still want to continue with the assessment, if it has determined that it can address all deficiencies within the time period of the current assessment. In this situation, the DAA can either authorize continuation of the assessment or terminate the assessment effort depending upon the evaluation of the PCI’s ability to address the deficiencies. Responsibility: DAA, OIMO

Guidance: The operations plan should adequately specify the policies, procedures, and processes of the PCI so that, subsequent to an initial review, deficiencies that could lead to an eventual DATO may be identified for the PCI.

Subtask 3.3: Verify that the PCI operations plan is acceptable.

Responsibility: DAA

Guidance: If the PCI operations plan is deemed acceptable, the DAA should authorize the accreditation processes to advance to the next phase. Acceptance of the PCI operations plan signifies that the resources required to initiate and complete the accreditation activities may be deployed.

5.2 Assessment Phase

The Assessment Phase consists of two tasks— (i) PCI control assessment; and (ii) assessment documentation. The purpose of this phase is to determine the extent to which the requirements of FIPS 201-1 are implemented correctly, operating as intended, and producing the desired outcomes. This phase also specifies actions to be taken to correct all identified deficiencies. An analysis of the impact of identified deficiencies that cannot be corrected or mitigated efficiently on the reliable operation of the PCI should be conducted and documented. Successful completion of this phase should provide the DAA with the information needed to make an appropriate accreditation decision.

Task 4: PCI Control Assessment The objectives of this task are to— (i) initiate and conduct an assessment of the PCI controls; and (ii) document the results of the assessment. The Assessor shall first verify the acceptability of all documentation, including the operations plan and previous assessments, along with all relevant Federal laws, regulations, standards, and directives. PCI control assessment should then commence. The Assessor should schedule interviews, schedule real-time observations of PCI processes, and initiate all needed testing of the PIV Card and PCI information system components. Once the Assessor has gathered the results of the assessment procedures, descriptions of all discovered deficiencies shall be prepared, along with recommendations for removing these deficiencies.

Subtask 4.1: Review the suggested and selected assessment methods for each PCI control in preparation for the assessment.

Responsibility: Assessor

Guidance: Based on the accreditation boundary, the scope of the assessment should be established. The Assessor should review the selected assessment procedures (based on the scope of the assessment) in order to plan and coordinate activities for the assessment. For instance, if a particular PCI control requires the observation of a particular process, the Assessor will need to schedule this activity in a timely fashion after coordinating it with the PCI’s or PCIF’s management. The Assessor, as directed by the DAA, may supplement the assessment methods and procedures recommended in these guidelines. Assessment methods and procedures may be created or tailored for a particular PCI.

Subtask 4.2: Assemble all documentation and supporting materials necessary for the assessment of the PCI; if these documents include previous assessments, review the findings and determine if they are applicable to the current assessment.

Responsibility: OIMO; Assessor

Guidance: The OIMO assists the Assessor in gathering all relevant documents and supporting materials from the organization that will be required during the assessment of the PCI. Central to this effort is the PCI operations plan. The PCI’s operations shall be completely described in the operations plan. The PCI operations plan may include by reference, or point to, the supporting materials. In this case, the OIMO will also need to gather this supporting material for the Assessor. Examples of other documentation include: (i) letters of appointment; (ii) privacy-related documentation; (iii) information forms utilized within the PCI; (iv) documentation from each outsourced service provider, including control implementation specifics, support and service level agreements, and contracts; (v) standard operating procedures for the PCIFs within the accreditation boundary for the PCI; and (vi) signed accreditation letters under SP 800-37 for all information systems within the PCI.

When previous assessments exist, including the one on which the current Authorization to Operate (ATO) is based, the Assessor is strongly encouraged to review these results. The Assessor may satisfy some of the PCI control assessment requirements by reviewing and referencing previous assessment report(s). Although previous assessments cannot be used as a substitute for the current assessment, they provide a snapshot view of the PCI and highlight problems that may have existed in the past.

Subtask 4.3: Assess the required PCI controls using the prescribed assessment procedures found in Appendix G.

Responsibility: Assessor

Guidance: The Assessor performs the assessment procedures selected for each PCI control to assess if the PCI controls have been implemented correctly, are operating as intended, and producing the desired outcomes. The Assessor uses the assessment methods specified in Section 4.1. Documentation collected in the previous task is reviewed, and any deficiencies are identified. Interviews can be used as an opportunity to clarify issues encountered during a review of the PCI documentation, as well as to determine the expertise of the personnel performing key functions with the PCI and its facilities. Processes need to be observed to ensure that they are being followed as documented and tests executed to determine if the PIV components have been configured and are operating in a PIV-compliant manner.

If the PCI and its facilities are being assessed, all the PCI controls will need to be assessed. If PIV services have been outsourced to an external provider, the Assessor shall verify that the PCI controls applying to those services have been assessed, and the reliability of the service provider has been found satisfactory. If a PCI and its facilities have already been assessed and are operating under a current ATO, and the purpose of the assessment is to add a facility(s) to the accreditation letter, the Assessor may reuse the results of a previous assessment for the organization level PCI controls and then assess a random sample of PCIFs.

Subtask 4.4: Prepare the assessment report.

Responsibility: Assessor

Guidance: The assessment report contains— (i) the results of the assessment; (ii) recommendations for correcting deficiencies; and (iii) the residual risk to the organization if those deficiencies are not corrected or mitigated. The assessment report is the Assessor’s statement of the results of analyzing and evaluating the PCI’s implementation of controls. The sample assessment report template in Appendix E should be used as a format for documenting the results after assessing the PCI controls.

Task 5: Assessment Documentation This task consists of the Assessor submitting the assessment report to the OIMO and the latter adding the PCI operations plan (revised if necessary) and the corrective actions plan (CAP) to generate an accreditation submission package for the DAA. In situations where the assessment report contains deficiencies, the OIMO may choose to address some deficiencies based on the recommendations by the Assessor and revise the PCI operations plan (if needed), even before submitting the package for accreditation.

Subtask 5.1: Provide the OIMO with the assessment report.

Responsibility: Assessor

Guidance: The OIMO relies on the expertise, experience, and judgment of the Assessor to: (i) provide recommendations on how to correct deficiencies in the planned or performed operations; and (ii) to understand the potential impacts of those deficiencies. The OIMO may choose to act on selected recommendations of the Assessor before the accreditation package is finalized. To optimize the utilization of resources organization-wide, any actions taken by the OIMO prior to the final accreditation decision must be coordinated with the DAA. The Assessor reviews any changes made in response to the corrective actions and revises the assessment report, as appropriate.

Subtask 5.2: Revise the PCI operations plan (if necessary) and implement its new provisions.

Responsibility: OIMO

Guidance: The revised PCI operations plan must include all changes made in response to recommendations for corrective actions from the Assessor.

Subtask 5.3: Prepare the corrective actions plan (CAP).

Responsibility: OIMO

Guidance: The CAP, one of the three primary documents in the accreditation submission package, describes actions that must be taken by the OIMO to correct deficiencies identified in the Assessment phase. The CAP identifies— (i) the tasks to be accomplished; (ii) the resources required to accomplish the tasks; (iii) scheduled completion dates for the tasks, and (iv) the person designated as responsible for completing each of the tasks.

Subtask 5.4: Assemble the accreditation submission package and submit to the DAA.

Responsibility: OIMO

Guidance: The OIMO is responsible for the assembly and compilation of the accreditation submission package with inputs from the OIMO. The accreditation submission package shall contain: (i) the final assessment report; (ii) the CAP; (iii) the revised PCI operations plan; and (iv) the SP 800-37 accreditation letters for all information systems within the PCI. The OIMO may wish to consult other key organization participants (e.g., the Assessor, PO) prior to submitting the accreditation submission package to the DAA. The accreditation submission package can be submitted in either paper or electronic form. The contents of the accreditation submission package must be protected in accordance with organization policy.

5.3 Accreditation Phase

The Accreditation Phase consists of two tasks— (i) making an appropriate accreditation decision; and (ii) completing the accreditation documentation. Upon completion of this phase, the OIMO will have— (i) an authorization to operate the PCI services as defined in its operations plan; (ii) an interim authorization to operate under specific terms and conditions; or (iii) a denial of authorization to operate. Task 6: Accreditation Decision The accreditation decision task determines if the assessment phase has been satisfactorily completed so that a recommendation concerning the operation of the PCI can be made with assurance. The DAA, working with the Assessor, reviews the contents of the assessment submission package, the identified and uncorrected or un-correctable deficiencies, the potential impacts on each organization using the PCI’s services, and the CAP in determining the final risk to the organization(s) and the acceptability of that risk in light of the organization’s mission.

Subtask 6.1: Review the assessment decision package to see if it is complete and that all applicable PCI controls have been fully assessed using the designated assessment procedures.

Responsibility: DAA

Guidance: Coverage for all PCI controls and proper adherence to assessment procedures and appropriate assessment methods helps to create confidence in assessment findings and is the main objective of the assessment review. Part of the assessment review also includes understanding the impact of the identified deficiencies on the organization’s operations, assets, and individuals.

Subtask 6.2: Determine if the risk to the organization’s operations, assets, or potentially affected individuals is acceptable, and arrive at an accreditation decision.

Responsibility: DAA

Guidance: After the completion of the assessment review, the DAA has a clear understanding of the impact of deficiencies. This helps the DAA to judge which deficiencies are of greatest concern to the organization and which can be tolerated without creating unreasonable organization-level risk. The CAP is also considered in determining the risk to the organization in terms of when and how the OIMO intends to address the known deficiencies. The DAA may consult the OIMO, Assessor, or other organization officials before completing the final risk evaluation. This risk evaluation in turn determines the degree of acceptability of PCI operations. The logic for using the latter as the basis for an accreditation decision is described in Section 2.9.

Task 7: Accreditation Documentation The accreditation documentation task includes— (i) completing and transmitting the accreditation decision package to the appropriate individuals and organizations; and (ii) updating the PCI’s operations plan. Subtask 7.1: Provide copies of the accreditation decision package, in either paper or electronic form, to the OIMO and any other organization officials having interests, roles, or responsibilities in the PCI.

Responsibility: DAA

Guidance: The accreditation decision package, including the accreditation decision letter, should be transmitted to the OIMO. Upon receipt of the accreditation decision package, the OIMO must review the authorization and its terms and conditions. The original accreditation decision package must be kept on file by the OIMO. The DAA shall retain copies of the contents of the accreditation decision package. The accreditation decision package must be appropriately safeguarded and stored, whenever possible, in a centralized organization filing system to ensure accessibility. The accreditation decision package shall be available to authorized auditors and oversight organizations upon request. The accreditation decision package must be retained in accordance with the organization’s records retention policy. The PCI and specific facilities are accredited for a maximum of three (3) years from the date of the ATO. After the period ends, re-accreditation must be performed.

Subtask 7.2: Update the PCI’s operations plan.

Responsibility: OIMO

Guidance: The operations plan must be updated to reflect all changes made as the result of assessment and accreditation. All conditions of PCI operations that are set forth in the accreditation decision must also be noted in the plan.

5.4 Monitoring Phase

The Monitoring Phase consists of two tasks— (i) operations plan maintenance; and (ii) annual lifecycle walkthrough. Based on the importance of reliably creating and issuing PIV Cards, it is imperative that once the accreditation is completed, the PCI is monitored to ensure that policies, procedures, and processes remain in effect as originally intended. There can be significant changes in a PCI’s policies, management, operations personnel, and available technology during a three-year ATO. These changes must be monitored so that the organization minimizes exposing itself to security and privacy threats existing or arising in the PCI. For example, if there is a significant staff turnover in the PCI, the organization must be sure that the new PCI staff is enrolling applicants and issuing cards using the same reliable processes that were previously approved.

In order to facilitate the monitoring of a PCI without undue burden in activities and paperwork, only two activities are required during this phase: maintenance of the operations plan and an annual lifecycle walkthrough of PCI operations. The latter entails reviewing all the services and functions of a PCI and its facilities for continued reliability. The annual walkthrough must cover a PIV Card’s lifecycle from sponsorship to maintenance. Observation of the full lifecycle of a card ensures that all processes are still reliably operating as assessed during the accreditation. Task 8: Operations Plan Update A PCI’s operations plan is the primary description of what and how PIV Card issuing services are provided. It is essential that this document be updated as changes occur in the PCI’s operations. The PCI management will be able to analyze the impact of changes as they occur and will be significantly better prepared when re-accreditation is required.

Subtask 8.1: Document all relevant changes in the PCI within the operations plan.

Responsibility: OIMO

Guidance: In addition to the policies, procedures, and processes that must be documented if changes are made, the organization shall update the operations plan if changes to the PCI information system, the PIV Card, privacy policies, roles and responsibilities, or PCI controls are made.

Subtask 8.2: Analyze the proposed or actual changes to the PCI and determine the impact of such changes.

Responsibility: OIMO

Guidance: If the results of the impact analysis indicate that changes to the PCI could affect the reliability of the PCI’s operations, the changes and impact on the PCI must be reported to the DAA, corrective actions must be initiated, and the CAP must be updated. In instances where major changes have occurred, the PCI must be re-accredited.

Task 9: Annual Lifecycle Walkthrough The annual lifecycle walkthrough is a monitoring activity to be performed initially by the PCI when its PIV Card issuing services begin, and annually thereafter. The OIMO (or designated appointee) is responsible for observing and reviewing the entire lifecycle of a PIV Card. This walkthrough should provide an accurate snapshot of the PCI’s operations and reliability at a point in time. By walking through the PIV Card lifecycle, from sponsorship to issuance, including maintenance, the operations of the PCI can be examined as an integrated entity. During the walkthrough, the OIMO (or designated appointee) shall observe all processes involving the PIV Card, comparing them against the requirements defined in the PCI controls. This activity shall be performed every year after each accreditation until re-accreditation begins. All identified deficiencies in reliable operations shall be sent to the DAA for review and analysis. Any potential impact to the reliability of the PCI’s operations and risk to the organization shall be documented and presented to the OIMO and the DAA.

Subtask 9.1: Observe all the processes involved in getting a PIV Card, including those from sponsorship to maintenance. Observe each process and compare its controls against the applicable list of required PCI controls. If a PCI has several facilities, this process should be repeated using randomly selected PCIFs. Responsibility: OIMO (or designated appointee)

Guidance: As part of the walkthrough, the OIMO (or designated appointee) observes the processes followed for new employees and contractors (if different) as well as PIV Card maintenance processes, such as card termination, reissuance, or renewals. The OIMO (or designated appointee) observes each process and compares it against the documented steps for the PCI and the associated PCI controls. An annual walkthrough is required until re-accreditation is initiated.

Subtask 9.2: The results of the lifecycle walkthrough are summarized in a report to the DAA. Deficiencies must be highlighted, along with corrective actions that must be implemented to correct any deficiencies.

Responsibility: OIMO, DAA

Guidance: The OIMO (or designated appointee) shall document the results of the walkthrough. The results shall be recorded in the assessment report template included in Appendix E. All deficiencies should be highlighted, and a plan for correcting each deficiency shall be documented. The DAA shall decide if any deficiency is significant enough to require a change of the PCI’s authorization-to- operate status.The Assessment report contains the results of the assessment in a format that facilitates reviewing by the DAO. The DAO must evaluate the information in the Assessment Report in order to make a sound, credible decision regarding the residual risk of authorizing the operations of the issuer.

An Assessment Report template is provided in Appendix E . The report is organized by Authorization Focus Area. For each issuer control, it must be documented as to which entity is responsible for the implementation of that control (the organization or an external service provider) and if the issuer control is at the organizational or facility level.

Activation/Issuance Process

Issuer Control Identifier— AI-7

Control Description— Before the PIV Card is provided to the applicant, the issuer performs a 1:1 biometric match of the applicant against biometrics available on the PIV Card or in the chain-of-trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data that are available. If the match is unsuccessful, or if no biometric data is available, the cardholder provides two identity source documents (as specified in FIPS 201-2, Section 2.7), and an attending operator inspects these and compares the cardholder with the facial image printed on the PIV Card.

Control Owner/ Control Level — External Service Provider/Facility Level

ASSESSMENT DETAILS

Assessment Method(s):

Review: Operations Plan

Observe: Activation/Issuance Process

Assessment Result— Partially Satisfied

Assessment Findings— There is operational evidence that a 1:1 biometric match is carried out before the card is released to the applicant.

Assessment Deficiency and Potential Impact— The requirement to carry out this task is not documented clearly enough in the operations plan. Although personnel are knowledgeable about this requirement, and the task was observed to be performed correctly during card issuance, the lack of documentation could be a problem if there is turnover in staff. Alternate processes when fingerprints are unavailable are not in place.

Recommendation— Update the issuance process description within the operations plan to include a clear description of this task in the process and develop alternate processes for issuance when fingerprints are not available.

Figure 4 - Sample Issuer Control Assessment Result (for PCI)

The assessment result for each issuer control shall be one of the following:  Satisfied  Partially Satisfied  Not Satisfied  Not Applicable After carrying out an assessment procedure, the Assessor records his/her conclusion in one of two ways: MET, NOT MET. Using the list of conclusions pertaining to assessment procedures associated with an issuer control, the assessment result (which is one of the 4 outcomes listed above) is arrived at as follows:

 If the conclusion from all assessment procedures is MET, then the assessment result for the issuer control is “Satisfied”

 If some of the conclusions are NOT MET, then the assessment result for the issuer control is marked as either “Partially Satisfied” or “Not Satisfied”, depending on whether or not any of the underlying tasks in the assessment procedures are critical (i.e., they represent the only way to meet the issuer control’s objective). An example of an assessment that resulted in “Partially Satisfied” is given in Figure 4 . In this instance, there is an awareness of a task requirement, and the task itself is being carried out, but the reference to the task is missing in the document.

In drawing a conclusion after carrying out an assessment procedure, the Assessor must consider the potential subjective and objective aspects of the assessment methods used (e.g., interviews, document reviews, observations, and tests) for that assessment procedure. Deficiencies that result in “Partially Satisfied” or “Not Satisfied” must be reported by the Assessor. The Assessor must also outline the potential adverse impacts if the issuer control is deployed with the identified deficiencies.

The assessment report template provides the means for recording the assessment result for each issuer control. The assessment results for all issuer controls are aggregated to generate the assessment result for an Issuer Authorization Focus area. The set of Issuer Authorization Focus Area results are aggregated to generate Issuer Authorization Topic results. Finally, the group of Issuer Authorization Topic results is used to generate the overall Issuer Assessment Report and an accompanying Executive Summary (intended for Senior Management). 5.0 A SSESSMENT & A UTHORIZATION L IFECYCLE

The authorization of a PIV Card Issuer (PCI) or a Derived PIV Credential Issuer (DPCI) consists of four phases: (i) Initiation; (ii) Assessment; (iii) Authorization; and (iv) Monitoring. Each phase consists of tasks and sub-tasks that are to be carried out by the responsible officials (e.g., the Designated Authorizing Official (DAO), Assessor, Organization Identity Management Official (OIMO), and Issuing Facility Manager(s)). Figure 5 provides a view of the authorization phases, including the tasks associated with each phase. A table of authorization phases, tasks, sub-tasks, and the official responsible for each is provided in Appendix H .

5.1 Initiation Phase

The Initiation Phase consists of three tasks: (i) preparation; (ii) resource identification; and (iii) operations plan analysis and acceptance. The primary purpose of this phase is to ensure that the issuer is prepared for the assessment, including having all the resources and documentation in place. The other purpose of this phase is to include the DAO early in the process in order to assure success of the assessment and authorization.

Task 1: Preparation The objectives of this task are to prepare for authorization by reviewing the operations plan and confirming that the plan is consistent with [FIPS201-2] and the template provided in Appendix D . INITIATION PHASE

ASSESSMENT PHASE

AUTHORIZATION PHASE

MONITORING PHASE  Preparation  Resource Identification  Operations Plan Analysis and Acceptance

 Issuer Control Assessment  Assessment Documentation

 Authorization Decision  Authorization Documentation

 Operations Plan Update  Annual Lifecycle Walkthrough

Figure 5 - Assessment & Authorization Lifecycle Phases Subtask 1.1: Confirm that the operations of the issuer have been fully described and documented in their operations plan. Responsibility: OIMO Guidance: The operation plan includes, at a minimum, the sections defined in the operations plan template in Appendices D.1 or D.2 depending on whether the issuer is issuing PIV Cards or Derived PIV Credentials. An issuer of both PIV Cards and Derived PIV Credentials may develop a single operations plan that addresses both without repeating common elements. It is the OIMO’s responsibility to ensure that the organization’s operations plan incorporates a complete and accurate description of the issuer’s operations. If a process or function is provided by an external service provider, their operating procedures should be documented and incorporated by reference in the issuer’s operations plan. In this case, the operations plan includes a pointer, guiding the reader to additional documentation and information.

Subtask 1.2: Confirm that processes performed are conducted in accordance with the policies and procedures specified in the issuer’s operations plan and are documented in standard operating procedures. Responsibility: OIMO, Issuing Facility Manager Guidance: Even though an issuer may be following requirements from FIPS 201-2, their processes need to be consistent within their operations plan and documented in standard operating procedures.

Task 2: Resource Identification The objectives of the resource identification task are to– (i) identify and document the resources required for assisting with the assessment; (ii) identify the scope of the assessment and authorization boundary; and (iii) prepare a plan of assessment activities indicating the proposed schedule and key milestones.

Subtask 2.1: Identify the Senior Authorizing Official (SAO), Designated Authorizing Official (DAO), Privacy Official (PO), Issuing Facility Managers, Assessor, and other key personnel at the facility level who are performing functions, such as identity proofing/registration, card production, and activation/issuance. Maintenance personnel also should be contacted to provide requested assessment information to the Assessor. Responsibility: OIMO Guidance: Notify these individuals of the upcoming assessment, and inform them of the need for their participation during the process.

Subtask 2.2: Determine the authorization boundary for the issuer. Responsibility: OIMO; DAO Guidance: The authorization boundary determines the target of the assessment. In preparation for the issuer assessment, the OIMO and DAO should identify which issuing facilities and external service providers are to be included. This ensures that functions performed and processes managed by the external service provider are considered during the authorization process. An organization may want to include only those issuing facilities that are ready to operate; other facilities can be assessed at a later date.

Subtask 2.3: Determine the resources and the time needed for the assessment of the issuer, and prepare a plan for execution of the assessment. Responsibility: OIMO; DAO Guidance: The level of effort required for an assessment depends on numerous factors— (i) the size of the issuer; (ii) the location and number of its facilities; (iii) the level of outsourcing utilized by the issuer; and (iv) the number of cards and/or derived credentials being, or to be issued. By examining factors that could influence the complexity of the assessment, the organization can make informed judgments about the size of the assessment team, the resources needed to support the assessment, and the time-frame for completing it.

Task 3: Operations Plan Analysis and Acceptance The objectives of the operations plan analysis and acceptance task are: (i) determine if the requirements of FIPS 201-2 have been implemented; (ii) evaluate the operations plan and revise as needed; and (iii) obtain acceptance of the plan by the DAO prior to conducting an assessment of the issuer controls.

Subtask 3.1: Review the list of required issuer controls documented in the organization’s operation plan and then confirm that they have been implemented properly. Responsibility: DAO; OIMO Guidance: Since the issuer controls serve as the basis for the assessment, review the operations plan and supporting documentation to identify the controls that must be implemented before investing time in assessment activities such as interviews or testing. The operations plan must document each issuer control, whether it is organization or facility specific, the owner of the issuer control, and how the control is implemented.

Subtask 3.2: Analyze the operations plan to determine if there are deficiencies in satisfying all the policies, procedures, and other requirements in FIPS 201-2 that could result in a Denial of Authorization to Operate (DATO) being issued. After discussing the discovered deficiencies in the documentation and operations plan with the OIMO, the organization may still want to continue with the assessment, if it has determined that it can address all deficiencies within the time period of the current assessment. In this situation, the DAO can either authorize continuation of the assessment or terminate the assessment effort depending upon the evaluation of the issuer’s ability to address the deficiencies. Responsibility: DAO, OIMO Guidance: The operations plan should adequately specify the policies, procedures, and processes of the issuer so that, subsequent to an initial review, deficiencies that could lead to an eventual DATO may be identified and remediated as soon as possible.

Subtask 3.3: Verify that the operations plan is acceptable. Responsibility: DAO Guidance: If the operations plan is deemed acceptable, the DAO should authorize the authorization processes to advance to the next phase. Acceptance of the operations plan signifies that the resources required to initiate and complete the authorization activities may be deployed.

5.2 Assessment Phase

The Assessment Phase consists of two tasks— (i) issuer control assessment; and (ii) assessment documentation. The purpose of this phase is to determine the extent to which the requirements of FIPS 201-2 are implemented correctly, operating as intended, and producing the desired outcomes. This phase also specifies actions to be taken to correct all identified deficiencies. An analysis of the impact of identified deficiencies that cannot be corrected or mitigated efficiently on the reliable operation of the issuer should be conducted and documented. Successful completion of this phase should provide the DAO with the information needed to make an appropriate authorization decision.

Task 4: Issuer Control Assessment The objectives of this task are to— (i) initiate and conduct an assessment of the issuer controls; and (ii) document the results of the assessment. The Assessor shall first verify the acceptability of all documentation, including the operations plan and previous assessments, along with all relevant Federal laws, regulations, standards, and directives. Issuer control assessment should then commence. The Assessor should schedule interviews, schedule real-time observations of issuance processes, and initiate all needed testing of the PIV Card, Derived PIV Credential and relevant information system components. Once the Assessor has gathered the results of the assessment procedures, descriptions of all discovered deficiencies shall be prepared, along with recommendations for removing these deficiencies.

Subtask 4.1: Review the suggested and selected assessment methods for each issuer control in preparation for the assessment. Responsibility: Assessor Guidance: Based on the authorization boundary, the scope of the assessment should be established. The Assessor should review the selected assessment procedures (based on the scope of the assessment) in order to plan and coordinate activities for the assessment. For instance, if a particular issuer control requires the observation of a particular process, the Assessor will need to schedule this activity in a timely fashion after coordinating it with the issuing facility management. The Assessor, as directed by the DAO, may supplement the assessment methods and procedures recommended in these guidelines. Assessment methods and procedures may be created or tailored for a particular issuer. Subtask 4.2: Assemble all documentation and supporting materials necessary for the assessment of the issuer; if these documents include previous assessments, review the findings and determine if they are applicable to the current assessment. Responsibility: OIMO; Assessor Guidance: The OIMO assists the Assessor in gathering all relevant documents and supporting materials from the organization that will be required during the assessment of the issuer. Central to this effort is the operations plan. The issuer’s operations shall be completely described in the operations plan. The operations plan may include by reference, or point to, the supporting materials. In this case, the OIMO will also need to gather this supporting material for the Assessor. Examples of other documentation include: (i) letters of appointment; (ii) privacy- related documentation; (iii) information forms utilized by the issuer; (iv) documentation from each outsourced service provider, including control implementation specifics, support and service level agreements, and contracts; (v) standard operating procedures for the issuing facilities within the authorization boundary is; and (vi) signed authorization letters under [SP 800-37-1] for all information systems. When previous assessments exist, including the one on which the current Authorization to Operate (ATO) is based, the Assessor is strongly encouraged to review these results. The Assessor may satisfy some of the issuer control assessment requirements by reviewing and referencing previous assessment report(s). Although previous assessments cannot be used as a substitute for the current assessment, they provide a snapshot view of the issuer and highlight problems that may have existed in the past.

Subtask 4.3: Assess the required issuer controls using the prescribed assessment procedures found in Table G.1 and Table G.2 based on the scope of the issuance functions. Responsibility: Assessor Guidance: The Assessor performs the assessment procedures selected for each issuer control to assess if they have been implemented correctly, are operating as intended, and producing the desired outcomes. The Assessor uses the assessment methods specified in Section 4.1 . Documentation collected in the previous task is reviewed, and any deficiencies are identified. Interviews can be used as an opportunity to clarify issues encountered during a review of the issuer’s documentation, as well as to determine the expertise of the personnel performing key PIV functions. Processes need to be observed to ensure that they are being followed as documented and tests executed to determine if the PIV components have been configured and are operating in a PIV-compliant manner. As part of an assessment all applicable issuer controls need to be assessed. If PIV services have been outsourced to an external provider, the Assessor shall verify that the issuer controls applying to those services have been assessed, and the reliability of the service provider has been found satisfactory. If an issuer and its facilities have already been assessed and are operating under a current ATO, and the purpose of the assessment is to add a facility(s) to the authorization letter, the Assessor may reuse the results of a previous assessment for the organization level issuer controls and then assess a random sample of the new issuing facilities.

Subtask 4.4: Prepare the assessment report. Responsibility: Assessor Guidance: The assessment report contains— (i) the results of the assessment; (ii) recommendations for correcting deficiencies; and (iii) the residual risk to the organization if those deficiencies are not corrected or mitigated. The assessment report is the Assessor’s statement of the results of analyzing and evaluating the issuer’s implementation of controls. The sample assessment report template in Appendix E should be used as a format for documenting the results after assessing the issuer controls.

Task 5: Assessment Documentation This task consists of the Assessor submitting the assessment report to the OIMO and the latter adding the issuer’s operations plan (revised if necessary) and the corrective actions plan (CAP) to generate an authorization submission package for the DAO. In situations where the assessment report contains deficiencies, the OIMO may choose to address some deficiencies based on the recommendations by the Assessor and revise the operations plan (if needed), even before submitting the package for authorization.

Subtask 5.1: Provide the OIMO with the assessment report. Responsibility: Assessor Guidance: The OIMO relies on the expertise, experience, and judgment of the Assessor to: (i) provide recommendations on how to correct deficiencies in the planned or performed operations; and (ii) to understand the potential impacts of those deficiencies. The OIMO may choose to act on selected recommendations of the Assessor before the authorization package is finalized. To optimize the utilization of resources organization-wide, any actions taken by the OIMO prior to the final authorization decision must be coordinated with the DAO. The Assessor reviews any changes made in response to the corrective actions and revises the assessment report, as appropriate.

Subtask 5.2: Revise the operations plan (if necessary) and implement its new provisions. Responsibility: OIMO Guidance: The revised operations plan must include all changes made in response to recommendations for corrective actions from the Assessor.

Subtask 5.3: Prepare the corrective actions plan (CAP). Responsibility: OIMO Guidance: The CAP, one of the three primary documents in the authorization submission package, describes actions that must be taken by the OIMO to correct deficiencies identified in the Assessment phase. The CAP identifies— (i) the tasks to be accomplished; (ii) the resources required to accomplish the tasks; (iii) scheduled completion dates for the tasks, and (iv) the person designated as responsible for completing each of the tasks.

Subtask 5.4: Assemble the authorization submission package and submit to the DAO. Responsibility: OIMO Guidance: The OIMO is responsible for the assembly and compilation of the authorization submission package with inputs from the OIMO. The authorization submission package shall contain: (i) the final assessment report; (ii) the CAP; (iii) the revised operations plan; and (iv) the [SP 800-37-1] authorization letters for all information systems used by the issuer. The OIMO may wish to consult other key organization participants (e.g., the Assessor, PO) prior to submitting the authorization submission package to the DAO. The authorization submission package can be submitted in either paper or electronic form. The contents of the authorization submission package must be protected in accordance with organization policy.

5.3 Authorization Phase

The Authorization Phase consists of two tasks— (i) making an appropriate authorization decision; and (ii) completing the authorization documentation. Upon completion of this phase, the OIMO will have— (i) an authorization to operate the issuer’s services as defined in its operations plan; (ii) an interim authorization to operate under specific terms and conditions; or (iii) a denial of authorization to operate.

Task 6: Authorization Decision The authorization decision task determines if the assessment phase has been satisfactorily completed so that a recommendation concerning the operation of the issuer can be made with assurance. The DAO, working with the Assessor, reviews the contents of the assessment submission package, the identified and uncorrected or un-correctable deficiencies, the potential impacts on each organization using the issuer’s services, and the CAP in determining the final risk to the organization(s) and the acceptability of that risk in light of the organization’s mission.

Subtask 6.1: Review the authorization decision package to see if it is complete and that all applicable issuer controls have been fully assessed using the designated assessment procedures. Responsibility: DAO Guidance: Coverage for all issuer controls and proper adherence to assessment procedures and appropriate assessment methods helps to create confidence in assessment findings and is the main objective of the assessment review. Part of the assessment review also includes understanding the impact of the identified deficiencies on the organization’s operations, assets, and individuals. Subtask 6.2: Determine if the risk to the organization’s operations, assets, or potentially affected individuals is acceptable. Responsibility: DAO Guidance: After the completion of the assessment review, the DAO has a clear understanding of the impact of deficiencies. This helps the DAO to judge which deficiencies are of greatest concern to the organization and which can be tolerated without creating unreasonable organization-level risk. The CAP is also considered in determining the risk to the organization in terms of when and how the OIMO intends to address the known deficiencies. The DAO may consult the OIMO, Assessor, or other organization officials before completing the final risk evaluation. This risk evaluation in turn determines the degree of acceptability of issuer operations. The logic for using the latter as the basis for an authorization decision is described in Section 2.9 .

Subtask 6.3: Provide the authorization package to an independent party for review and arrive at an authorization decision. Responsibility: DAO Guidance: Before providing the final authorization decision, the DAO seeks an independent review of the risks involved its issuer operations. The DAO shares the results of the assessment and the perceived risks with another issuer (e.g., another agency that issues PIV Cards or Derived PIV Credentials) to get their opinion and establish trustworthiness in the issued credentials.

Task 7: Authorization Documentation The authorization documentation task includes— (i) completing and transmitting the authorization decision package to the appropriate individuals and organizations; and (ii) updating the issuer’s operations plan.

Subtask 7.1: Provide copies of the authorization decision package, in either paper or electronic form, to the OIMO and any other organization officials having interests, roles, or responsibilities in the issuer’s operations. Responsibility: DAO Guidance: The authorization decision package, including the authorization decision letter, should be transmitted to the OIMO. Upon receipt of the authorization decision package, the OIMO must review the authorization and its terms and conditions. The original authorization decision package must be kept on file by the OIMO. The DAO shall retain copies of the contents of the authorization decision package. The authorization decision package must be appropriately safeguarded and stored, whenever possible, in a centralized organization filing system to ensure accessibility. The authorization decision package shall be available to authorized auditors and oversight organizations upon request. The authorization decision package must be retained in accordance with the organization’s records retention policy. The issuer and specific facilities are authorized for a maximum of three (3) years from the date of the ATO. After the period ends, re-authorization must be performed. Subtask 7.2: Update the operations plan. Responsibility: OIMO Guidance: The operations plan must be updated to reflect all changes made as the result of assessment and authorization. All conditions of issuer’s operations that are set forth in the authorization decision must also be noted in the plan.

5.4 Monitoring Phase

The Monitoring Phase consists of two tasks— (i) operations plan maintenance; and (ii) annual lifecycle walkthrough. Based on the importance of reliably creating and issuing PIV Cards and Derived PIV Credentials, it is imperative that once the authorization is completed, the issuer is monitored to ensure that policies, procedures, and processes remain in effect as originally intended. There can be significant changes in an issuer’s policies, management, operations personnel, and available technology during a three-year ATO. These changes must be monitored so that the organization minimizes exposing itself to security and privacy threats existing or arising after the authorization. For example, if there is a significant staff turnover, the organization must be sure that the new staff is performing the PIV functions using the same reliable processes that were previously approved. The overall responsibility for monitoring lies with the OIMO and the DAO.

In order to facilitate the monitoring of an issuer without undue burden in activities and paperwork, only two activities are required during this phase: maintenance of the operations plan and an annual lifecycle walkthrough of issuer operations. The latter entails reviewing all the services and functions of an issuer and its facilities for continued reliability. The annual walkthrough must cover a PIV Card’s and/or Derived PIV Credential’s lifecycle from sponsorship to maintenance. Observation of the full lifecycle ensures that all processes are still reliably operating as assessed during the authorization.

Task 8: Operations Plan Update An operations plan is the primary description of what and how PIV Card and/or Derived PIV Credential issuing services are provided by the issuer. It is essential that this document be updated as changes occur in the issuer’s operations. Management will be able to analyze the impact of changes as they occur and will be significantly better prepared when re-authorization is required.

Subtask 8.1: Document all relevant changes in the issuance processes within the operations plan. Responsibility: OIMO Guidance: In addition to the policies, procedures, and processes that must be documented if changes are made, the organization shall update the operations plan if changes to the information system, the PIV Card, Derived PIV Credential, privacy policies, roles and responsibilities, or issuer controls are made. Subtask 8.2: Analyze the proposed or actual changes to the issuer and determine the impact of such changes. Responsibility: OIMO Guidance: If the results of the impact analysis indicate that changes to the issuer could affect the reliability of its operations, the changes and impact on the issuer must be reported to the DAO, corrective actions must be initiated, and the CAP must be updated. In instances where major changes have occurred, the issuer must be re-authorized.

Task 9: Annual Lifecycle Walkthrough The annual lifecycle walkthrough is a monitoring activity to be performed initially by the issuer when its PIV Card and/or Derived PIV Credential issuing services begin, and annually thereafter. The OIMO (or designated appointee) is responsible for observing and reviewing the entire lifecycle of the PIV Card and/or the Derived PIV Credential. This walkthrough should provide an accurate snapshot of the issuer’s operations and reliability at a point in time. By walking through the lifecycle, from sponsorship to issuance, including maintenance, the operations of an issuer can be examined as an integrated entity. During the walkthrough, the OIMO (or designated appointee) shall observe all processes involving the PIV Card or Derived PIV Credential, comparing them against the requirements defined in the issuer controls. This activity shall be performed every year after each authorization until re- authorization begins. All identified deficiencies in reliable operations shall be sent to the DAO for review and analysis. Any potential impact to the reliability of the issuer’s operations and risk to the organization shall be documented and presented to the OIMO and the DAO.

Subtask 9.1: Observe all the processes involved in getting a PIV Card or a Derived PIV Credential, including those from sponsorship to maintenance. Observe each process and compare its controls against the applicable list of required issuer controls. If an issuer has several facilities, this process should be repeated using randomly selected issuing facilities. Responsibility: OIMO (or designated appointee) Guidance: As part of the walkthrough, the OIMO (or designated appointee) observes the processes followed for new employees and contractors (if different) as well any maintenance processes, such as termination, reissuance, or renewals. The OIMO (or designated appointee) observes each process and compares it against the documented steps for the issuer and the associated issuer controls. An annual walkthrough is required until re-authorization is initiated. Subtask 9.2: The results of the lifecycle walkthrough are summarized in a report to the DAO. Deficiencies must be highlighted, along with corrective actions that must be implemented to correct any deficiencies. Responsibility: OIMO, DAO Guidance: The OIMO (or designated appointee) shall document the results of the walkthrough. The results shall be recorded in the assessment report template included in Appendix E . All deficiencies should be highlighted, and a plan for correcting each deficiency shall be documented. The DAO shall decide if any deficiency is significant enough to require a change of the issuer’s authorization- to-operate status. A PPENDIX A: R EFERENCES

[FIPS140-2] Federal Information Processing Standard 140-2, Security Requirements for Cryptographic Modules , May 25, 2001 (with Change Notices through 12/3/2002), http://csrc.nist.gov/publications/PubsFIPS.html . [FIPS199] Federal Information Processing Standard 199, Standards for Security Categorization of Federal Information and Information Systems , February 2004, http://csrc.nist.gov/publications/PubsFIPS.html . [FIPS200] Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems , March 2006, http://csrc.nist.gov/publications/PubsFIPS.html . [FIPS201-2] Federal Information Processing Standard 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors , August 2013. http://dx.doi.org/10.6028/NIST.FIPS.201-2 . [HSPD-12] HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors , August 27, 2004, http://www.dhs.gov/homeland-security-presidential-directive- 12 . [NIST IR 7817] NIST Interagency Report 7817, A Credential Reliability and Revocation Model for Federated Identities , November 2012), http://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7817.pdf . [M-05-24] Office of Management and Budget, M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors , August 5, 2005, [M-06-06] Office of Management and Budget, M-06-06, Sample Privacy Documents for Agency Implementation of Homeland Security Presidential Directive (HSPD) 12 , February 17, 2006, https://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-06.pdf. [M-07-06] Office of Management and Budget, M-07-06, Validating and Monitoring Agency Issuance of Personal Identity Verification Credentials January 11, 2007, https://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2007/m07-06.pdf. [SP800-37] Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach , February 2010 (updated 6/5/2014), http://dx.doi.org/10.6028/NIST.SP.800-37r1 . [SP800-53] Special Publication 800-53 Revision 4, Recommended Security and Privacy Controls for Federal Information Systems and Organizations , April 2013 (updated 1/22/2015), http://dx.doi.org/10.6028/NIST.SP.800-53Ar4 . [SP800-63-2] Special Publication 800-63-2, Electronic Authentication Guideline, August 2013, http://dx.doi.org/10.6028/NIST.SP.800-63-2 [SP800-59] Special Publication 800-59, Guideline for Identifying an Information System as a National Security System , August 2003, http://csrc.nist.gov/publications/PubsSPs.html . [SP800-73-4] Special Publication 800-73-4, Interfaces for Personal Identity Verification , 3 parts, May 2015, http://dx.doi.org/10.6028/NIST.SP.800-73-4 . [SP800-76-2] Special Publication 800-76-2, Biometric Specifications for Personal Identity Verification , July 2013, http://dx.doi.org/10.6028/NIST.SP.800-76-2 . [SP800-78-4] Special Publication 800-78-4, Cryptographic Algorithms and Key Sizes for Personal Identity Verification , May 2015, http://dx.doi.org/10.6028/NIST.SP.800-78-4 .

[SP800-157] Special Publication 800-157, Guidelines for Derived Personal Identity Verification (PIV) Credentials , December 2014, http://dx.doi.org/10.6028/NIST.SP.800-157 [SPRINGER MEMO] Office of Personnel Management, Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12 , July 31, 2008, http://www.opm.gov/investigate/resources/final_credentialing_standards.pdf . A PPENDIX B: G LOSSARY AND A CRONYMS

this document Definition or explanation of term s ; expansion of acronym s Access Control The process of granting or denying specific requests to: (i) obtain and use information and related information processing services; and (ii) enter specific physical facilities (e.g., Federal buildings, military establishments, and border-crossing entrances). Authorization (as applied to an issuer) The official management decision of the Designated Authorizing Official to permit operation of an issuer after determining that the issuer’s reliability has satisfactorily been established through appropriate assessment processes. Authorization Package The results of assessment and supporting documentation provided to the Designated Authorizing Official to be used in the authorization decision process. Agency An executive department specified in 5 U.S.C., Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); or a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91. Applicant An individual applying for a PIV Card. Assessment (as applied to an issuer) Assessment in this context means a formal process of assessing the implementation and reliable use of issuer controls using various methods of assessment (e.g., interviews, document reviews, observations) that support the assertion that an issuer is reliably meeting the requirements of [FIPS 201-2] . Assessment Method A focused activity or action employed by an Assessor for evaluating a particular issuer control. Assessment Procedure A set of activities or actions employed by an Assessor to determine the extent that an issuer control is implemented. Assessor The individual responsible for conducting assessment activities under the guidance and direction of a Designated Authorizing Official. The Assessor is a 3 rd party. ATO Authorization to Operate; One of three possible decisions concerning an issuer made by a Designated Authorizing Official after all assessment activities have been performed stating that the issuer is authorized to perform specific PIV Card and/or Derived Credential issuance services. CAP (Corrective Action Plan) Corrective actions for an issuer for removing or reducing deficiencies or risks identified by the Assessor during the assessment of issuer operations. The plan identifies actions that need to be performed in order to obtain or sustain authorization. Activation/Issuance A process that includes the procurement of FIPS-approved blank PIV Cards or hardware/software tokens (for Derived PIV Credential), initializing them using appropriate software and data elements, personalization of these cards/tokens with the identity this document Definition or explanation of term s ; expansion of acronym s credentials of authorized subjects, and pick-up/delivery of the personalized cards/tokens to the authorized subjects, along with appropriate instructions for protection and use. Component An element such as a fingerprint capture station or card reader used by an issuer, for which [FIPS 201-2] has defined specific requirements. Credential An object or data structure that authoritatively binds an identity (and optionally, additional attributes) to a card or token possessed and controlled by a cardholder or subscriber. DAO Designated Authorizing Official; A senior organization official that has been given the authorization to authorize the reliability of an issuer. DATO Denial of Authorization to Operate; issued by a DAO to an issuer that is not authorized as being reliable for the issuance of PIV Cards or Derived PIV Credentials. Derived PIV Credential A credential issued based on proof of possession and control of the PIV Card, so as not to duplicate the identity proofing process as defined in [SP 800-63-2] . A Derived PIV Credential token is a hardware or software based token that contains the Derived PIV Credential. DPCI Derived PIV Credential (and associated token) Issuer; an issuer of Derived PIV Credentials as defined in [SP 800-63-2] and [SP 800- 157] . FIPS Federal Information Processing Standard HSPD-12 Homeland Security Presidential Directive; HSPD-12 established the policy for which FIPS 201-2 was developed. IATO Interim Authorization to Operate; issued by a DAO to an issuer who is not satisfactorily performing PIV Card and/or Derived PIV Credential specified services (e.g., identity proofing/registration (if applicable)), card/token production, activation/issuance and maintenance). Identification The process of discovering the true identity (i.e., origin, initial history) of a person or item from the entire collection of similar persons or items. Identifier Unique data used to represent a person’s identity and associated attributes. A name or a card number are examples of identifiers. Identity The set of physical and behavioral characteristics by which an individual is uniquely recognizable. Identity Proofing Verifying the claimed identity of an applicant by authenticating the identity source documents provided by the applicant. Issuer An entity that performs functions required to produce, issue, and maintain PIV Cards or Derived PIV Credentials for an organization Issuing Facility A physical site or location–including all equipment, staff, and documentation–that is responsible for carrying out one or more of this document Definition or explanation of term s ; expansion of acronym s the PIV functions. ITL Information Technology Laboratory

Maintenance The process of managing PIV Cards or Derived PIV Credentials (and its token) once they are issued. It includes re-issuance, post issuance updates, and termination. Mobile Device A mobile device, for the purpose of this document is a portable computing device that: (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on- board sensors that allow the devices to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, tablets, and e-readers. NIST National Institute of Standards and Technology OIMO Organization Identity Management Official; The individual responsible for overseeing the operations of an issuer in accordance with [FIPS 201-2] and for performing the responsibilities specified in this guideline. OMB Office of Management and Budget PCI PIV Card Issuer Information System A computer-based system used by an issuer to perform the functions necessary for PIV Card or Derived PIV Credential issuance as per [FIPS 201-2] . PII Personally Identifiable Information; Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. [E-Gov] PIV Personal Identity Verification as specified in [FIPS 201-2] . PIV Card The physical artifact (e.g., identity card, “smart” card) issued to an applicant by an issuer that contains stored identity markers or credentials (e.g., a photograph, cryptographic keys, digitized fingerprint representations) so that the claimed identity of the cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an automated process (computer readable and verifiable). PIV Credential Evidence attesting to one’s right to credit or authority; in [FIPS 201-2] . It is the PIV Card or Derived PIV Credential token and data elements associated with an individual that authoritatively binds an identity (and, optionally, additional attributes) to that individual. Risk The level of potential impact on an organization operations (including mission, functions, image, or reputation), organization this document Definition or explanation of term s ; expansion of acronym s assets, or individuals of a threat or a given likelihood of that threat occurring. Registration Making a person’s identity known to the enrollment/Identity Management System information system by associating a unique identifier with that identity, and collecting and recording the person’s relevant attributes into the information system. Registration is necessary in order to initiate other processes, such as adjudication, card/token personalization and issuance and, maintenance that are necessary to issue and to re-issue or maintain a PIV Card or a Derived PIV Credential token. SAO Senior Authorizing Official; A senior organization official that has budgetary control, provides oversight, develops policy, and has authority over all functions and services provided by the issuer. SOP Standard operating procedures SOR A system of records is a group of records under the control of a Federal agency which contains a personal identifier (such as a name, date of birth, finger print, Social Security Number, and Employee Number) and one other item of personal data (such as home address, performance rating, and blood type) from which information is retrieved using a personal identifier. SORN The Privacy Act requires each agency to publish a notice of its systems of records in the Federal Register. This is called a System of Record Notice (SORN). SP Special Publication Subscriber An individual applying for a Derived PIV Credential A PPENDIX C: I SSUER R EADINESS R EVIEW C HECKLIST

The readiness review checklist may be used by an issuer of PIV Cards or Derived PIV Credential tokens while preparing for assessment. The checklist may also be used to validate that the issuer has collected all relevant documentation, identified appropriate individuals and made them available to the assessment team.

Activity Completed Comments Identify a 3 rd party assessment team to assess the issuer. Determine the authorization boundary. Establish the scope and objectives of the assessment. Determine the level of effort and resources necessary to carry out the assessment. Establish the time-frame to complete the assessment and identify key milestone decision points. Notify key personnel at the issuing facility and any external service providers (if applicable) of the impending assessment. Validate that the operations plan is complete and includes all the required information. Ensure that the necessary roles have been designated. Validate that implementation and management responsibility for issuer controls have been accurately assigned. Make sure that the information systems utilized by the issuer have been assessed and authorization to operate in accordance with [SP 800-37-1] . Ensure that the following documentation has been developed and can be made available to the assessment team: (i) Operations plan (ii) Results from any past assessment and authorization decisions for the issuer (iii) Letters of appointment (if any) (iv) Service Level Agreements (SLA) and Memorandums of Understanding (MOU) between the organization and the service provider(s). (v) Listing of all HSPD-12 components used within the PIV system (vi) Privacy-related documentation (vii) All forms utilized by the issuer Activity Completed Comments (viii) Documentation from outsourced providers (ix) Standard operating procedures for the issuing facilities within the authorization boundary (x) Signed authorization letter under [SP 800-37-1] for each information system within scope of the assessment. Prior to authorization, a third party that is independent has reviewed the assessment. The PIV system is operational and actual PIV processes can be observed by the assessment team. The PIV system is in production and operational. PIV Cards and Derived PIV Credential tokens are ready to be personalized and can be used for testing by the assessment team. Personalized PIV Cards and/or Derived PIV Credential tokens are submitted on an annual basis to the FIPS 201 Evaluation Program for testing and are issued from a production system. A PPENDIX D: O PERATIONS P LAN T EMPLATES

Appendices D.1 and D.2 are suggested outlines for a PIV Card Issuer (PCI) and a Derived PIV Credential Issuer (DPCI) respectively. It is highly recommended that an organization follow these templates to document its operations comprehensively and to the full extent as needed to support a successful authorization. An issuer of both PIV Cards and Derived PIV Credentials may develop a single operations plan that addresses all requirements without repeating common elements of the plan.

Appendix D.1: Operations Plan Template for PIV Card Issuers

I. Background <Provide a brief background on HSPD-12, FIPS 201-2 and PIV, as well as how the organization has planned to meet the Directive. > II. Purpose and Scope <Describe the purpose and scope of the operations plan. > III. Applicable Laws, Directives, Policies, Regulations & Standards <Identify all Laws, Directives, Policies, Regulations and Standards that govern PIV Card issuance at the Organization.> IV. PCI Roles and Responsibilities <Identify the authorization-related roles and responsibilities of all key personnel within the PCI.> V. Assignment of Roles <Document how the various roles that have been identified in the section above are appointed. These can be either specific individuals or positions within the organization. Provide contact information for all the roles assigned.> VI. PCI Description <Provide a description of the organization’s PCI. Details such as structure and geographic dispersion should be included.> VII. Issuing Facility Details <Identify all the issuing facilities that are included and are part of the authorization boundary. Provide details such as the location, PIV Card Process performed (e.g. registration) at the facility and the approximate number of PIV Cards personalized at each facility. > VIII. PCI Management <This section discusses various management aspects of the PCI. > a. Coordination and Interaction <Describe management interactions within the PCI, both at an organization level, and between the organization and the facility(s). > b. Staffing <Describe the procedures employed to make sure that adequate staff is available for performing PIV Card related functions. > c. Training <Describe the procedures employed to ensure that the staff is properly trained to perform their respective duties. > d. Procurement <Describe the mechanism typically used for procuring products/services related to the organization’s HSPD-12 implementation. > e. Outsourcing <Describe the PIV Card functions being outsourced (if applicable). >

IX. PCI Policies and Procedures <Describe in this section the various policies and procedures that apply for (i) sponsorship, (ii) identity proofing / registration, (iii)adjudication, (iv) card production, (v) activation and issuance and (vi) maintenance for PIV Cards. Also discuss the procedures for temporary badges, as well as for non-PIV badges employed by the organization. > a. Sponsorship b. Identity Proofing and Registration c. Adjudication d. Card Production e. Activation/Issuance f. Maintenance i. Re-issuance ii. Post-issuance updates iii. Termination b. Temporary/Non-PIV Badges

X. PCI Issuance Information System (s) Description <Provide a description of the technical aspects of the organization’s PIV issuance system, including system architecture, network connectivity, connections to external system and information shared both internally and externally, the PKI provider as well as the information system authorization status. > a. Architecture b. Interconnections and Information Sharing c. Information System Inventory d. Public Key Infrastructure e. SP 800-37-1 A&A Information

XI. Card Personalization & Production <Describe the organization’s PIV Card graphical layout(s), as well the optional data containers being used. Provide details if there are any PIV Card expiration date requirements levied by the organization. Also describe the mechanisms in place for securing both pre-personalized and personalized PIV Card stock > a. PIV Card Graphical Topology b. PIV Card Electronic Data Elements c. Expiration Date Requirements d. Card Inventory Management

XII. Issuer Controls <This section documents the issuer controls(from Table G.1 ) and provides the following information for each: (i) issuer control identifier and description, (ii) control owner, (iii) whether the control is organization-specific or facility- specific and (iv) a description of how the issuer control has been implemented by the organization. > a. Issuer Control Identifier and Control Description b. Issuer Control Owner c. Organization/Facility Specific d. How the issuer control is implemented Appendix I - Memoranda of Appointment <Attached copies of signed memoranda-of-appointment that record the various roles that have been assigned and the personnel fulfilling these roles that have accepted the position and its associated responsibilities. > Appendix II - Privacy Requirements <Attached copies of the privacy-related information as identified below. > a. Privacy Policy b. Privacy Impact Assessment c. System of Record Notice d. Privacy Act Statement/Notice e. Rules of Conduct f. Privacy Processes i. Requests to review personal information ii. Requests to amend personal information iii. Appeal procedures iv. Complaint procedures

Appendix III – Service Level Agreements, Memoranda of Understanding (MOU) <Attached copies of any service level agreements and memoranda of understanding executed between the organization and any external service provider that has been contracted to provide certain PIV related functions.> Appendix D.2: Operations Plan Template for Derived PIV Credential Issuers

I. Background <Provide a brief background on HSPD-12, FIPS 201-2, PIV and SP 800-157, as well as how the organization has planned to meet the Directive. > II. Purpose and Scope <Describe the purpose and scope of the operations plan. > III. Applicable Laws, Directives, Policies, Regulations & Standards <Identify all Laws, Directives, Policies, Regulations and Standards that govern Derived PIV Credential token Issuance at the Organization.> IV. DPCI Roles and Responsibilities <Identify the authorization-related roles and responsibilities of all key personnel within the DPCI.> V. Assignment of Roles <Document how the various roles that have been identified in the section above are appointed. These can be either specific individuals or positions within the organization. Provide contact information for all the roles assigned.> VI. DPCI Description <Provide a description of the organization’s DPCI. Details such as structure and geographic dispersion should be included.> VII. Issuing Facility Details <If applicable, identify all the Issuing facilities that are included and are part of the authorization boundary. Provide details such as the location, Derived PIV Credential functions performed at the facility and the types and approximate number of Derived PIV Credentials personalized at each facility. If issuance is conducted entirely remotely, indicate this within VI. > VIII. DPCI Management <This section discusses various management aspects of the DPCI. > a. Coordination and Interaction <Describe management interactions within the DPCI, both at an organization level, and between the organization and the facility(s). > b. Staffing <Describe the procedures employed to make sure that adequate staff is available for performing Derived PIV Credential related issuance functions. > c. Training <Describe the procedures employed to ensure that the staff is properly trained to perform their respective duties. > d. Procurement <Describe the mechanism typically used for procuring products/services related to the organization’s HSPD-12 implementation. > e. Outsourcing <Describe the Derived PIV Credential functions being outsourced (if applicable). >

IX. DPCI Policies and Procedures <Describe in this section the various policies and procedures that apply for (i) sponsorship, (ii) token production and (ii) activation and issuance, and (iv) maintenance for Derived PIV Credentials. a. Sponsorship b. Token Production c. Activation/Issuance d. Maintenance i. Re-issuance ii. Post-issuance updates iii. Termination

X. DPCI Issuance System (s) Description <Provide a description of the technical aspects of the organization’s PIV issuance system, including system architecture, network connectivity, connections to external system and information shared both internally and externally, the PKI provider as well as the information system authorization status. > a. Architecture b. Interconnections and Information Sharing c. Information System Inventory d. Public Key Infrastructure e. SP 800-37-1 A&A Information f. Linkage between the PIV Card and the Derived PIV Credential

XI. Derived PIV Credential Details <Provide details of the organization’s implementation of the Derived PIV Credential token. Describe if its hardware or software based. If hardware-based, provide details of implementation (e.g. removable, SD Card, Universal Integrated Circuit Card, USB token or embedded)> a. Derived PIV Credential token Data Elements b. Inventory Management (for Hardware-based Tokens)

XII. Issuer Controls <This section documents the issuer controls (from Appendix G.2 ) and provides the following information for each: (i) issuer control identifier and description, (ii) control owner, (iii) whether the control is organization-specific or facility- specific and (iv) a description of how the issuer control has been implemented by the organization. > a) Issuer Control Identifier and Control Description b) Issuer Control Owner c) Organization/Facility Specific d) How the issuer control is implemented

Appendix I - Memoranda of Appointment <Attached copies of signed memoranda-of-appointment that record the various roles that have been assigned and the personnel fulfilling these roles that have accepted the position and its associated responsibilities. > Appendix II - Privacy Requirements <Attached copies of the privacy-related information as identified below. > a. Privacy Policy b. Privacy Impact Assessment c. System of Record Notice d. Privacy Act Statement/Notice e. Rules of Conduct f. Privacy Processes i. Requests to review personal information ii. Requests to amend personal information iii. Appeal procedures iv. Complaint procedures

Appendix III – Service Level Agreements, Memoranda of Understanding (MOU) <Attached copies of any service level agreements and memoranda of understanding executed between the organization and any external service provider that has been contracted to provide certain PIV related functions.> A PPENDIX E: A SSESSMENT R EPORT T EMPLATE

Below is a template to use when generating the assessment report. This is to be completed for each issuer control. An example using a specific issuer control follows.

Issuer Authorization Topic (IAT):

Authorization Focus Area

Issuer Control Identifier—

Control Description—

Issuer Control Owner / Control Level — (External Service Provider, Organization specific, Facility specific)

ASSESSMENT DETAILS

Assessment Method(s):

Review: (Artifact(s))

Observe: (Name of Process)

Assessment Result— (Satisfied, Partially Satisfied, Not Satisfied, Not Applicable)

Assessment Findings—

Assessment Deficiency and Potential Impact—

Recommendation—

Activation/Issuance Process

Issuer Control Identifier— AI-7

Control Description— Before the PIV Card is provided to the applicant, the issuer performs a 1:1 biometric match of the applicant against biometrics available on the PIV Card or in the chain-of- trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data that are available. If the match is unsuccessful, or if no biometric data is available, the cardholder provides two identity source documents (as specified in [FIPS 201-2] , Section 2.7), and an attending operator inspects these and compares the cardholder with the facial image printed on the PIV Card.

Issuer Control Owner— External Service Provider, Facility Specific

ASSESSMENT DETAILS

Assessment Method(s):

Review: Operations Plan

Observe: Activation/Issuance Process Assessment Result— Partially Satisfied

Assessment Findings— There is operational evidence that a 1:1 biometric match is carried out before the card is released to the applicant.

Assessment Deficiency and Potential Impact— The requirement to carry out this task is not documented clearly enough in the operations plan. Although personnel are knowledgeable about this requirement, and the task was observed to be performed correctly during card issuance, the lack of documentation could be a problem if there is turnover in staff. Alternate processes when fingerprints are unavailable are not in place.

Recommendation— Update the issuance process description within the operations plan to include a clear description of this task in the process and develop alternate processes for issuance when fingerprints are not available.

Summary Report Template

IAT (% Satisfied, % Partially Satisfied, % Not Satisfied) For each Authorization Focus Area (% Issuer controls Satisfied, % Partially Satisfied, % Not Satisfied) (% Review Assessments Satisfied, % Interview Assessments Satisfied, % Observe Assessments Satisfied, % Test Assessments Satisfied) A PPENDIX F: S AMPLE T RANSMITTAL AND D ECISION L ETTERS

Sample Assessment/Authorization Package Transmittal Letter

From: Organization Identity Management Official Date:

To: Designated Authorizing Official (DAO)

Subject: Authorization Submission Package for [PCI / DPCI]

An assessment of the [PCI/DPCI N AME ] located at [PCI/DPCI Location and Issuing Facility Locations] has been conducted in accordance with NIST Special Publication (SP) 800-79-2, Guidelines for the Authorization of PIV Card Issuers and Derived PIV Credential Issuer and the [ ORGANIZATION ] policy on authorization. The attached authorization package contains— (i) the operations plan; (ii) the assessment report; (iii) a corrective actions plan (CAP); and (iv) an [SP 800-37-1] authorization letter for each information system within the [PCI/DPCI].

The operations plan, its policies, procedures, and processes have been assessed by [A SSESSOR ] using the assessment methods and procedures defined in SP 800-79-2 and specified in the assessment report to determine the extent to which the requirements under [HSPD-12] and [FIPS 201-2] are exhibited. The CAP describes the corrective actions that we plan to perform to remove or reduce any remaining deficiencies detected in our operations. Sample Authorization Decision Letter (Authorization to Operate)

From: Designated Authorizing Official Date:

To: Organization Identity Management Official

Subject: Authorization Decision for [PCI / DPCI]

After reviewing the results of the authorization package of the [PCI / DPCI], I have determined that its policies, procedures, and processes are in compliance both with [FIPS 201-2] and our organization’s own policies, regulations and standards. Accordingly, I am issuing an authorization to operate (ATO). [PIV Card and/or Derived PIV Credential] issuance services are authorized without any restrictions or limitations. This authorization is my formal declaration that the requirements of [HSPD-12] are being satisfied.

This ATO also applies to issuing facilities under this [PCI / DPCI]. Included is a list of facilities authorized to operate under this authorization decision.

This authorization and ATO will remain in effect for 3 years from the date of this letter if— (i) all required documentation is updated annually; (ii) a lifecycle walkthrough is completed annually and the results sent to me within thirty (30) days of completion; and (iii) no deficiencies are identified during the walkthrough that would increase the risk to the organization’s mission. Sample Authorization Decision Letter (Interim Authorization to Operate)

From: Designated Authorizing Official Date:

To: Organization Identity Management Official

Subject: Authorization Decision for [PCI / DPCI]

After reviewing the results of the assessment of the [PCI / DPCI], I have determined that the requirements identified in [FIPS 201-2] and the organization’s policies, regulations, and standards have not been implemented satisfactorily. However, I have determined that there is an overarching need for the issuance services to continue due to mission necessity and other considerations. Accordingly, I am issuing an interim authorization to operate (IATO). Operation of the [PCI /DPCI] shall be performed in accordance with the enclosed terms and conditions during the IATO period. The [PCI / DPCI] is not considered authorized during the IATO period.

This IATO also applies to facilities under the [PCI / DPCI]. Included is a list of facilities authorized to operate during this interim period, along with specific limitations or restrictions that apply.

This interim authorization to operate is valid for a maximum till close of business on <date [not to exceed three months]. This interim authorization will remain in effect as long as— (i) the required status reports for the [PCI / DPCI] are submitted to this office every month; (ii) the problems or deficiencies reported from the authorization do not result in additional risk that is deemed unacceptable; and (iii) continued progress is being made in reducing or eliminating the deficiencies in accordance with the corrective actions plan (CAP). At the end of IATO period, the [PCI / DPCI] must be ready to receive an authorization to operate. A second IATO will be granted only in extenuating circumstances. This office will review the CAP submitted with the authorization package during the IATO period and monitor progress on removal or reduction of concerns and discrepancies before re-authorization is initiated. Sample Authorization Decision Letter (Denial of Authorization to Operate)

From: Designated Authorizing Official Date:

To: Organization Identity Management Official

Subject: Authorization Decision for [PCI / DPCI]

After reviewing the results of the assessment of the [PCI / DPCI] and the supporting evidence provided in the associated authorization package, I have determined that the requirements identified in [FIPS 201-2] and the organization’s policies, regulations, and standards are not being exhibited by the [PCI / DPCI]. Accordingly, I am issuing a denial of authorization to operate (DATO) to the [PCI / DPCI] and its issuing facilities. The [PCI / DPCI] is not authorized and [ MAY NOT BE PLACED INTO OPERATION or ALL CURRENT OPERATIONS MUST BE HALTED ].

The corrective actions plan (CAP) is to be pursued immediately to ensure that proactive measures are taken to correct the deficiencies found during the assessment. Re- authorization is to be initiated at the earliest opportunity to determine the effectiveness of correcting the deficiencies. A PPENDIX G: I SSUER C ONTROLS AND A SSESSMENT P ROCEDURES

Tables G.1 and G.2 list issuer controls that are applicable to a PIV Card Issuer (PCI) and a Derived PIV Credential Issuer (DPCI), respectively. An issuer must comply with all applicable requirements, with applicability determined by whether the organization issues the mandatory PIV Cards, the optional Derived PIV Credentials (if implemented) or both.

Table G.1: Controls and Assessment Procedures for PIV Card Issuers (PCIs)

Authorization Focus Area Identifier Issuer Control Source Preparation and Maintenance of Documentation DO-1 The organization develops and implements an issuer operations plan according to the template in Appendix D-1 . The operations plan references other documents as needed.

Assessment Determine that: (i) the operations plan includes the relevant elements from the template in Appendix D-1 (review); (ii) the operations plan includes the list of issuer controls and the issuer control owner for each, how they were implemented and whether they are organization or facility specific (review); (iii) documentation that is not included in the operations plan is referenced accurately (review); (iv) the operations plan has been reviewed and approved by the DAO within the organization (review, interview). SP 800-79-2, Section 2.11 – Authorization Package and Supporting Documentation

DO-2 The organization has a written policy and procedures for identity proofing and registration that are approved by the head or deputy secretary (or equivalent) of the Federal department or agency.

Assessment Determine that : (i) the organization has developed and documented written policy and procedures for identity proofing and registration for personnel requiring a PIV Card (e.g. employees and contractors) (review); (ii) the policy is consistent with the organization’s mission and functions, [FIPS 201-2] and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head or deputy secretary (or equivalent) of the Federal department or agency (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). [ FIPS 201-2 ], Section 2.7 – PIV Identity Proofing and Registration Requirements

DO-3 The organization has a written policy and procedures for issuance that are approved by the head or deputy secretary (or equivalent) of the Federal department or agency.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for issuance (review); [FIPS 201-2] , Section 2.8 – PIV Card Issuance Authorization Focus Area Identifier Issuer Control Source (ii) the policy is consistent with the organization’s mission and functions, [FIPS 201-2] and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head or deputy secretary (or equivalent) of the Federal department or agency (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview).

DO-4 This control has been withdrawn. Renewal is now part of re- issuance in [FIPS 201-2] . Therefore, DO-4 is covered, as applicable, by DO-6. -

DO-5 The organization has a written policy and procedures describing the conditions for PIV Card termination.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for PIV Card termination (review); (ii) the policy is consistent with the organization’s mission and functions, [FIPS 201-2] and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the organization will periodically review and update the policy as required (review, interview). [FIPS 201-2] , Section 2.9.4 – PIV Card Termination

DO-6 The organization has a written policy and procedures describing the conditions for PIV Card reissuance and post issuance update.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for card reissuance (review); (ii) the policy is consistent with the organization’s mission and functions, [FIPS 201-2] and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the organization will periodically review and update the policy and procedures as required (review, interview). [FIPS 201-2] , Section 2.9.1 – PIV Card Reissuance

[FIPS 201-2] , Section 2.9.2 - PIV Card Post Issuance Update Requirements

DO-7 In cases where a PIV Card is not required, such as temporary employees, contractors employed for less than 6 months and visitors, the organization has a written policy and procedures describing the conditions for temporary badges.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for the issuance of temporary badges (review); (ii) the policy is consistent with the organization’s mission and functions, applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the organization will periodically review and update the policy and procedures as required (review, interview). OMB Memorandum [ M-05-24] Authorization Focus Area Identifier Issuer Control Source DO-8 (NEW) The organization has a written policy and procedures for identity proofing and registration that apply to citizens of foreign countries who are working for the Federal government overseas (if applicable).

Assessment Determine that: (i) the organization uses a process that is approved by the U.S. State Department’s Bureau of Diplomatic Security (review); (ii) the policy and procedures have been signed off by the head or deputy secretary (or equivalent) of the Federal department or agency (review). [FIPS 201-2] , Section 2.7 – PIV Identity Proofing and Registration Requirements

Authorization Focus Area Identifier Issuer Control Source Assignment of Roles and Responsibilities RR-1 The organization has appointed the role of Senior Authorizing Official (SAO).

Assessment Determine that : (i) the organization has defined the role of Senior Authorizing Official and its responsibilities according to the requirements of SP 800-79-2 (review); (ii) the organization has assigned the role of Senior Authorizing Official (review). SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities

RR-2 The organization has appointed the role of Designated Authorizing Official (DAO).

Assessment Determine that : (i) the organization has defined the role of Designated Authorizing Official and its responsibilities according to the requirements of SP 800-79-2 (review); (ii) the organization has assigned the role of Designated Authorizing Official (review, interview). SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities

RR-3 The organization has appointed the role of Organization Identity Management Official (OIMO).

Assessment Determine that : (i) the organization has defined the role of Organization Identity Management Official and its responsibilities according to the requirements of SP 800-79-2 (interview); (ii) the organization has assigned the role of Organization Identity Management Official (review, interview). SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities Authorization Focus Area Identifier Issuer Control Source RR-4 The organization has appointed the role of Assessor.

Assessment Determine that : (i) the organization has defined the role of Assessor and its responsibilities according to the requirements of SP 800- 79-2 (review); (ii) the organization has assigned the role of Assessor (review); (iii) the Assessor is a third party that is independent of, and organizationally separate from, the persons and office(s) directly responsible for the day-to-day operation of the organization (review, interview). SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities

RR-5 The organization has appointed the role of Privacy Official (PO).

Assessment Determine that : (i) the organization has defined the role of Privacy Official and its responsibilities according to the requirements of SP 800-79-2 (review); (ii) the organization has assigned the role of Assessor (review); (iii) the Privacy Official does not have any other roles in the organization (review, interview). [FIPS 201-2] , Section 2.11 - PIV Privacy Requirements

SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities

RR-6 The issuer employs processes which adhere to the principle of separation of duties to ensure that no single individual has the capability to issue a PIV Card without the cooperation of another authorized person.

Assessment Determine that : (i) the standard operating procedures document the principle of separation of duties (review); (ii) the processes demonstrate adherence to the principle of separation of duties (interview, observe). [FIPS 201-2] , Section 2.7 – PIV Identity Proofing and Registration Requirements Authorization Focus Area Identifier Issuer Control Source Facility and Personnel Readiness Facility FP-1 Minimum physical controls at the issuing facility are implemented. These include: (i) use of locked rooms, safes, and lockable cabinets (as appropriate); (ii) physical access to key areas within the facility is restricted to authorized personnel, (iii) security monitoring and automated alarms are implemented, (iv) emergency power and lighting are available, and (v) fire prevention and protection mechanisms are implemented.

Assessment Determine that: (i) the OIMO and Issuing Facility Manager(s) are aware of the minimum set of physical controls that need to be in place at the facility(ies) (interview); (ii) the minimum physical security controls are implemented by the issuing facility (observe).

FP-2 Issuer Documentation (e.g., operations plan, standard operating procedures, and contracts) are maintained at each issuing facility.

Assessment Determine that: (i) the most current versions of the issuer documentation is available at each issuing facility for reference as needed (interview, review).

Equipment FP-3 The Issuing Facility Manager(s) has a copy of the contingency/disaster recovery plan for the information systems, which is stored securely.

Assessment Determine that : (i) the contingency plan/ disaster recovery plan is stored securely at the facility (interview, observe); (ii) the Issuing Facility Manager is knowledgeable on how to restore/reconstitute the information systems in case of system failures (interview).

FP-4 The information systems are managed using a system development life cycle (SDLC) methodology that includes information security considerations as outlined in [SP 800-37-1] -.

Assessment Determine that : (i) the information system used by the organization has been developed using an SDLC methodology (review, interview); (ii) information system security is considered as part of the development life cycle (review). [SP 800-37-1] , Section 2.2 Authorization Focus Area Identifier Issuer Control Source FP-5 Card activation/issuance workstations are situated in an enclosed area (wall or partition) to provide privacy for an applicant or card holder.

Assessment Determine that : (i) Issuing facility workstations are situated in an enclosed area (wall or partition) such that other individuals cannot see an applicant or card holder’s personal information (observe).

Key Personnel FP-6 All operators who perform roles within an issuing facility in the areas of identity proofing and registration, issuance or maintenance are allowed access to information systems only when authenticated through a PIV Card.

Assessment Determine that : (i) the requirement that all operators who perform roles within an issuing facility in the areas of identity proofing and registration, issuance or maintenance are allowed logical access to information systems only when authenticated through a PIV Card, has been documented in the issuing facility’s standard operating procedures (review); (ii) Operators use PIV Cards to access information systems in the course of performing their roles within the PIV Card lifecycle processes (observe). OMB Memorandum 11-11

FP-7 All operators who perform roles within an issuing facility in the areas of identity proofing and registration, issuance and maintenance have undergone training that is specific to their duties prior to being allowed to perform in that function.

Assessment Determine that : (i) all operators who perform roles within an issuing facility in the areas of identity proofing and registration, issuance and maintenance are allowed access to information systems only after completing a training course specific to their duties. (interview, review); (ii) Records showing that the appropriate training course has been completed by issuing facility personnel are stored by the facility for audit purposes (interview, review). Authorization Focus Area Identifier Issuer Control Source FP-8 All pre-personalized and personalized smart card stock received from card vendors and card production facilities are received only by authorized personnel who ensure that the card stock is stored, handled and disposed of securely at the issuing facility.

Assessment Determine that : (i) the issuing facility has an authorized list of personnel that are responsible for ensuring that smart card stock is received and stored securely. (interview); (ii) procedures for receiving, storing and destroying smart card stock are documented in the issuing facility’s standard operating procedures (review); (iii) the authorized personnel are knowledgeable of the procedures on how to receive, store and destroy (in case of printing errors) smart card stock (interview). [FIPS 201-2] , Section 2.8 - PIV Card Issuance

FP-9 The organization maintains a current list of designated points of contact and alternate points of contact for all issuing facilities used by the organization for identity proofing and registration and issuance and maintenance processes.

Assessment Determine that : (i) the organization maintains a \list of designated points of contact and alternate points of contact for all issuing facilities used by the organization (review); (ii) the list is current and the individuals named are the correct points of contact (review and interview). Authorization Focus Area Identifier Issuer Control Source Protection of Stored and Transmitted Data ST-1 The issuer information systems that contain information in identifiable form are handled in compliance with Federal laws and policies, including the Privacy Act of 1974.

Assessment Determine that : (i) the organization does not disclose any record which is contained in the system of records to any person, or to another organization unless written consent has been given by the individual to whom the record pertains unless one of the exceptions for disclosure in the Privacy Act are met (review, interview); (ii) individuals are permitted to gain access to their personal record and the information is provided in a form comprehensible to them (review, interview); (iii) individuals are able to request amendments to records pertaining to them, corrections are made promptly and if not, the individual is provided with a reason for the refusal and is able to request a review of the refusal (review, interview); (iv) the organization notifies an individual when their record is made available to any person under a compulsory legal process when such a process becomes a matter of public record (review, interview). [FIPS 201-2] , Section 2.11 - PIV Privacy Requirements

ST-2 The information systems protect the integrity and confidentiality of transmitted information.

Assessment Determine that : (i) the integrity of transmitted information is protected (interview, test, review); (ii) the confidentiality of transmitted information is protected (interview, test, review). [FIPS 201-2] , Section 2.11 - PIV Privacy Requirements Authorization Focus Area Identifier Issuer Control Source Enforcement of Privacy PR-1 Privacy act statement/notice, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees violating privacy policies are developed and posted by the organization in multiple locations at the issuing facility (e.g., internet site, human resource offices, regional offices, and contractor orientation handouts). Assessment Determine that : (i) the issuing facility has posted privacy act statement/notice, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees violating privacy policies (interview, review). OMB Memorandum [ M-05- 24]

PR-2 The organization has conducted a Privacy Impact Assessment of their issuer information system (s), compliant with Section 208 of the E-Government Act of 2002 and based on guidance found in Appendix E of OMB Memorandum 06-06. Assessment Determine that: (i) the organization has conducted a Privacy Impact Assessment of their issuer information system (s) based on guidance found in Appendix E of OMB Memorandum 06-06 (review); (ii) the organization has submitted the Privacy Impact Assessment of their issuer information system (s) to OMB (interview, review). OMB Memorandum [ M-05- 24]

OMB Memorandum [M-06-06] (Appendix E)

PR-3 The organization’s employee and contractor identification systems of records notices (SORN’s) are updated to reflect any changes in the disclosure of information to other organizations in order to be consistent with the Privacy Act of 1974 and OMB Circular A-130, Appendix 1. Assessment Determine that: (i) the organization updates SORN’s to reflect changes in the disclosure of information (review, interview). OMB Memorandum [ M-05- 24]

PR-4 The applicant is notified of what information in identifiable form is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information. Assessment Determine that: (i) Before receiving the PIV Card, the issuing facility requires the applicant to be notified of the personally identifiable information that is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (review, observe); (ii) the applicant is informed of what personally identifiable information is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (interview). [FIPS 201-2] , Section 2.11 – PIV Privacy Requirements Authorization Focus Area Identifier Issuer Control Source PR-5 The issuing facility employs technologies that allow for continuous auditing of compliance with privacy policies and practices. Assessment Determine that: (i) the issuing facility employs technologies that allow for the continuous auditing of compliance with privacy policies and practices. This could include the use of technology to monitor data access, data flows between information systems and the use of personally identifiable information (interview, test). [FIPS 201-2] , Section 2.11 – PIV Privacy Requirements

PR-6 In the case of termination, any personally identifiable information that has been collected from the cardholder is disposed of in accordance with the stated privacy and data retention policies. Assessment Determine that: (i) as part of PIV Card termination, the organization disposes of personally identifiable information in accordance with its privacy and data retention policies while taking in account the grace period provisions (review, interview). [FIPS 201-2] , Section 2.9.4 – PIV Card Termination

[FIPS 201-2] , Section 2.8.2 – Grace Period

Authorization Focus Area Identifier Issuer Control Source Deployed Products & Information Systems DP-1 In order to be compliant with the provisions of OMB Circular A- 130, App III, the issuer information system(s) are authorized to operate in accordance with NIST [SP 800-37-1] , Guide for Applying the Risk Management Framework to Federal Information Systems A Security Life Cycle Approach

Assessment Determine that: (i) the organization has a letter showing the current authorization decision of each information system used to support the issuer (review). [FIPS 201-2] , Appendix A.2 Application of Risk Management Framework to IT System(s) Supporting PCI

[FIPS 201-2] , Section 2.11 – PIV Privacy Requirements

DP-2 Every product directly utilized by an issuing facility to issue a PIV Card is from the GSA FIPS 201 Evaluation Program’s Approved Products List (APL) where applicable.

Assessment Determine that: (i) for each product that falls within one of the categories in the FIPS 201 Evaluation Program , its presence (make, model, versions) is checked on the APL (review); (ii) there is no product in operation that has been moved to the GSA Removed Products List (RPL). OMB Memorandum [ M-05- 24]

Federal Acquisition Regulation ( FAR ), Section 4.1302 Acquisition of approved products and services for personal identity verification. Authorization Focus Area Identifier Issuer Control Source DP-3 The organization has submitted to the FIPS 201 Evaluation Program for testing a personalized PIV Card, issued from their production system.

Assessment Determine that: (i) the organization has a test report from the FIPS 201 Evaluation Program showing successful conformance of the PIV credentials on the PIV Card to the PIV Data Model (review); (ii) The organization continues to submit personalized PIV Cards on an annual basis to the FIPS 201 Evaluation Program for testing (review). OMB Memorandum [M 07-06]

Authorization Focus Area Identifier Issuer Control Source Implementation of Credentialing Infrastructures CI-1 For legacy Public Key Infrastructures (PKI’s), the organization’s CA is cross-certified with the Federal Bridge (FBCA) and issues certificates with the id-fpki-common-authentication and id-fpki- common-authentication policy OIDs of the U.S. Federal PKI Common Policy Framework

Assessment Determine that: (i) the organization’s CA is listed on http://www.idmanagement.gov/entities-cross-certified- federal-bridge as being cross-certified and authorized to issue certificates with the appropriate OIDs (review). [FIPS 201-2] , Section 5.4 – Legacy PKI

CI-2 For non-legacy PKI’s, all certificates issued to support PIV Card authentication are issued under the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework.

Assessment Determine that: (i) the PKI provider is listed on http://www.idmanagement.gov/list-certified-shared- service-providers as being a shared service provider (review). [FIPS 201-2] , Section 5.2 – PKI Certificate

CI-3 When cards are personalized, PIV Card Application Administration Keys are set to be specific to each PIV Card. That is, each PIV Card contains a unique PIV Card Application Administration Keys.

Assessment Determine that: (i) the CMS vendor’s documentation shows the use of unique PIV Card Application Administration Keys (review); (ii) the OIMO indicates that PIV Card Application Administration Keys are unique (interview). [FIPS 201-2] , Section 4.3.2 – Activation by Card Management System Authorization Focus Area Identifier Issuer Control Source CI-4 Fingerprint images retained by organizations are formatted according to [SP 800-76-2] .

Assessment Determine that: (i) the fingerprint images are formatted according to Table 4 in [SP 800-76-2] and INCITS 381-2004 (review, test). [SP 800-76-2] , Section 3.3 – Fingerprint image format for images retained by agencies

CI-5 Facial images collected during identity proofing and registration are formatted such that they conform to [SP 800-76-2] .

Assessment Determine that: (i) the facial images are formatted according to Table 12 in [SP 800-76-2] and INCITS 385 (review, test). [SP 800-76-2] , Section 7.2 – Acquisition and Format

CI-6 The fingerprint templates stored on the PIV Card (which is used for off-card comparison) are (i) prepared from images of the primary and secondary fingers where the choice of fingers is based on the criteria described in [SP 800-76-2] Section 4.2, and (ii) formatted such that they conform to [SP 800-76-2] .

Assessment Determine that: (i) the procedures used to fingerprint the applicant are based on the primary and secondary finger selection criteria as detailed in [SP 800-76-2] Section 4.2 (review, observe); (ii) the fingerprint templates are prepared from images of the primary and secondary fingers (test); (iii) the fingerprint templates are formatted according to Table 6 in [SP 800-76-2] and INCITS 378-2004 (review, test). [SP 800-76-2] , Section 4.2 – Source Images

CI-7 (NEW) The identity management system (IDMS) should reflect the adjudication status of each PIV cardholder.

Assessment Determine that: (i) the issuer’s identity management system is capable of recording the adjudication status of each PIV Cardholder (observe). [FIPS 201-2] , Section 2.8 – PIV Card Issuance

CI-8 (NEW) If implemented, iris images collected during identity proofing and registration are formatted such that they conform to [SP 800-76- 2] , if applicable.

Assessment Determine that: (i) the iris images are formatted according to Table 9 in [SP 800-76-2] and ISO/IEC 19794-6:2011 (review, test) [SP 800-76-2] , Section 6.3 – Iris image specification for PIV Cards Authorization Focus Area Identifier Issuer Control Source CI-9 (NEW) If implemented, Fingerprint templates, for on-card comparison, collected during identity proofing and registration are formatted such that they conform to [SP 800-76-2] , if applicable.

Assessment Determine that: (i) the fingerprint templates for on-card comparison are formatted according to Table 7 in [SP 800-76-2] and ISO/IEC 19794-2:2011 (review, test). [SP 800-76-2] , Section 5.5.1 – Biometric Information Template

CI-10 (NEW) For issuers that implement the chain of trust, this data is represented in an XML schema in accordance with SP 800-156. The chain of trust include the following items: (i) a log of activities, (ii) enrollment data record, (iii) most recent unique identifiers, (iv) Information about the authorizing entity, (v) current status of the background investigation, (vi) the evidence of authorization if the credential is issued under a pseudonym, (vii) Any data or any subsequent changes in the data about the cardholder.

Assessment Determine that: (i) the chain of trust implemented by the issuer is conformant to the XML specification (review, test). SP 800-156, Section 2 - Chain-of-Trust Data Representation

Authorization Focus Area Identifier Issuer Control Source Sponsorship Process SP-1 A PIV Card is issued only upon request by proper authority.

Assessment Determine that: (i) the process for making a request is documented (review); (ii) A request from a valid authority is required to issue a PIV Card (observe). [FIPS 201-2] , Section 2.1 – Control Objectives

SP-2 The issuing facility collects personal information using only forms approved by OMB under the Paperwork Reduction Act of 1995.

Assessment Determine that : (i) forms used to collect personal information have been approved by OMB (review, observe). OMB Memorandum [M 07-06]

Authorization Focus Area Identifier Issuer Control Source Authorization Focus Area Identifier Issuer Control Source Identity Proofing Process / Registration EI-1 The issuing facility has a process in place to verify the authenticity of the source documents and match them to the identity claimed by the applicant.

Assessment Determine that: (i) the issuing facility has a process in place to verify the authenticity of the source documents and match them to the identity claimed by the applicant (interview, observe); (ii) the issuing facility has materials used to train identity proofing officials on how to verify the authenticity of the source documents (review) (iii) the issuing facility perform electronic verification of identity source documents, where possible. (review). [FIPS 201-2] , Section 2.1 – Control Objectives

EI-2 The issuing facility requires the applicant to appear in-person at least once before the issuance of a PIV Card.

Assessment Determine that: (i) the requirement that an applicant appear in-person at least once before the issuance of a PIV Card is documented (review); (ii) the applicant appears in-person at least once before the issuance of a PIV Card (observe). [FIPS 201-2] , Section 2.7 – PIV Identity Proofing and Registration Requirements

EI-3 Two identity source documents are checked based on those listed in Section 2.7 of [FIPS 201-2] and are neither expired nor cancelled.

Assessment Determine that: (i) the requirement to check two identity source documents based on the list provided in Section 2.7 of [FIPS 201-2] ,is documented (review); (ii) two identity source documents are checked in accordance, during identity proofing process (observe); (iii) If the two identity source documents bear different names, evidence of a formal name change is provided (review, observe). [FIPS 201-2] , Section 2.7 – PIV Identity Proofing and Registration Requirements

EI-4 At least one of the identity source documents used to verify the claimed identity of the applicant is a valid Federal or state government-issued photo identification.

Assessment Determine that: (i) the requirement that at least one of the identity source documents is a valid Federal or state government issued photo ID is documented (review); (ii) At least one of the identity source documents used to verify the claimed identity of the applicant is a valid Federal or state government-issued photo identification (observe). [FIPS 201-2] , Section 2.1 - Control Objectives Authorization Focus Area Identifier Issuer Control Source EI-5 Moved to MP-9. -

EI-6 This control has been withdrawn. Biometrics (fingerprint, facial image and the optional iris images) can be reused for up to 12 years. -

EI-7 The biometrics (fingerprints, facial image and the optional iris images) that are used to personalize the PIV Card must be captured during the identity proofing and registration process.

Assessment Determine that: (i) the requirement to capture biometrics (fingerprints, facial image and optional iris images) that are used to personalize the PIV Card must be captured during identity proofing and registration process is documented (review); (ii) The biometrics (fingerprints, facial image, and the optional iris image) that are used to personalize the PIV Card are captured during the identity proofing and registration process (observe). [FIPS 201-2], Section 2.8 - PIV Card Issuance

EI-8 This control has been withdrawn. [FIPS 201-2] does not require that a PIV Card be reissued within 6 weeks before expiration of the old PIV Card. -

EI-9 The issuing facility captures the applicant’s fingerprints in accordance with any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or (iii) rolled ink card.

Assessment (i) the issuing facility captures the applicant’s fingerprints in accordance with any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or (iii) rolled ink card (observe). [SP 800-76-2] , Section 3.2 – Fingerprint Image Acquisition

EI-10 The issuing facility has an attending official present at the time of biometric (fingerprint and optional iris images) capture.

Assessment Determine that: (i) the requirement that the issuing facility has an attending official present at the time of biometric (fingerprint and optional iris images) capture is documented (review); (i) the issuing facility has an attending official present at the time of biometric (fingerprint and optional iris images) capture (observe). [SP 800-76-2] , Section 3.2 – Fingerprint Image Acquisition

[SP 800-76-2] , Section 6.6 - Iris image quality control Authorization Focus Area Identifier Issuer Control Source EI-11 The issuing facility acquires fingerprint images in accordance with Table 3 in [SP 800-76-2] .

Assessment Determine that: (i) fingers are inspected for the absence dirt, coatings, gels, and other of foreign materials (observe); (ii) scanner and card surfaces are clean (observe); (iii) the presentation of fingers for a plain live scan, rolled live scan, and rolled ink card are based on procedures in Table 2 of [SP 800-76-2] (observe);\ (iv) multi-finger plain impression images are properly segmented into single finger images (observe). [SP 800-76-2] , Section 3.2 – Fingerprint Image Acquisition

EI-12 The issuing facility captures the 10 fingerprints of the applicant. In the case where less than ten fingers are available, the missing fingers are labeled before transmitting to the FBI for the purpose of conducting a background investigation.

Assessment Determine that: (i) the requirement that the issuing facility captures the 10 fingerprints of the applicant and labels any missing fingers is documented (review); (ii) the issuing facility captures the 10 fingerprints of the applicant and labels any missing fingers (observe). [SP 800-76-2] , Section 3.2 – Fingerprint Image Acquisition

EI-13 (NEW) If the biometric (fingerprint) data collected to personalize the PIV Card and the biometric data (fingerprints) collected to support background investigations are collected on separate occasions, then a 1:1 biometric match of the applicant is performed at each visit against biometric data collected during a previous visit. . Assessment Determine that: (i) the requirement that if the biometric data for personalization and background investigation are collected on separate occasions a 1:1 biometric match of the applicant is performed at each visit against biometric data collected during a previous visit (review, observe). [FIPS 201-2] , Section 2.4 - Biometric Data Collection for PIV Card Authorization Focus Area Identifier Issuer Control Source Adjudication Process AP-1 The organization ensures: (a) the initiation of a Tier 1 or higher federal background investigation and (b) the completion of the National Agency Check (NAC) of the background investigation prior to issuance of the PIV Card; when a completed and favorably adjudicated NACI (or equivalent or higher) or Tier 1 or higher federal background investigation record cannot be referenced.

Assessment: Determine that: (i) the organization references a completed and favorably adjudicated NACI (or equivalent or higher) or Tier 1 or higher federal background investigation record for the applicant (review, observe); (ii) the organization conducts the appropriate level of background investigation prior to PIV Card issuance if a previously completed and favorably adjudicated result cannot be obtained(review, observe). [FIPS 201-2] , Section 2.7 – PIV Identity Proofing and Registration Requirements

AP-2 In cases where the NAC results are not received within 5 days of the NAC initiation, the FBI NCHC (fingerprint check) portion of the NAC is completed before PIV Card issuance.

Assessment Determine that: (i) the PIV Card is issued only after successful completion of the NCHC (fingerprint check) portion of the NAC (review, observe). [FIPS 201-2] , Section 2.7 – PIV Identity Proofing and Registration Requirements

AP-3 (NEW) The organization follows credentialing guidance issued by the Director of the Office of Personnel Management (OPM) and Office of Management and Budget (OMB).

Assessment: Determine that: (i) the facility has documented procedures follow the credentialing guidance issued by OPM and OMB (review). [FIPS 201-2] , Section 2.2 – Credentialing Requirements

[Springer Memo] and the Federal Investigative Standards

OMB Memorandum [ M-05- 24]

AP-4 (NEW) In the absence of an FBI NCHC (e.g., due to unclassifiable fingerprints) the NAC results are required prior to issuing a PIV Card.

Assessment: Determine that: (i) If FBI NCHC check cannot be completed, the organization does not issue PIV Cards until the results of the NAC are obtained (review, interview). [FIPS 201-2] , Section 2.8 – PIV Card Issuance Requirements. Authorization Focus Area Identifier Issuer Control Source AP-5 (NEW) The PIV Card is terminated if the results of the background investigation so justify.

Assessment: Determine that: (i) The organization revokes the PIV Card if it is issued on the basis of the FBI NCHC check and the NAC results once obtained are unfavorable (review, interview) [FIPS 201-2] , Section 2.8 – PIV Card Issuance Requirements.

[Springer Memo] and the Federal Investigative Standards Authorization Focus Area Identifier Issuer Control Source Card Production Process CP-1 The PIV Card implements security features that aid in reducing counterfeiting, are resistant to tampering, and provide visual evidence of tampering attempts.

Assessment Determine that: (i) the PIV Card contains at least one security feature. Examples of these security features include the following: (i) Optical varying structures, (ii) Optical varying inks, (iii) Laser etching and engraving, (iv) Holograms, (v) Holographic images, (vi) Watermarks (interview, observe). (ii) Incorporation of security features—(i) are in accordance with durability requirements; (ii) are free of defects, such as fading and discoloration; (iii) do not obscure printed information; and (iv) do not impede access to machine- readable information (interview, observe) [FIPS 201-2] , Section 4.1.2 – Tamper Proofing and Resistance

CP-2 The PIV Card is not embossed.

Assessment Determine that: (i) the PIV Card is not embossed (review, observe) [FIPS 201-2] , Section 4.1.3 – Physical Characteristics and Durability

CP-3 Decals are not adhered to the PIV Card.

Assessment Determine that: (i) decals are not adhered to the PIV Card (review, observe). [FIPS 201-2] , Section 4.1.3 – Physical Characteristics and Durability

CP-4 If organizations choose to punch an opening in the card body to enable the card to be oriented by touch or to be worn on a lanyard, all such alterations are closely coordinated with the card vendor and/or manufacturer to ensure the card material integrity is not adversely impacted.

Assessment Determine that: (i) the integrity of a PIV Card is not affected by a punched opening (test); (ii) Documentation from the PIV Card vendor shows that durability and operational requirements have not been compromised (review). [FIPS 201-2] , Section 4.1.3 – Physical Characteristics and Durability Authorization Focus Area Identifier Issuer Control Source CP-5 (NEW) If organization choose to use tactilely discernible marks (Edge Ridging or Notched Corner Tactile Marker or Laser Engraving Tactile Marker) to indicate card orientation, such alterations are closely coordinated with the card vendor and/or manufacturer to ensure the card material integrity and printing process is not adversely impacted.

Assessment Determine that: (i) the integrity of a PIV Card is not affected by the use of the tactile marker(s) (test); (ii) Documentation from the PIV Card vendor shows that durability and operational requirements have not been compromised (review). [FIPS 201-2] , Section 4.1.3 – Physical Characteristics and Durability

CP-6 (NEW) PIV Cards that contain topographical defects (e.g., scratches, poor color, fading, etc.) or that are not properly printed are destroyed.

Assessment Determine that: (i) The organization has a procedure to destroy PIV Card that contain topographical defects or that are not printed properly (review); (ii) the organization destroys PIV Cards that contain topographical defects or that are not printed properly (observe). [FIPS 201-2] , Section 2.8 – PIV Card Issuance

CP-7 (NEW) PIV Cards are printed using the color representation as specified in Table 4-2 Color Representation in [FIPS 201-2] , Section 4.1.5.

Assessment Determine that: (i) the issuer uses an appropriate color representation for printing PIV Cards (review, test); (ii) the card production system is configured to use an appropriate color representation system (review). [FIPS 201-2] , Section 4.1.5 – Color Representation

Authorization Focus Area Identifier Issuer Control Source Activation/Issuance Process AI-1 The personalized PIV Card complies with all the mandatory items on the front of the PIV Card.

Assessment Determine that: (i) the PIV Card meets specific requirements in [FIPS 201-2] for: (i) photograph; (ii) name; (iii) employee affiliation; (iv) agency, department, or organization (v) card expiration dates (zones 14f & 19f); (vi) color coding for employee affiliation(; (vii) affiliation color code symbol (observe, test). [FIPS 201-2] , Section 4.1.4.1 – Mandatory Items on the Front of the PIV Card Authorization Focus Area Identifier Issuer Control Source AI-2 The personalized PIV Card complies with all the mandatory items on the back of the PIV Card.

Assessment Determine that: (i) the PIV Card meets specific requirements in [FIPS 201-2] for (i) an agency card serial number; (ii) and issuer identification number (observe, test). [FIPS 201-2] , Section 4.1.4.2 – Mandatory Items on the Back of the Card

AI-3 If one or more optional items are printed on the front of the PIV Card, they comply with the requirements for the optional items on the front on the PIV Card.

Assessment Determine that: (i) the PIV Card meets specific requirements in [FIPS 201-2] if it includes optional items on the front of the card, such as (i) a signature; (ii) agency specific text area; (iii) rank; (iv) portable data file; (v) header; (vi) agency seal; (vii) footer; (viii) issue date; (ix); (x) photo border; (xi) agency specific data; (xii) organizational affiliation abbreviation; and (xiii) edge ridging or notched corner tactile marking; (xiv) laser tactile marker (observe, test). [FIPS 201-2] , Section 4.1.4.3 – Optional Items on the Front of the Card

AI-4 If one or more optional items are printed on the back of the PIV Card, they comply with the requirements for the optional items on the back on the PIV Card.

Assessment Determine that: (i) the PIV Card meets specific requirements in [FIPS 201-2] if it includes optional items on the back of the card, such as (i) magnetic stripe; (ii) return to address (iii) physical characteristics of the cardholder; (iv) additional language for emergency responder officials; (v) standard Section 499, Title 18 language; (vi) linear 3 of 9 bar code; (vii) agency- specific text (zones 9 & 10) (observe, test). [FIPS 201-2] , Section 4.1.4.4 – Optional Items on the Back of the Card

AI-5 The PIV Card includes mechanisms to block activation of the card after a number of consecutive failed activation attempts.

Assessment Determine that: (i) the PIV Card can block activation if the number of consecutive failed attempts has exceeded that set by the issuer (test, observe). [FIPS 201-2] , Section 4.3.1 – Activation by Cardholder Authorization Focus Area Identifier Issuer Control Source AI-6 The PIV Card is valid for no more than six years.

Assessment Determine that: (i) the expiration date printed on the PIV Card is no more than six years from the issuance date (observe); (ii) the expiration date is printed in the CHUID (test); (iii) the two dates (printed on the card and the expiration date in the CHUID) are the same (test). (iv) the biometric that is used for reissuance is not older than 12 years (review) [FIPS 201-2] , Section 2.8 – PIV Card Issuance

[FIPS 201-2] , Section 2.9.1 – PIV Reissuance

AI-7 Before the PIV Card is provided to the applicant, the issuer performs a 1:1 biometric match of the applicant against biometrics available on the PIV Card or in the chain-of-trust. The 1:1 biometric match requires either a match of fingerprint(s) or, if unavailable, other optional biometric data that are available. If the match is unsuccessful, or if no biometric data is available, the cardholder provides two identity source documents (as specified in Section 2.7 of [FIPS 201-2] ), and an attending operator inspects these and compares the cardholder with the facial image printed on the PIV Card.

Assessment Determine that: (i) the issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV chain of trust prior to releasing the card (review); (ii) the issuer has alternate processes in place for situations where biometric matches are not possible (review, observe). [FIPS 201-2] , Section 2.8 – PIV Card Issuance

AI-8 This control has been withdrawn. Renewal is covered as part of re-issuance in [FIPS 201-2] . -

AI-9 The issuer advises applicants that the PIN on the PIV Card should not be easily-guessable or otherwise individually- identifiable in nature.

Assessment Determine that: (i) the requirement that the issuer advises applicants that the PIN on the PIV Card should not be easily guessable or otherwise individually-identifiable in nature is documented (review); (ii) the issuer advises applicants that the PIN on the PIV Card should not be easily guessable or otherwise individually- identifiable in nature (observe). [FIPS 201-2] , Section 4.3.1 Activation by Cardholder Authorization Focus Area Identifier Issuer Control Source AI-10 PIV cards issued have the PIV NACI indicator set appropriately based on whether the subject’s background investigation was incomplete at the time of credential issuance.

Assessment Determine that: (i) the PIV NACI indicator is set to TRUE if, at the time of credential issuance, (1) the FBI National Criminal History Fingerprint Check has completed, and (2) a background investigation has been initiated but has not completed (review, observe, test); (ii) The PIV NACI indicator is set to FALSE if, at the time of credential issuance, the subject’s background investigation has been completed and successfully adjudicated (review, observe, test). [FIPS 201-2] , Appendix B.2 - PIV Certificate Extension

AI-11 This control has been moved to MP-12. -

AI-12 The organization issues electromagnetically opaque holders or other technology to protect against any unauthorized contactless access to information stored on a PIV Card.

Assessment Determine that: (i) the requirement that electromagnetically opaque holders or other technology is provided at the time of PIV Card issuance (review, observe); (ii) the electromagnetically opaque holder used by the organization is present on the GSA FIPS 201 Evaluation Program’s Approved Products List (APL) (review). [FIPS 201-2] , Section 2.11 – PIV Privacy Requirements

AI-13 This control has been moved to MP-8. -

AI-14 (NEW) If pseudonyms are required to protect an employee or contractor, the issuance of a PIV Card uses agency-approved pseudonyms and follows normal procedures for PIV Card issuance.

Assessment Determine that: (i) The organization has determined that use of a pseudonym is necessary to protect employees or contractors (review). (ii) The organization maintains a list of pseudonyms that have been issued and can link them to employees or contractors authorized to receive the such pseudonyms (review); (iii) Issuance procedures for pseudonyms are consistent with procedures for issuing regular PIV Cards (review, observe). [FIPS 201-2] , Section 2.8.1 - Special Rule for Pseudonyms Authorization Focus Area Identifier Issuer Control Source Maintenance Process MP-1 A post-issuance update doesn’t modify the PIV Card expiration date, FASC-N, or UUID.

Assessment Determine that: (i) the PIV Card expiration date, FASC-N or UUID is not modified post-issuance (review, interview). [FIPS 201-2] , Section 2.9.2 – PIV Card Post Issuance Update Requirements

MP-2 In the case of re-issuance and termination, the PIV Card is collected and destroyed whenever possible. If the PIV Card cannot be collected and destroyed, the CA is informed and the certificates corresponding to the PIV Authentication key and the asymmetric Card Authentication key on the PIV Card are revoked. The certificates corresponding to the digital signature and key management keys are also revoked, if present.

Assessment Determine that: (i) in the case of reissuance and termination, the requirement that the PIV Card is collected and destroyed whenever possible is documented and performed (review, observe); (ii) the issuer has procedures to notify the CA in the event the PIV Card cannot be collected (review, observe). [FIPS 201-2] , Section 2.9.1 – PIV Reissuance

[FIPS 201-2] , Section 2.9.4 - PIV Card Termination

MP-3 During PIV Card re-issuance and termination any databases maintained by the PIV Card issuer that indicate current valid (or invalid) FASC-N or UUID values are updated to reflect the change in status.

Assessment Determine that: (i) databases maintained by the issuer that indicate FASC- N or UUID values are updated to reflect the change in status (review, observe); [FIPS 201-2] , Section 2.9.1 – PIV Reissuance

[FIPS 201-2] , Section 2.9.4 - PIV Card Termination

MP-4 If the PIV Card cannot be collected and destroyed, normal revocation procedures are completed within 18 hours of notification.

Assessment Determine that: (i) documentation includes the requirement that if PIV Card cannot be collected and destroyed, normal revocation procedures are completed within 18 hours of notification (review); (ii) if the PIV Card cannot be collected and destroyed, normal revocation procedures are completed within 18 hours of notification (observe). [FIPS 201-2] , Section 2.9.1 – PIV Reissuance

[FIPS 201-2] , Section 2.9.4 - PIV Card Termination

MP-5 Upon PIV Card termination, the organization enforces a standard methodology of updating systems of records to indicate the PIV Card status, and this information is distributed effectively throughout systems used for physical and logical access to Authorization Focus Area Identifier Issuer Control Source organization facilities and resources.

Assessment Determine that: (i) the issuing facility has procedures to update information systems and disseminate information to indicate PIV Card termination (review); (ii) the organization’s information systems are updated to indicate PIV Card termination ( observe);. (iii) the PIV Card termination status is distributed to all logical and physical access points as applicable (test).

MP-6 This control has been withdrawn. The requirement to post a quarterly report to the organization’s website (and report the website to OMB) is already covered in OMB Memorandum 07-06. OMB Memorandum [M 07-06]

MP-7 The organization has completed a lifecycle walkthrough at one year intervals since the last authorization date, and the results are documented in a report to the DAO.

Assessment Determine that : (i) the organization has completed a lifecycle walkthrough to cover sponsorship, identity proofing, card production, activation/issuance and maintenance processes (interview); (ii) a lifecycle walkthrough has been completed at one year intervals since the last authorization date (interview); (iii) the results of the issuer lifecycle walkthrough have been documented and reviewed by the DAO (review, interview). SP 800-79-2, Section 5.4 - Monitoring Phase

MP-8 (NEW) The card issuer reissues a PIV Card without repeating the identity proofing and registration process if: (i) the issuer has access to the applicant’s chain-of-trust record and the applicant can be reconnected to the chain-of-trust record, or (ii). if the match is unsuccessful, or if no biometric data is available, the cardholder provides two identity source documents (as specified in Section 2.7 of [FIPS 201-2] ), and an attending operator inspects these and compares the cardholder with the facial image retrieved from the enrollment data record and the facial image printed on the new PIV Card.

Assessment Determine that: (i) the issuing facility verifies that PIV Card issuance has been authorized by a proper authority and that the employee’s or contractor’s background investigation is valid (review, observe); (ii) Re-investigations are performed if required, in accordance with OPM guidance (review); (iii) The issuing facility is able to reconnect the applicant to the chain-of-trust per [FIPS 201-2] issuance requirements (observe). (iv) The issuing facility has alternate procedures to release the PIV Card when the biometric match is unsuccessful (review, observe); [FIPS 201-2] , Section 2.8.2 – Grace Period

[FIPS 201-2] , Section 2.9.1 - PIV Card Reissuance

[FIPS 201-2] , Section 2.9.1.1
- Special Rule for Name Change by Cardholder Authorization Focus Area Identifier Issuer Control Source (v) Any data change about the cardholder, is recorded by the issuer in the chain-of-trust, if applicable (review, observe); (vi) Name changes are performed in accordance with Section 2.9.1.1 of [FIPS 201-2] (review, observe). MP-9 (NEW) The entire identity proofing, registration, and issuance process is repeated if the issuer: (i) does not maintain a chain-of-trust record for the cardholder or (ii) if the reissuance process was not started before the old PIV Card expired.

Assessment Determine that: (i) the issuing completes the entire identity proofing, registration and issuance process if they don’t maintain a chain of trust or if the reissuance process was not started before the old PIV Card expired (review, observe). [FIPS 201-2] , Section 2.9.1 - PIV Card Reissuance

MP-10 (NEW) Previously collected biometric data is not reused with the new PIV Card if the expiration date of the new PIV Card is no later than 12 years after the date that the biometric data was obtained.

Assessment Determine that: (i) the issuing facility ensures that new biometric data is collected if the new PIV Card’s expiration is 12 years after the collection of the initial biometric data available with the issuer (review, observe). [FIPS 201-2] , Section 2.9.1 - PIV Card Reissuance

MP-11 (NEW) Post issuance updates (either performed with the issuer in physical custody of the PIV Card or remotely) is performed with issuer security controls equivalent to those applied during PIV Card reissuance. These include the following: (i) communication between the PIV Card issuer and the PIV Card occurs only over mutually authenticated secure sessions between tested and validated cryptographic modules (one being the PIV Card); (ii) data transmitted between the issuer and PIV Card is encrypted and contain data integrity checks; (iii) the PIV Card Application will communicate with no end point entity other than the PIV Card issuer during the remote post issuance update.

Assessment Determine that: (i) post issuance updates include all required security controls be implemented by the issuer and the issuer information systems (review). [FIPS 201-2] , Section 2.9.2 - PIV Card Post Issuance Update Requirements

MP-12 (NEW) When a PIN reset is performed in-person at the issuing facility, before providing the reset PIV Card back to the cardholder, the issuer performs a 1:1 biometric match to ensure that the cardholder's biometric matches either the stored biometric on the PIV Card or biometric data stored in the chain-of-trust. In cases where a biometric match is not possible, the cardholder provides the PIV Card to be reset and another primary identity source document (as specified in Section 2.7 of [FIPS 201-2] ). An attending operator inspects these and compares the cardholder with the facial image retrieved from the enrollment data record [FIPS 201-2] , Section 2.9.3 - PIV Card Verification Data Reset Authorization Focus Area Identifier Issuer Control Source and the facial image printed on the card.

Assessment Determine that: (i) the issuer performs a 1:1 biometric match of the cardholder against the biometric included in the PIV Card or in the PIV chain of trust prior to providing the reset PIV Card back to the cardholder (observe, test); (ii) the issuer has alternate processes in place for situations where biometric matches are not possible (review, observe).

MP-13 (NEW) When a PIN reset is performed at an unattended issuer-operated kiosk, the issuer ensures that the PIV Card is authenticated and that the cardholder’s biometric matches either the stored biometric on the PIV Card, through an on-card 1:1 biometric match, or biometric data stored in the chain-of-trust, through an off-card 1:1 biometric match. If the biometric match or card authentication is unsuccessful, the kiosk does not reset the PIV Card.

Assessment Determine that: (i) the issuer’s kiosk performs a 1:1 biometric match of the cardholder against the biometric included in the PIV Card or in the chain of trust prior to resetting the PIV Card (observe, test). [FIPS 201-2] , Section 2.9.3 - PIV Card Verification Data Reset

MP-14 (NEW) Remote PIN reset on a general computing platform (e.g., desktop, laptop) is only performed by the issuer if the following requirements are met: (i) the cardholder initiates a PIN reset with the issuer operator, (ii) the operator authenticates the owner of the PIV Card through an out-of-band authentication procedure (e.g., pre-registered knowledge tokens); (iii) the cardholder’s biometric matches the stored biometric on the PIV Card through a 1:1 on-card biometric comparison.

Assessment Determine that: (i) remote PIN resets meet all security requirements to be implemented by the issuer and the issuer information systems (review, observe, test). [FIPS 201-2] , Section 2.9.3 - PIV Card Verification Data Reset

MP-15 (NEW) Before any verification data (e.g., PIN, OCC fingerprint templates, etc.) is reset, the issuer performs a 1:1 biometric match of the cardholder to reconnect to the chain-of-trust. The type of biometric used for the match is not the same as the type of biometric data that is being reset. If no alternative biometric data is available, the cardholder provides the PIV Card to be reset and another primary identity source document (as specified in Section 2.7 of [FIPS 201-2] ). An attending operator inspects these and compares the cardholder with the facial image retrieved from the enrollment data record and the facial image printed on the PIV Card.

Assessment [FIPS 201-2] , Section 2.9.3 - PIV Card Verification Data Reset Authorization Focus Area Identifier Issuer Control Source Determine that: (i) the issuer performs a 1:1 biometric match of the cardholder against the biometric included in the PIV Card or in the chain of trust prior to providing the reset PIV Card back to the cardholder (observe, test); (ii) The same type of biometric used for the match is not the same as the type of biometric data that is being reset (observe, test); (iii) the issuer has alternate processes in place for situations where biometric matches are not possible (review, observe). Table G.2: Controls and Assessment Procedures for Derived PIV Credential Issuers (DPCIs)

This table specifies the controls and assessment procedures for the Derived PIV Credential and its related token. The controls in this section are mapped to the PCI controls in G.1 to assist issuers that intend to issue both types of credentials. Unlike for a PIV Card Issuer, not all issuer controls are applicable to a Derived PIV Credential Issuer. Certain issuer controls are applicable to only LOA-3 or to only LOA-4 Derived PIV Credentials and therefore must be implemented by the issuer only if they are issuing that level of a Derived PIV Credential. This is represented via the “ applicability ” column within this table. Controls with an applicability column marked with DPCI (e.g., without LOA-4 or 3 postfix) apply to both LOA-3 and LOA-4 Derived PIV Credential.

Authorization Focus A rea Identifier Issuer Control Applicability Source Preparation and Maintenance of Documentation DO(DC)-1 The organization develops and implements an issuer operations plan according to the template in Appendix D.2 . The operations plan references other documents as needed.

Assessment Determine that: (i) the operations plan includes the relevant elements from the template in Appendix D.2 (review); (ii) the operations plan includes the list of issuer controls and the issuer control owner for each, how they were implemented and whether they are organization or facility specific (review); (iii) documentation that is not included in the operations plan is referenced accurately (review); (iv) the operations plan has been reviewed and approved by the DAO within the organization (review, interview). DPCI SP 800-79-2, Section 2.11 – Authorization Package and Supporting Documentation

DO(DC)-3 The organization has a written policy and procedures for initial issuance that are approved by the Federal department or agency.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for issuance (review); (ii) the policy is consistent with the organization’s mission and functions, [FIPS 201-2] , and, [SP 800-157] and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the Federal department or agency (review); (iv) the organization will periodically review and DPCI [SP 800-157] , Section 2 Lifecycle Activities and Related Requirements

[SP 800-157] , Section 2.2 – Initial Issuance Authorization Focus A rea Identifier Issuer Control Applicability Source update the policy and procedures as required (review, interview).

DO(DC)-5 The organization has a written policy and procedures describing the conditions for Derived PIV Credential termination.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for Derived PIV Credential termination (review); (ii) the policy is consistent with the organization’s mission and functions, [FIPS 201-2] and [SP 800-157] and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the organization will periodically review and update the policy as required (review, interview). DPCI [SP 800-157] , Section 2 Lifecycle Activities and Related Requirements

[SP 800-157] , Section 2.3 – Maintenance

DO(DC)-6 The organization has a written policy and procedures describing the conditions for Derived PIV Credential maintenance.

Assessment Determine that : (i) the organization has developed and documented a written policy and procedures for Derived PIV Credential maintenance (review); (ii) the policy is consistent with the organization’s mission and functions, [FIPS 201-2] and [SP 800-157] and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the organization will periodically review and update the policy and procedures as required (review, interview). DPCI [SP 800-157] , Section 2 Lifecycle Activities and Related Requirements

[SP 800-157] , Section 2.3 -Maintenance Authorization Focus Area Identifier Issuer Control Applicability Source Assignment of Roles and Responsibilities RR(DC)-1 The organization has appointed the role of Senior Authorizing Official (SAO).

Assessment Determine that : (i) the organization has defined the role of Senior Authorizing Official and its responsibilities according to the requirements of SP 800-79-2 (review); (ii) the organization has assigned the role of Senior Authorizing Official (review). DPCI SP 800-79-2, Section 2.6 –Issuer Roles and Responsibilities

RR(DC)-2 The organization has appointed the role of Designated Authorizing Official (DAO).

Assessment Determine that : (i) the organization has defined the role of Designated Authorizing Official and its responsibilities according to the requirements of SP 800-79-2 (review); (ii) the organization has assigned the role of Designated Authorizing Official (review, interview). DPCI SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities

RR(DC)-3 The organization has appointed the role of Organization Identity Management Official (OIMO).

Assessment Determine that : (i) the organization has defined the role of Organization Identity Management Official and its responsibilities according to the requirements of SP 800-79-2 (interview); (ii) the organization has assigned the role of Organization Identity Management Official (review, interview). DPCI SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities

RR(DC)-4 The organization has appointed the role of Assessor.

Assessment Determine that : (i) the organization has defined the role of Assessor and its responsibilities according to the requirements of SP 800-79-2 (review); (ii) the organization has assigned the role of Assessor (review); (iii) the Assessor is a third party that is independent of, and organizationally separate from, the persons and office(s) directly responsible for the day-to-day operation of the organization (review, interview). DPCI SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities Authorization Focus Area Identifier Issuer Control Applicability Source RR(DC)-5 The organization has appointed the role of Privacy Official (PO).

Assessment Determine that : (i) the organization has defined the role of Privacy Official and its responsibilities according to the requirements of SP 800-79- 2 (review); (ii) the organization has assigned the role of Assessor (review); (iii) the Privacy Official does not have any other roles in the organization (review, interview). DPCI [FIPS 201-2] , Section 2.11 - PIV Privacy

SP 800-79-2, Section 2.6 – Issuer Roles and Responsibilities

Authorization Focus Area Identifier Issuer Control Applicability Source Facility and Personnel Readiness Facility FP(DC)-1 Minimum physical controls at the issuing facility are implemented. These include: (i) use of locked rooms, safes, and lockable cabinets (as appropriate); (ii) physical access to key areas within the facility is restricted to authorized personnel, (iii) security monitoring and automated alarms are implemented, (iv) emergency power and lighting are available, and (v) fire prevention and protection mechanisms are implemented.

Assessment Determine that: (i) the OIMO and Issuing Facility Manager(s) are aware of the minimum set of physical controls that need to be in place at the facility(ies) (interview); (ii) the minimum physical security controls are implemented by the issuing facility (observe). DPCI - LOA 4 Only Commonly accepted

FP(DC)-2 Issuer Documentation (e.g., operations plan, standard operating procedures, and contracts) are maintained.

Assessment Determine that: (i) the most current versions of the issuer documentation is available for reference as needed (interview, review). DPCI Commonly accepted

Equipment Authorization Focus Area Identifier Issuer Control Applicability Source FP(DC)-3 The issuer has developed and maintains a contingency/disaster recovery plan for the information systems, which is stored securely.

Assessment Determine that : (i) the contingency plan/ disaster recovery plan is stored securely (interview, observe); (ii) the issuer personnel are knowledgeable on how to restore/reconstitute the information systems in case of system failures (interview). DPCI Commonly accepted

FP(DC)-4 The information systems are managed using a system development life cycle (SDLC) methodology that includes information security considerations as outlined in SP 800-37.

Assessment Determine that : (i) the information system used by the organization has been developed using an SDLC methodology (review, interview); (ii) information system security is considered as part of the development life cycle (review). DPCI [SP 800-37-1] , Section 2.2

FP(DC)-5 Derived PIV Credential activation and issuance workstations are situated in an enclosed area (wall or partition) to provide privacy for the subscriber and the operator.

Assessment Determine that : (i) Issuing facility workstations are situated in an enclosed area (wall or partition) such that unauthorized individuals cannot see subscriber information (observe). DPCI - LOA 4 Only Commonly accepted

Key Personnel Authorization Focus Area Identifier Issuer Control Applicability Source FP(DC)-6 All operators who perform roles of initial issuance, maintenance, or termination are allowed access to information systems only when authenticated through a PIV Card.

Assessment Determine that : (i) the requirement that all operators who perform roles in the areas of initial issuance, maintenance or termination are allowed logical access to information systems only when authenticated through a PIV Card, has been documented in the standard operating procedures (review); (ii) Operators use PIV Cards to access information systems in the course of performing their roles within the Derived PIV Credential lifecycle processes (observe). DPCI OMB Memorandum 11-11

FP(DC)-7 All operators who perform roles within the areas of initial issuance, maintenance and termination have undergone training that is specific to their duties prior to being allowed to perform in that function.

Assessment Determine that : (i) all operators who perform roles in the areas of initial issuance, maintenance and termination are allowed access to information systems only after completing a training course specific to their duties. (interview, review); (ii) Records showing that the appropriate training course has been completed by issuer personnel are stored for audit purposes (interview, review). DPCI Commonly accepted Authorization Focus Area Identifier Issuer Control Applicability Source FP(DC)-8 All pre-personalized removable (non-embedded) hardware cryptographic tokens (e.g., SD Card, UICC, USB) received from token vendors are received only by authorized personnel who ensure that these tokens are stored, handled and disposed off securely at the issuing facility.

Assessment Determine that : (i) the issuing facility has an authorized list of personnel that are responsible for ensuring that token stock is received and stored securely (interview); (ii) procedures for receiving, storing and destroying tokens are documented in the issuing facility’s standard operating procedures (review); (iii) the authorized personnel are knowledgeable of the procedures on how to receive, store and destroy the tokens (interview). DPCI - LOA 4 Only Commonly accepted

FP(DC)-9 The organization maintains a current list of designated points of contact and alternate points of contact for all issuing facilities used by the organization for Derived PIV Credential issuance, maintenance and termination processes.

Assessment Determine that : (i) the organization maintains a list of designated points of contact and alternate points of contact for all issuing facilities used by the organization (review); (ii) the list is current and the individuals named are the correct points of contact (review and interview). DPCI - LOA 4 Only Commonly accepted Authorization Focus Area Identifier Issuer Control Applicability Source Protection of Stored and Transmitted Data ST(DC)-1 The issuer information systems that contain information in identifiable form are handled in compliance with Federal laws and policies, including the Privacy Act of 1974.

Assessment Determine that : (i) the organization does not disclose any record which is contained in the system of records to any person, or to another organization unless written consent has been given by the individual to whom the record pertains unless one of the exceptions for disclosure in the Privacy Act are met (review, interview); (ii) individuals are permitted to gain access to their personal record and the information is provided in a form comprehensible to them (review, interview); (iii) individuals are able to request amendments to records pertaining to them, corrections are made promptly and if not, the individual is provided with a reason for the refusal and is able to request a review of the refusal (review, interview); (iv) the organization notifies an individual when their record is made available to any person under a compulsory legal process when such a process becomes a matter of public record (review, interview). DPCI [FIPS 201-2] , Section 2.11
- PIV Privacy

ST(DC)-2 The information systems protect the integrity and confidentiality of transmitted information.

Assessment Determine that : (i) the integrity of transmitted information is protected (interview, test, review); (ii) the confidentiality of transmitted information is protected (interview, test, review). DPCI [FIPS 201-2] , Section 2.11
- PIV Privacy

[SP 800-157] , Section 2.2
- Initial Issuance Authorization Focus Area Identifier Issuer Control Applicability Source Enforcement of Privacy Requirements PR(DC)-1 Privacy act statement/notice, complaint procedures, appeals procedures for those denied Derived PIV Credentials or whose credentials are revoked, and sanctions for employees violating privacy policies are developed and posted by the organization in multiple locations (e.g., internet site, human resource offices, regional offices, and contractor orientation handouts). Assessment Determine that : (i) the issuer has posted privacy act statement/notice, complaint procedures, appeals procedures for those denied a token or whose token are revoked, and sanctions for employees violating privacy policies (interview, review). DPCI OMB Memorandum [ M-05- 24]

PR(DC)-2 The organization has conducted a Privacy Impact Assessment of their issuer information system (s), compliant with Section 208 of the E-Government Act of 2002 and based on guidance found in Appendix E of OMB Memorandum 06-06. Assessment Determine that: (i) the organization has conducted a Privacy Impact Assessment of their issuer information system(s) based on guidance found in Appendix E of OMB Memorandum 06-06 (review); (ii) the organization has submitted the Privacy Impact Assessment of their issuer information system (s) to OMB (interview, review). DPCI OMB Memorandum [ M-05- 24]

OMB Memorandum [M-06- 06] (Appendix E)

PR(DC)-3 The organization’s employee and contractor identification systems of records notices (SORN’s) are updated to reflect any changes in the disclosure of information to other organizations in order to be consistent with the Privacy Act of 1974 and OMB Circular A-130, Appendix 1. Assessment Determine that: (i) the organization updates SORN’s to reflect changes in the disclosure of information (review, interview). DPCI OMB Memorandum [ M-05- 24] Authorization Focus Area Identifier Issuer Control Applicability Source PR(DC)-4 The subscriber is notified of what information in identifiable form is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information. Assessment Determine that: (i) Before receiving the Derived PIV Credential , the issuer requires the subscriber to be notified of the personally identifiable information that is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (review, observe); (ii) the subscriber is informed of what personally identifiable information is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (interview). DPCI [FIPS 201-2] , Section 2.11 – PIV Privacy

PR(DC)-5 The issuer employs technologies that allow for continuous auditing of compliance with privacy policies and practices. Assessment Determine that: (i) the issuer employs technologies that allow for the continuous auditing of compliance with privacy policies and practices. This could include the use of technology to monitor data access, data flows between information systems and the use of personally identifiable information (interview, test). DPCI [FIPS 201-2] , Section 2.11 – PIV Privacy

PR(DC)-6 In the case of termination, any personally identifiable information that has been collected from the subscriber is disposed of in accordance with the stated privacy and data retention policies. Assessment Determine that: (i) as part of Derived PIV Credential termination, the organization disposes of personally identifiable information in accordance with its privacy and data retention policies (review, interview). DPCI [FIPS 201-2] , Section 2.9.4 – PIV Card Termination Authorization Focus Area Identifier Issuer Control Applicability Source Deployed Products & Information Systems DP(DC)-1 In order to be compliant with the provisions of OMB Circular A-130, App III, the issuer information system(s) are authorized to operate in accordance with NIST [SP 800-37-1] , Guide for Applying the Risk Management Framework to Federal Information Systems A Security Life Cycle Approach

Assessment Determine that: (i) the organization has a letter showing the current authorization decision of each information system used to support the issuer (review). DPCI [FIPS 201-2] , Appendix A.2 Application of Risk Management Framework to IT System(s) Supporting PCI

[FIPS 201-2] , Section 2.11 – PIV Privacy

DP(DC)-2 Products directly utilized by an issuing facility to issue a Derived PIV Credential is from the GSA FIPS 201 Evaluation Program’s Approved Products List (APL) where applicable. 16

Assessment Determine that: (i) for each product that falls within one of the categories in the FIPS 201 Evaluation Program , its presence (make, model, versions) is checked on the APL (review); (ii) no product in operation has been moved to the GSA FIPS 201 Evaluation Program Removed Products List (RPL). DPCI OMB Memorandum [ M-05- 24]

Federal Acquisition Regulation ( FAR ), Section 4.1302 Acquisition of approved products and services for personal identity verification.

DP(DC)-3 The organization has submitted to the FIPS 201 Evaluation Program for testing Derived PIV Credential tokens in the chosen target formats the organization supports. 17

Assessment Determine that: (i) the organization has test report(s) from the FIPS 201 Evaluation Program showing successful conformance of each format supported by the organization to the Derived PIV Credential Data Model (review). (ii) The organization continues to submit personalized Derived PIV Credential tokens on an annual basis to the FIPS 201 Evaluation Program for testing (review). DPCI OMB Memorandum [M 07- 06]

16 This control will be applicable when approval procedures, test procedures and test tools for Derived PIV Credentials are available through GSA. 17 This control will be applicable when GSA commences testing activities for Derived PIV Credentials. Authorization Focus Area Identifier Issuer Control Applicability Source Implementation of Credentialing Infrastructures CI(DC)-2 Derived PIV Authentication certificates are issued under either: (i) the id-fpki-common-derived-pivAuth-hardware (LOA-4) or the id-fpki-common-derived-pivAuth (LOA-3) policy of the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework.

Assessment Determine that: (i) the PKI is listed on the Federal PKI Policy Authority’s website as being a provider of Derived PIV Credential certificates (review). DPCI [SP 800-157] , Section 3.1 – Certificate Policies

CI(DC)-11 (NEW) For Derived PIV Authentication certificates issued under id-fpki-common-derived-pivAuth-hardware, the Derived PIV Authentication key pair is generated within a hardware cryptographic module that has been validated to [FIPS140-2] Level 2 or higher that provides Level 3 physical security to protect the Derived PIV Authentication private key while in storage and that does not permit exportation of the private key.

Assessment Determine that: (i) the organization ensures that Derived PIV Authentication certificates issued under id-fpki- common-derived-pivAuth-hardware certificate policy are generated on cryptographic modules validated against [FIPS140-2] at Level 2 or higher with Level 3 physical security (review). DPCI - LOA [SP 800-157] , Section 3.2 – Cryptographic Specifications

CI(DC)-12 (NEW) For Derived PIV Authentication certificates issued under id-fpki-common-derived-pivAuth, the Derived PIV Authentication key pair is generated within a cryptographic module that has been validated to [FIPS140-2] Level 1 or higher.

Assessment Determine that: (i) the organization ensures that Derived PIV Authentication certificates issued under id-fpki- common-derived-pivAuth certificate policy are generated on [FIPS140-2] validated cryptographic modules or higher (review). DPCI - LOA 3 Only [SP 800-157] , Section 3.2 – Cryptographic Specifications Authorization Focus Area Identifier Issuer Control Applicability Source CI(DC)-13 (NEW) A Derived PIV Credential issuer shall only issue a Derived PIV Credential to an Applicant if it has access to information about the Applicant’s PIV Card from the issuer of the PIV Card. In particular the Derived PIV Credential issuer shall have a mechanism to periodically check with the PIV Card issuer to determine if the PIV Card has been terminated or if information about the individual that will appear in the Derived PIV Credential (e.g., name) has changed, as these would require revocation or modification of the Derived PIV Credential. Examples of such mechanisms include: (i) if the Derived PIV Credential is issued by the same organization that issued the subscriber’s PIV Card, the linkage between the two credentials is maintained through the common Identity Management System (IDMS) database, (ii) if the issuer is different from the PCI, the Backend Attribute Exchange can be queried for the termination status of the PIV Card and attribute changes, (iii) if the issuer is different, from the PCI, the issuer of the PIV Card maintains a list of corresponding Derived PIV Credential issuers and sends notification to the latter set when the PIV Card is terminated, (iv) if the issuer is different from the PCI, a Uniform Reliability and Revocation Service (URRS) can be implemented in accordance with Section 3.7 of [NIST IR 7817] ,

Assessment Determine that: (i) the issuer has developed procedures for updating Derived PIV Credentials data as a result of a change to PIV Card information (review); (ii) the issuer of the Derived PIV Credential does not solely rely on tracking the revocation status of the PIV Authentication certificate as a means of tracking the termination status of the PIV Card (review); (iii) The issuer has implemented one or more mechanisms to trigger an update to the Derived PIV Credential as a result of a change to the PIV Card (review, observe). DPCI [SP 800-157] , Section 2.3 – Maintenance

[SP 800-157] , Section 2.4 – Linkage with PIV Card

CI(DC)-14 (NEW) The issuer retains for future reference the biometric sample used to validate the Applicant.

Assessment Determine that: (i) the issuer has implemented a process/system to retain the Applicant’s biometric for maintenance of the Derived PIV Credential (review). [SP 800-157] , Section 2.2 – Authorization Focus Area Identifier Issuer Control Applicability Source Sponsorship Process SP(DC)-1 A Derived PIV Credential is issued only upon request by proper authority.

Assessment Determine that: (i) the process for making a request is documented (review); (ii) A request from a valid authority is made in order to issue a Derived PIV Credential (observe). DPCI [FIPS 201-2] , Section 2.1 – Control Objectives

SP(DC)-2 The issuing facility collects personal information using only forms approved by OMB under the Paperwork Reduction Act of 1995.

Assessment Determine that : (i) forms used to collect personal information have been approved by OMB (review, observe). DPCI OMB Memorandum [M 07- 06]

Authorization Focus Area Identifier Issuer Control Applicability Source Identity Proofing (i.e., Derivation) / Registration Process EI(DC)-1 A Derived PIV Credential is issued following verification of the subscriber’s identity using the PIV Authentication key on his or her existing PIV Card by performing: (i) the PIV Authentication certificate is validated as being active and not revoked prior to issuance of a Derived PIV Credential, (ii) the subscriber must demonstrate possession and control of the related PIV Card via the PKI-AUTH authentication mechanism as per section 6.2.3.1 of [FIPS 201-2] , (iii) the revocation status of the subscriber’s PIV Authentication certificate is rechecked seven (7) calendar days following issuance of the Derived PIV Credential.

Assessment Determine that: (i) the issuer has a documented process in place to verify the identity of the subscriber’s identity (review); (ii) the issuer’s process is compliant with the requirements for issuance of Derived PIV Credentials ( observe). DPCI [SP 800-157] , Section 2.2 – Authorization Focus Area Identifier Issuer Control Applicability Source Issuance/ Activation Process AI(DC)-5 A mechanism to block use of the Derived PIV Authentication private key after a number of consecutive failed authentication attempts is implemented.

Assessment Determine that: (i) the implementation can block use of Derived PIV Credential’s private key if the number of consecutive failed attempts has exceeded that set by the issuer (test, observe). (ii) Throttling mechanisms may also be used to limit the number of attempts that may be performed over a given period of time. DPCI [SP 800-157] , Section 3.4 – Activation Data

AI(DC)-16 (NEW) An LoA-3 Derived PIV Credential could be issued remotely. If the issuance process involves two or more electronic transactions when issuing an LoA-3 Derived PIV Credential remotely, the subscriber identifies himself/herself in each new encounter by presenting a temporary secret that was issued in a previous transaction, as described in Section 5.3.1 of [SP 800- 63-2] .

Assessment Determine that: (i) the issuer implements a process conformant to [SP 800-63-2] when multiple transactions are involved in issuing a Derived PIV Credential remotely at LOA 3 (review, observe), (ii) the issuer uses communications that are authenticated and protected from modification (e.g., using Transport Layer Security (TLS)), and that encryption is used, if necessary, to protect the confidentiality of any private or secret data (review and observe). 3 Only [SP 800-157] , Section 2.2 -

AI(DC)-17 (NEW) An LOA-4 Derived PIV Credential is issued in person, in accordance with [SP 800-63-2] , and the subscriber identifies himself/herself using a biometric sample that can be verified against the subscriber’s PIV Card.

Assessment Determine that: (i) the issuer implements a process conformant to [SP 800-63-2] and where a biometric sample of the subscriber is verified prior to issuance of the Derived PIV Credential (review, observe) [SP 800-157] , Section 2.2 - Authorization Focus Area Identifier Issuer Control Applicability Source AI(DC)-18 (NEW) If there are two or more transactions during the issuance process of an LOA-4 Derived PIV Credential, the subscriber identifies himself/herself using a biometric sample that can either be verified against the PIV Card or against a biometric that was recorded in a previous transaction.

Assessment Determine that: (i) the issuer implements a compliant process when multiple transactions are involved in issuing a Derived PIV Credential at LOA4 (review, observe) [SP 800-157] , Section 2.2 - Authorization Focus Area Identifier Issuer Control Applicability Source Maintenance Process MP(DC)-2 If the token corresponding to the Derived PIV Credential is lost, stolen, damaged or compromised, the Derived PIV Authentication certificate is revoked in accordance with the underlying certificate policy.

Assessment Determine that: (i) in the case of lost, stolen, damaged or compromised credential the issuer has processes in place to revoke the Derived PIV Authentication certificate (review, observe, test). DPCI [SP 800-157] , Section 2.3 - Maintenance

MP(DC)-5 Upon Derived PIV Credential termination, the organization enforces a standard methodology of updating systems of records to indicate Derived PIV Credential status, and this status is distributed effectively. Assessment Determine that: (i) the issuer has procedures to update information systems and disseminate information to indicate Derived PIV Credential termination (review); (ii) the organization’s information systems are updated to indicate Derived PIV Credential termination ( observe); (iii) the Derived PIV Credential termination status is distributed to remote access points as applicable (test). DPCI Commonly accepted security

MP(DC)-7 The organization has completed a lifecycle walkthrough at one year intervals since the last authorization date, and the results are documented in a report to the DAO.

Assessment Determine that : (i) the organization has completed a lifecycle walkthrough to cover initial issuance, maintenance and termination processes (interview); (ii) a lifecycle walkthrough has been completed at one year intervals since the last authorization date (interview); (iii) the results of the issuer lifecycle walkthrough have been documented and reviewed by the DAO (review, interview). DPCI SP 800-79-2, Section 5.4 - Monitoring Phase

MP(DC)-11 (NEW) When certificate re-key or modification is performed remotely for an LOA-4 Derived PIV Credential, the following applies: (i) communication between the issuer and the cryptographic module in which the Derived PIV Authentication private key is stored occurs only over mutually authenticated secure sessions between tested and validated cryptographic modules, (ii) data transmitted between the issuer and the cryptographic module in which the Derived PIV Authentication private key is stored is encrypted and contain data integrity checks. [SP 800-157] , Section 2.3 - Maintenance Authorization Focus Area Identifier Issuer Control Applicability Source Assessment Determine that: (i) Remote update for certificate re-key and modification of the LoA-4 Derived PIV Certificate meet all required security controls to be implemented by the issuer and the issuer information systems (review);. (ii) the initial issuance process is followed for a re- key of an expired or compromised Derived PIV credential or a re-key of a Derived PIV Credential at LOA-4 to a new hardware token.

MP(DC)-12 (NEW) When password reset is performed in-person at the issuer's facility, or at an unattended kiosk operated by the issuer, it is implemented through one of the following processes: (i) the Subscriber’s PIV Card is used to authenticate the Subscriber (via PIV-AUTH mechanism as per section 6.2.3.1 of [FIPS 201-2] ) prior to password reset, (ii) a 1:1 biometric match is performed against the biometric sample retained during initial issuance of the Derived PIV Credential, against the biometric on the Chain-of-Trust or against the biometric on the PIV Card.

Assessment Determine that: (i) the issuer’s performs a password reset using a conformant process (review, observe). DPCI - LOA [SP 800-157] , Section 3.4 – Activation Data

MP(DC)-13 (NEW) For remote password reset for LOA 4 Derived PIV Credentials, the subscriber’s PIV Card is used to authenticate the subscriber (via PIV-AUTH authentication mechanism as per Section 6.2.3.1 of [FIPS 201-2] ) prior to password reset. If the reset occurs over a session that is separate from the session over which the PIV-AUTH authentication mechanism was completed, strong linkage (e.g., using a temporary authenticator) is established between the two sessions. The remote password reset is completed over a protected session (e.g., using TLS).

Assessment Determine that: (i) remote password resets meet all security requirements to be implemented by the issuer and the issuer information systems (review, observe, test). [SP 800-157] , Section 3.4 – Activation Data

MP(DC)-16 (NEW) Rekey (and reissuance) of Derived PIV Credentials in cases of expiration, loss, damage, or compromise, as well as issuance of a new hardware token is performed in accordance with the initial issuance process.

Assessment Determine that: (i) the issuer follows the initial issuance process while re-keying or re-issuing a Derived PIV Credential for cases of of expiration, loss, damage, or compromise Derived PIV Credential, DPCI [SP 800-157] , Section 2.3 - Maintenance Authorization Focus Area Identifier Issuer Control Applicability Source as well as issuance of a new hardware token .(review, observe).

MP(DC)-17 (NEW) If the Derived PIV Authentication private key was created and stored on a hardware cryptographic token that does not permit the user to export the private key, then termination of the Derived PIV Credential is performed by collecting and either zeroizing the private key or destroying the token. Otherwise, termination is performed by revoking the Derived PIV Authentication certificate.

Assessment Determine that: (i) the issuer has developed and follows compliant processes to terminate Derived PIV Credentials (review, observe). [SP 800-157] , Section 2.3 – Maintenance

MP(DC)-18 (NEW) A Derived PIV Credential issuer can issue a Derived PIV Credential to an Applicant only if it has access to information about the Applicant’s PIV Card from the issuer of the PIV Card. The Derived PIV Credential issuer shall have a mechanism to periodically check with the PIV Card issuer to determine if the PIV Card has been terminated or if information about the individual that will appear in the Derived PIV Credential (e.g., name) has changed, as these would require revocation or modification of the Derived PIV Credential. Assessment Determine that: (i) the issuer has developed procedures for updating the link between the Derived PIV Credentials data and the PIV Card when a new PIV Card is issued (review); (ii) The issuer implements and maintains one or more mechanisms to update the linkage between the Derived PIV Credential and a PIV Card as a result of a new PIV Card issuance (review, observe, test). DPCI [SP 800-157] , Section 2.4 – Linkage with PIV Card A PPENDIX H: A SSESSMENT AND A UTHORIZATION T ASKS

Phases, Tasks, and Sub - tasks Person(s) Responsible

Initiation Phase

Task 1: Preparation

Subtask 1.1: Confirm that the operations of the issuer have been fully described and documented in an operations plan which fully encompasses the scope of the issuance process (i.e., issuance of PIV Cards and/or Derived PIV Credentials). OIMO

Subtask 1.2: Confirm that processes conducted by the issuing facility are in accordance with the policies and procedures specified in the operations plan and are documented in Standard Operating Procedures. OIMO, Issuing Facility Manager

Task 2: Resource Identification

Subtask 2.1: Identify the Senior Authorizing Official (SAO), Designated Authorizing Official (DAO), Privacy Official (PO), Issuing Facility Managers, Assessor, and other key personnel at the facility level, who are performing identity proofing/registration, card production, activation/issuance and other lifecycle functions. OIMO

Subtask 2.2: Determine the authorization boundary for the issuer. OIMO, DAO

Subtask 2.3: Determine the resources and the time needed for the issuer authorization, and prepare for execution of the assessment. OIMO, DAO

Task 3: Operations Plan Analysis and Acceptance

Subtask 3.1: Review the list of required issuer controls documented in the operation plan to confirm that they have been implemented properly. DAO, OIMO

Subtask 3.2: Analyze the operations plan to determine if there are deficiencies in satisfying all the policies, procedures, and other requirements in FIPS 201- 2 that could result in a DATO being issued. DAO, OIMO

Subtask 3.3: Verify that the operations plan is acceptable. DAO

Assessment Phase

Task 4: Issuer Control Assessment Phases, Tasks, and Sub - tasks Person(s) Responsible

Subtask 4.1: Review the suggested and select assessment methods for each issuer control in preparation for the assessment; identify controls that are applicable based on whether the organization established a PIV Card Issuer (PCI) and/or Derived PIV Credentials Issuer (DPCI). Assessor

Subtask 4.2: Assemble all documentation and supporting materials necessary for the assessment of the issuer; if these documents include previous assessments, review the findings and determine if they are applicable to the current assessment. OIMO, Assessor

Subtask 4.3: Assess the required issuer controls using the prescribed assessment procedures found in Appendix G . Assessor

Subtask 4.4: Prepare the assessment report. Assessor

Task 5: Assessment Documentation

Subtask 5.1: Provide the OIMO with the assessment report. Assessor Subtask 5.2: Revise the operations plan (if necessary) and implement its new provisions. OIMO

Subtask 5.3: Prepare the corrective actions plan (CAP). OIMO Subtask 5.4: Assemble the authorization submission package and submit to the DAO. OIMO

Authorization Phase

Task 6: Authorization Decision

Subtask 6.1: Review the authorization decision package to see if it is complete and that all applicable issuer controls have been fully assessed using the designated assessment procedures. DAO

Subtask 6.2: Determine that the risk to the organization’s operations, assets, or potentially affected individuals is acceptable and that the issuer controls have been adequately assessed. DAO

Subtask 6.3: Share the authorization decision package with an independent party for review and prepare the final authorization decision letter. DAO

Task 7: Authorization Documentation

Subtask 7.1: Provide copies of the final authorization package, in either paper or electronic form, to the OIMO and any other officials having DAO Phases, Tasks, and Sub - tasks Person(s) Responsible interests, roles, or responsibilities in the issuing organization.

Subtask 7.2: Update the operations plan. OIMO

Monitoring Phase

Task 8: Operations Plan Update

Subtask 8.1: Document all relevant changes to the issuer within the operations plan. OIMO

Subtask 8.2: Analyze the proposed or actual changes to the issuer, and determine the impact of such changes. OIMO

Task 9: Annual Lifecycle Walkthrough

Subtask 9.1: Observe all the processes involved in obtaining a PIV Card or a Derived PIV Credential, including those from sponsorship to maintenance. Observe each process, and compare its implementation against the applicable list of required issuer controls. If an issuer has several facilities, this process should be repeated using randomly selected issuing facilities. OIMO (or designated appointee)

Subtask 9.2: The results of the lifecycle walkthrough are summarized in a report to the DAO. Deficiencies must be highlighted along with corrective actions that must be implemented to correct any deficiencies. OIMO, DAO

4.2 The Issuer Assessment Report (was: The Assessment Report)

Title changed

Before · SP 800-79-1

After · SP 800-79-2

Control changed

Before · SP 800-79-1

After · SP 800-79-2

`4.2` The Issuer Assessment Report (was: The Assessment Report)