Appendix B GLOSSARY AND ACRONYMS
All changes in this version
Title changed
Before · SP 800-79-1
GLOSSARY AND ACRONYMS
After · SP 800-79-2
GLOSSARY AND ACRONYMS
Control changed
Before · SP 800-79-1
Access Control The process of granting or denying specific requests to: (i) obtain and use information and related information processing services; and (ii) enter specific physical facilities (e.g., Federal buildings, military establishments, and border-crossing entrances). (as applied to a PCI) The official management decision of the Designated Accreditation Authority to authorize operation of a PCI after determining that the PCI’s reliability has satisfactorily being established through appropriate assessment processes. Accreditation Package The results of assessment and supporting documentation provided to the Designated Accreditation Authority to be used in the accreditation decision process. Agency An executive department specified in 5 U.S.C., Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); or a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91. Applicant An individual applying for a PIV Card. (as applied to a PCI) Assessment in this context means a formal process of assessing the implementation and reliable use of PCI controls using various methods of assessment (e.g., interviews, document reviews, observations) that support the assertion that a PCI is reliably meeting the requirements of FIPS 201-1. Assessment Method A focused activity or action employed by an Assessor for evaluating a particular PCI control. Assessment Procedure A set of activities or actions employed by an Assessor to determine the extent that a PCI control is implemented and used by a PCI. Assessor The individual responsible for conducting assessment activities under the guidance and direction of a Designated Accreditation Authority. ATO Authorization to Operate; One of three possible decisions concerning a PCI made by a Designated Accreditation Authority after all assessment activities have been performed stating that the reliability of the PCI is accredited and the PCI is authorized to perform specific PIV Card services. CAP (Corrective Action Plan) Corrective actions of a PCI for removing or reducing deficiencies or risks during PCI operations. The plan identifies actions that need to be performed in order to obtain or sustain accreditation. Card Activation/Issuance A process that includes the procurement of FIPS-approved blank identity cards, initializing them using appropriate software and data elements for identity verification and access control applications, personalization of the cards with the identity credentials of authorized subjects, and delivery of the personalized cards to the authorized subjects, along with appropriate instructions for protection and use. Component An element, such as a fingerprint capture station or card reader within the PCI, for which FIPS 201-1 makes specific requirements. Credential Evidence attesting to one’s right to credit or authority; in FIPS 201- 1, it is the PIV Card and data elements associated with an individual that authoritatively binds an identity (and, optionally, additional attributes) to that individual. DAA Designated Accreditation Authority; A senior organization official that has been given the authorization to accredit the reliability of a PCI. DATO Denial of Authorization to Operate; issued by a DAA to a PCI that is not accredited as being reliable for the issuance of PIV Cards. Enrollment/Identity Proofing The process that includes: (i) identity proofing and (ii) making a person’s identity known to the PCI information system by associating a unique identifier with that identity, and collecting and recording the person’s relevant attributes into the PCI information system. Enrollment is necessary in order to initiate other processes, such as adjudication, card issuance and maintenance,that are necessary to issue and maintain a PIV Card. FIPS Federal Information Processing Standard HSPD Homeland Security Presidential Directive; HSPD-12 established the policy for which FIPS 201-1was developed. IATO Interim Authorization to Operate a PCI performing specified services (e.g., enrollment/identity proofing, card production, card activation/issuance and maintenance). Identification The process of discovering the true identity (i.e., origin, initial history) of a person or item from the entire collection of similar persons or items. Identifier Unique data used to represent a person’s identity and associated attributes. A name or a card number are examples of identifiers. Identity The set of physical and behavioral characteristics by which an individual is uniquely recognizable. Identity Proofing Verifying the claimed identity of an applicant by authenticating the identity source documents provided by the applicant.
ITL Information Technology Laboratory Maintenance The process of managing PIV Cards once they are issued. It includes termination, renewal and re-issuance. NIST National Institute of Standards and Technology OIMO Organization Identity Management Official; The individual responsible for overseeing the operations of a PCI in accordance with FIPS 201-1 and for performing the responsibilities specified in this guideline. OMB Office of Management and Budget PCI PIV Card Issuer PCI information system A computer-based system used by a PCI to perform the functions necessary for PIV Card issuance as per FIPS 201-1. PCIF PCI Facility PII Personally Identifiable Information; Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. [E-Gov] PIV Personal Identity Verification as specified in FIPS 201-1. PIV Card The physical artifact (e.g., identity card, “smart” card) issued to an applicant by a PCI that contains stored identity markers or credentials (e.g., a photograph, cryptographic keys, digitized fingerprint representations) so that the claimed identity of the cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an automated process (computer readable and verifiable). PO Privacy Official Risk The level of potential impact on an organization operations (including mission, functions, image, or reputation), organization assets, or individuals of a threat or a given likelihood of that threat occurring. SAO Senior Authorizing Official; A senior organization official that has budgetary control, provides oversight, develops policy, and has authority over all functions and services provided by the PCI SOP Standard operating procedures SOR A system of records is a group of records under the control of a Federal agency which contains a personal identifier (such as a name, date of birth, finger print, Social Security Number, and Employee Number) and one other item of personal data (such as home address, performance rating, and blood type) from which information is retrieved using a personal identifier. SORN The Privacy Act requires each agency to publish a notice if its systems of records in the Federal Register. This is called a System of Record Notice (SORN). SP Special Publication
After · SP 800-79-2
Access Control The process of granting or denying specific requests to: (i) obtain and use information and related information processing services; and (ii) enter specific physical facilities (e.g., Federal buildings, military establishments, and border-crossing entrances). (as applied to a PCI) The official management decision of the Designated Accreditation Authority to authorize operation of a PCI after determining that the PCI’s reliability has satisfactorily being established through appropriate assessment processes. Accreditation Package The results of assessment and supporting documentation provided to the Designated Accreditation Authority to be used in the accreditation decision process. Agency An executive department specified in 5 U.S.C., Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); or a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91. Applicant An individual applying for a PIV Card. (as applied to a PCI) Assessment in this context means a formal process of assessing the implementation and reliable use of PCI controls using various methods of assessment (e.g., interviews, document reviews, observations) that support the assertion that a PCI is reliably meeting the requirements of FIPS 201-1. Assessment Method A focused activity or action employed by an Assessor for evaluating a particular PCI control. Assessment Procedure A set of activities or actions employed by an Assessor to determine the extent that a PCI control is implemented and used by a PCI. Assessor The individual responsible for conducting assessment activities under the guidance and direction of a Designated Accreditation Authority. ATO Authorization to Operate; One of three possible decisions concerning a PCI made by a Designated Accreditation Authority after all assessment activities have been performed stating that the reliability of the PCI is accredited and the PCI is authorized to perform specific PIV Card services. CAP (Corrective Action Plan) Corrective actions of a PCI for removing or reducing deficiencies or risks during PCI operations. The plan identifies actions that need to be performed in order to obtain or sustain accreditation. Card Activation/Issuance A process that includes the procurement of FIPS-approved blank identity cards, initializing them using appropriate software and data elements for identity verification and access control applications, personalization of the cards with the identity credentials of authorized subjects, and delivery of the personalized cards to the authorized subjects, along with appropriate instructions for protection and use. Component An element, such as a fingerprint capture station or card reader within the PCI, for which FIPS 201-1 makes specific requirements. Credential Evidence attesting to one’s right to credit or authority; in FIPS 201- 1, it is the PIV Card and data elements associated with an individual that authoritatively binds an identity (and, optionally, additional attributes) to that individual. DAA Designated Accreditation Authority; A senior organization official that has been given the authorization to accredit the reliability of a PCI. DATO Denial of Authorization to Operate; issued by a DAA to a PCI that is not accredited as being reliable for the issuance of PIV Cards. Enrollment/Identity Proofing The process that includes: (i) identity proofing and (ii) making a person’s identity known to the PCI information system by associating a unique identifier with that identity, and collecting and recording the person’s relevant attributes into the PCI information system. Enrollment is necessary in order to initiate other processes, such as adjudication, card issuance and maintenance,that are necessary to issue and maintain a PIV Card. FIPS Federal Information Processing Standard HSPD Homeland Security Presidential Directive; HSPD-12 established the policy for which FIPS 201-1was developed. IATO Interim Authorization to Operate a PCI performing specified services (e.g., enrollment/identity proofing, card production, card activation/issuance and maintenance). Identification The process of discovering the true identity (i.e., origin, initial history) of a person or item from the entire collection of similar persons or items. Identifier Unique data used to represent a person’s identity and associated attributes. A name or a card number are examples of identifiers. Identity The set of physical and behavioral characteristics by which an individual is uniquely recognizable. Identity Proofing Verifying the claimed identity of an applicant by authenticating the identity source documents provided by the applicant.
ITL Information Technology Laboratory Maintenance The process of managing PIV Cards once they are issued. It includes termination, renewal and re-issuance. NIST National Institute of Standards and Technology OIMO Organization Identity Management Official; The individual responsible for overseeing the operations of a PCI in accordance with FIPS 201-1 and for performing the responsibilities specified in this guideline. OMB Office of Management and Budget PCI PIV Card Issuer PCI information system A computer-based system used by a PCI to perform the functions necessary for PIV Card issuance as per FIPS 201-1. PCIF PCI Facility PII Personally Identifiable Information; Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. [E-Gov] PIV Personal Identity Verification as specified in FIPS 201-1. PIV Card The physical artifact (e.g., identity card, “smart” card) issued to an applicant by a PCI that contains stored identity markers or credentials (e.g., a photograph, cryptographic keys, digitized fingerprint representations) so that the claimed identity of the cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an automated process (computer readable and verifiable). PO Privacy Official Risk The level of potential impact on an organization operations (including mission, functions, image, or reputation), organization assets, or individuals of a threat or a given likelihood of that threat occurring. SAO Senior Authorizing Official; A senior organization official that has budgetary control, provides oversight, develops policy, and has authority over all functions and services provided by the PCI SOP Standard operating procedures SOR A system of records is a group of records under the control of a Federal agency which contains a personal identifier (such as a name, date of birth, finger print, Social Security Number, and Employee Number) and one other item of personal data (such as home address, performance rating, and blood type) from which information is retrieved using a personal identifier. SORN The Privacy Act requires each agency to publish a notice if its systems of records in the Federal Register. This is called a System of Record Notice (SORN). SP Special Publication