NIST PIV and digital identity SP 800-79-2

Controls in this version
Ref	Title	Text
1	Introduction	In order to enhance security, increase Federal Government efficiency, reduce identity fraud, and protect personal privacy, Homeland Security Presidential Directive 12 ( [HSPD-12] ), Policy for a Common Identification Standard for Federal Em	changed here
1.1 in 1	Applicability, Intended Audience, and Usage	This document is applicable to, and shall be used by all federal organizations. It may also be used by any other organization (e.g., state and local government, educational, non-profit) desiring close alignment with FIPS 201-2 and associate	changed here
1.2 in 1	Changes for this Revision	The major changes for this revision include additions and updates to issuer controls in response to new or changed requirements in FIPS 201-2. These are:  Inclusion of issuer controls for Derived PIV Credentials Issuers (DPCI),  Addition	changed here
1.3 in 1	Timelines for using the revised Guidelines	This publication is effective immediately and it supersedes the previous version. FIPS 201-2 mandates the implementation of some PIV Card features that were previously optional to implement. The standard also requires that all new or repla	changed here
1.4 in 1	Key Related NIST Publications	The following NIST publications were utilized as the basis for the requirements listed in this document.  FIPS 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS201-2] ;  SP 800-37-1 Rev. 1 , Guide fo	changed here
1.5 in 1	Organization of this Special Publication	The remainder of this publication is organized as follows:  Chapter 2 provides background information needed to understand issuer assessment and authorization methodology, as well as the inputs and outputs involved in the assessment of th	changed here
2	PREPARATION FOR ASSESSMENT AND AUTHORIZATION	This chapter presents the fundamentals of an authorization of a PIV Card Issuer (PCI) and a Derived PIV Credential Issuer (DPCI). It includes: (i) definitions of an issuer and issuing facility; (ii) outsourcing issuer services or functions;	changed here
2.1 in 2	Issuer	At the highest level, an issuer provides a full set of functions required to produce, issue, and maintain PIV Cards or Derived PIV Credentials for an organization. A PCI or DPCI is considered operational if all relevant roles and responsibi	changed here
2.2 in 2	Issuing Facilities	An issuing facility is a physical site or location–including all equipment, staff, and documentation–that is responsible for carrying out one or more of the following PIV functions: (i) identity proofing/registration; (ii) card/token 6 prod	changed here
2.3 in 2	Outsourcing of Issuing Functions	An organization may outsource its issuing functions to one or more organizations. As the complexity and cost of new technology increase, the organization may decide that the most efficient and cost-effective solution for implementing [HSPD-	changed here
2.4 in 2	Assessment and Authorization	[HSPD-12] mandates that identification credentials be “ issued only by providers whose reliability has been established by an official accreditation process .” This document contains guidelines for satisfying the requirements for an officia	changed here
2.5 in 2	Authorization Boundary of the Issuer	The first step in authorizing an issuer is to identify the appropriate authorization boundary. The authorization boundary defines the specific operations that are to be the target of the assessment and authorization. A PCI comprises the com	changed here
2.6 in 2	Issuer Roles and Responsibilities	PIV Card and Derived PIV Credential issuance roles and their processes are to be selected based on the organization’s structure, its mission, and operating environment. The organization must make sure that a separation of roles has been est	changed here
2.6.1 in 2.6	Senior Authorizing Official (SAO)	The Senior Authorizing Official (see Figure 2 ) of an organization is responsible for all operations. The SAO has budgetary control, provides oversight, develops policy, and has authority over all functions and services provided by the issu	changed here
2.6.2 in 2.6	Designated Authorizing Official (DAO)	The Designated Authorizing Official has the authority within an organization to review all assessments of an issuer and its facilities, and to provide an authorization decision as required by [HSPD-12] . Through authorization, the DAO accep	changed here
2.6.3 in 2.6	Organization Identity Management Official (OIMO)	The Organization Identity Management Official is responsible for implementing policies of the organization, assuring that all PIV processes of the issuer are being performed reliably, and providing guidance and assistance to the issuing fac	changed here
2.6.4 in 2.6	Issuing Facility Manager	An Issuing Facility Manager manages the day-to-day operations of an issuing facility. The Issuing Facility Manager is responsible for implementing all operating procedures for those functions that have been designated for that facility by t	changed here
2.6.5 in 2.6	Assessor	The Assessor is responsible for performing a comprehensive and 3 rd -party assessment of an issuer. The Assessor (usually supported by an assessment team) verifies the issuer’s PIV processes comply with control objectives of FIPS 201-2. The	changed here
2.6.6 in 2.6	Applicant Representative (AR)	The Applicant Representative is an optional role and may be established and used at the discretion of the organization. The AR represents the interests of current or prospective employees and contractors who are applicants for PIV Cards or	changed here
2.6.7 in 2.6	Privacy Official (PO)	The responsibilities of the Privacy Official are defined in FIPS 201-2. The person filling this role shall not assume any other operational role within the issuer organization. The PO issues policy guidelines with respect to collection and	changed here
2.6.8 in 2.6	Role Assignment Policies	Although issuer roles are independent and should be filled by different people if feasible, there may be a need (e.g., because of availability or economy) to have one person fill more than one role. Except for the roles of Assessor, Privacy	changed here
2.6.9 in 2.6	Assessment and Authorization Roles	Figure 2 illustrates a possible role structure when an issuer has multiple issuing facilities. The SAO has the primary authority and responsibility for the issuing organization. Reporting to the SAO are the OIMO and the DAO. An Issuing Faci	changed here
2.7 in 2	The Relationship between SP 800-79-2 and SP 800-37-1	While authorization is the major topic of both special publications, the goals of authorization are different in [SP 800-37-1] and SP 800-79-2. Authorization compliant to [SP 800-37-1] , as mandated by Appendix III of the Office of Manageme	changed here
2.8 in 2	Preparing for the Assessment of an Issuer	To facilitate an assessment of an issuer in a timely, efficient, and thorough manner, it is essential that the staff of the issuer and members of the Assessment team understand their specific roles and responsibilities, and participate as n	changed here
2.8.1 in 2.8	Issuer Duties	Before the assessment can begin, an Assessor must be designated. The Assessor conducts the assessment and oversees the assessment team. The assessment team may be made up of employees from the organization or personnel provided by a public	changed here
2.8.2 in 2.8	Assessment Team Duties	The independence of the assessment team is an important factor in assessing the credibility of the assessment results. In order to ensure that the results of the assessment are impartial and unbiased, the members of the assessment team must	changed here
2.9 in 2	Authorization Decisions	An authorization decision is a judgment made by the DAO regarding authorizing operation of an issuer and its facilities. The DAO reviews the results of the assessment, considers the impact to the organization of any identified deficiencies,	changed here
2.9.1 in 2.9	Authorization to Operate (ATO)	If, after reviewing the results of the assessment phase, the DAO deems that the operations of the issuer and its facilities conform to control objectives of FIPS 201-2 to an acceptable degree, and will continue to do so reliably during the	changed here
2.9.2 in 2.9	Interim Authorization to Operate (IATO)	If, after reviewing the results of the assessment phase, the DAO deems the discrepancies to be significant, but there is an overarching necessity to allow the issuer to operate, an interim authorization to operate (IATO) may be issued. 13 A	changed here
2.9.3 in 2.9	Denial of Authorization to Operate (DATO)	If, after reviewing the results of the assessment phase, the DAO deems operation of the issuer to be unacceptable, a denial of authorization to operate (DATO) shall be transmitted to the OIMO. Failure to receive authorization to operate ind	changed here
2.9.4 in 2.9	Authorization Impact of Information Systems under NIST SP 800-37-1	An issuer must not be authorized to operate if one or more of its critical information systems is deemed insecure and therefore is issued a DATO according to [SP 800-37-1] . In the case where an IATO (under [SP 800-37-1] ) has been issued f	changed here
2.10 in 2	The Use of Risk in the Authorization Decision	Authorization is the official management decision by the DAO to permit operation of an issuer based on an assessment of its reliability and an acceptance of the risk inherent in that decision. By granting an authorization to operate, the DA	changed here
2.11 in 2	Authorization Submission Package and Supporting Documentation	The authorization submission package documents the results of the assessment phase and provides the DAO with the essential information needed to make a credible, risk-based decision on whether to authorize operation of the issuer. Unless sp	changed here
3	T AXONOMY OF I SSUER C ONTROLS		changed here
3.1 in 3	Introducing Issuer Controls	Assessment of a PIV Card or Derived PIV Credential Issuer is a broader endeavor than assessment of the security of an information system under [SP 800-37-1] . The requirements specified in [FIPS201-2] cover all major aspects of an issuer, i	changed here
3.2 in 3	Implementing Issuer Controls	Each issuer control must be properly implemented, managed, and monitored in order for the issuer to be authorized. Depending on how an organization decides to implement their [HSPD- 12] program, the authority to implement some of the contro	changed here
3.2.1 in 3.2	Issuer Controls implemented at the Organization or Facility Level	The nature of each issuer control dictates where it is implemented. Controls that are common to or impact multiple PIV processes are implemented at the organization level. The development of the operations plan is an example of an issuer co	changed here
4	I SSUER C ONTROLS A SSESSMENT & A UTHORIZATION D ECISION P ROCESS	An assessment is a set of activities performed by the Assessor to gain assurance that the issuer controls for a PIV Card Issuer or a Derived PIV Credential Issuer have been implemented properly and meet their required function or purpose. U	changed here
4.1 in 4	Assessment Methods	In order to assess the capability and reliability of an issuer, one or more assessment procedures associated with each issuer control have to be completed. An assessment procedure is carried out using one or more of the following assessment	changed here
4.2 in 4	The Issuer Assessment Report	The Assessment report contains the results of the assessment in a format that facilitates reviewing by the DAO. The DAO must evaluate the information in the Assessment Report in order to make a sound, credible decision regarding the residua	changed here

Introduction

In order to enhance security, increase Federal Government efficiency, reduce identity fraud, and protect personal privacy, Homeland Security Presidential Directive 12 ( [HSPD-12] ), Policy for a Common Identification Standard for Federal Em

changed here

1.1

in 1

Applicability, Intended Audience, and Usage

This document is applicable to, and shall be used by all federal organizations. It may also be used by any other organization (e.g., state and local government, educational, non-profit) desiring close alignment with FIPS 201-2 and associate

changed here

1.2

in 1

Changes for this Revision

The major changes for this revision include additions and updates to issuer controls in response to new or changed requirements in FIPS 201-2. These are:  Inclusion of issuer controls for Derived PIV Credentials Issuers (DPCI),  Addition

changed here

1.3

in 1

Timelines for using the revised Guidelines

This publication is effective immediately and it supersedes the previous version. FIPS 201-2 mandates the implementation of some PIV Card features that were previously optional to implement. The standard also requires that all new or repla

changed here

1.4

in 1

Key Related NIST Publications

The following NIST publications were utilized as the basis for the requirements listed in this document.  FIPS 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS201-2] ;  SP 800-37-1 Rev. 1 , Guide fo

changed here

1.5

in 1

Organization of this Special Publication

The remainder of this publication is organized as follows:  Chapter 2 provides background information needed to understand issuer assessment and authorization methodology, as well as the inputs and outputs involved in the assessment of th

changed here

2

PREPARATION FOR ASSESSMENT AND AUTHORIZATION

This chapter presents the fundamentals of an authorization of a PIV Card Issuer (PCI) and a Derived PIV Credential Issuer (DPCI). It includes: (i) definitions of an issuer and issuing facility; (ii) outsourcing issuer services or functions;

changed here

2.1

in 2

Issuer

At the highest level, an issuer provides a full set of functions required to produce, issue, and maintain PIV Cards or Derived PIV Credentials for an organization. A PCI or DPCI is considered operational if all relevant roles and responsibi

changed here

2.2

in 2

Issuing Facilities

An issuing facility is a physical site or location–including all equipment, staff, and documentation–that is responsible for carrying out one or more of the following PIV functions: (i) identity proofing/registration; (ii) card/token 6 prod

changed here

2.3

in 2

Outsourcing of Issuing Functions

An organization may outsource its issuing functions to one or more organizations. As the complexity and cost of new technology increase, the organization may decide that the most efficient and cost-effective solution for implementing [HSPD-

changed here

2.4

in 2

Assessment and Authorization

[HSPD-12] mandates that identification credentials be “ issued only by providers whose reliability has been established by an official accreditation process .” This document contains guidelines for satisfying the requirements for an officia

changed here

2.5

in 2

Authorization Boundary of the Issuer

The first step in authorizing an issuer is to identify the appropriate authorization boundary. The authorization boundary defines the specific operations that are to be the target of the assessment and authorization. A PCI comprises the com

changed here

2.6

in 2

Issuer Roles and Responsibilities

PIV Card and Derived PIV Credential issuance roles and their processes are to be selected based on the organization’s structure, its mission, and operating environment. The organization must make sure that a separation of roles has been est

changed here

2.6.1

in 2.6

Senior Authorizing Official (SAO)

The Senior Authorizing Official (see Figure 2 ) of an organization is responsible for all operations. The SAO has budgetary control, provides oversight, develops policy, and has authority over all functions and services provided by the issu

changed here

2.6.2

in 2.6

Designated Authorizing Official (DAO)

The Designated Authorizing Official has the authority within an organization to review all assessments of an issuer and its facilities, and to provide an authorization decision as required by [HSPD-12] . Through authorization, the DAO accep

changed here

2.6.3

in 2.6

Organization Identity Management Official (OIMO)

The Organization Identity Management Official is responsible for implementing policies of the organization, assuring that all PIV processes of the issuer are being performed reliably, and providing guidance and assistance to the issuing fac

changed here

2.6.4

in 2.6

Issuing Facility Manager

An Issuing Facility Manager manages the day-to-day operations of an issuing facility. The Issuing Facility Manager is responsible for implementing all operating procedures for those functions that have been designated for that facility by t

changed here

2.6.5

in 2.6

Assessor

The Assessor is responsible for performing a comprehensive and 3 rd -party assessment of an issuer. The Assessor (usually supported by an assessment team) verifies the issuer’s PIV processes comply with control objectives of FIPS 201-2. The

changed here

2.6.6

in 2.6

Applicant Representative (AR)

The Applicant Representative is an optional role and may be established and used at the discretion of the organization. The AR represents the interests of current or prospective employees and contractors who are applicants for PIV Cards or

changed here

2.6.7

in 2.6

Privacy Official (PO)

The responsibilities of the Privacy Official are defined in FIPS 201-2. The person filling this role shall not assume any other operational role within the issuer organization. The PO issues policy guidelines with respect to collection and

changed here

2.6.8

in 2.6

Role Assignment Policies

Although issuer roles are independent and should be filled by different people if feasible, there may be a need (e.g., because of availability or economy) to have one person fill more than one role. Except for the roles of Assessor, Privacy

changed here

2.6.9

in 2.6

Assessment and Authorization Roles

Figure 2 illustrates a possible role structure when an issuer has multiple issuing facilities. The SAO has the primary authority and responsibility for the issuing organization. Reporting to the SAO are the OIMO and the DAO. An Issuing Faci

changed here

2.7

in 2

The Relationship between SP 800-79-2 and SP 800-37-1

While authorization is the major topic of both special publications, the goals of authorization are different in [SP 800-37-1] and SP 800-79-2. Authorization compliant to [SP 800-37-1] , as mandated by Appendix III of the Office of Manageme

changed here

2.8

in 2

Preparing for the Assessment of an Issuer

To facilitate an assessment of an issuer in a timely, efficient, and thorough manner, it is essential that the staff of the issuer and members of the Assessment team understand their specific roles and responsibilities, and participate as n

changed here

2.8.1

in 2.8

Issuer Duties

Before the assessment can begin, an Assessor must be designated. The Assessor conducts the assessment and oversees the assessment team. The assessment team may be made up of employees from the organization or personnel provided by a public

changed here

2.8.2

in 2.8

Assessment Team Duties

The independence of the assessment team is an important factor in assessing the credibility of the assessment results. In order to ensure that the results of the assessment are impartial and unbiased, the members of the assessment team must

changed here

2.9

in 2

Authorization Decisions

An authorization decision is a judgment made by the DAO regarding authorizing operation of an issuer and its facilities. The DAO reviews the results of the assessment, considers the impact to the organization of any identified deficiencies,

changed here

2.9.1

in 2.9

Authorization to Operate (ATO)

If, after reviewing the results of the assessment phase, the DAO deems that the operations of the issuer and its facilities conform to control objectives of FIPS 201-2 to an acceptable degree, and will continue to do so reliably during the

changed here

2.9.2

in 2.9

Interim Authorization to Operate (IATO)

If, after reviewing the results of the assessment phase, the DAO deems the discrepancies to be significant, but there is an overarching necessity to allow the issuer to operate, an interim authorization to operate (IATO) may be issued. 13 A

changed here

2.9.3

in 2.9

Denial of Authorization to Operate (DATO)

If, after reviewing the results of the assessment phase, the DAO deems operation of the issuer to be unacceptable, a denial of authorization to operate (DATO) shall be transmitted to the OIMO. Failure to receive authorization to operate ind

changed here

2.9.4

in 2.9

Authorization Impact of Information Systems under NIST SP 800-37-1

An issuer must not be authorized to operate if one or more of its critical information systems is deemed insecure and therefore is issued a DATO according to [SP 800-37-1] . In the case where an IATO (under [SP 800-37-1] ) has been issued f

changed here

2.10

in 2

The Use of Risk in the Authorization Decision

Authorization is the official management decision by the DAO to permit operation of an issuer based on an assessment of its reliability and an acceptance of the risk inherent in that decision. By granting an authorization to operate, the DA

changed here

2.11

in 2

Authorization Submission Package and Supporting Documentation

The authorization submission package documents the results of the assessment phase and provides the DAO with the essential information needed to make a credible, risk-based decision on whether to authorize operation of the issuer. Unless sp

changed here

3

T AXONOMY OF I SSUER C ONTROLS

changed here

3.1

in 3

Introducing Issuer Controls

Assessment of a PIV Card or Derived PIV Credential Issuer is a broader endeavor than assessment of the security of an information system under [SP 800-37-1] . The requirements specified in [FIPS201-2] cover all major aspects of an issuer, i

changed here

3.2

in 3

Implementing Issuer Controls

Each issuer control must be properly implemented, managed, and monitored in order for the issuer to be authorized. Depending on how an organization decides to implement their [HSPD- 12] program, the authority to implement some of the contro

changed here

3.2.1

in 3.2

Issuer Controls implemented at the Organization or Facility Level

The nature of each issuer control dictates where it is implemented. Controls that are common to or impact multiple PIV processes are implemented at the organization level. The development of the operations plan is an example of an issuer co

changed here

4

I SSUER C ONTROLS A SSESSMENT & A UTHORIZATION D ECISION P ROCESS

An assessment is a set of activities performed by the Assessor to gain assurance that the issuer controls for a PIV Card Issuer or a Derived PIV Credential Issuer have been implemented properly and meet their required function or purpose. U

changed here

4.1

in 4

Assessment Methods

In order to assess the capability and reliability of an issuer, one or more assessment procedures associated with each issuer control have to be completed. An assessment procedure is carried out using one or more of the following assessment

changed here

4.2

in 4

The Issuer Assessment Report

The Assessment report contains the results of the assessment in a format that facilitates reviewing by the DAO. The DAO must evaluate the information in the Assessment Report in order to make a sound, credible decision regarding the residua

changed here