Appendix D PCI OPERATIONS PLAN TEMPLATE
All changes in this version
Title changed
Before · SP 800-79-1
PCI OPERATIONS PLAN TEMPLATE
After · SP 800-79-2
PCI OPERATIONS PLAN TEMPLATE
Control changed
Before · SP 800-79-1
The following is a suggested outline for the PCI operations plan. It is highly recommended that an organization follow this template to document its PCI operations comprehensively and to the full extent as needed to support a successful accreditation.
I. Background <Provide a brief background on HSPD-12, FIPS 201-1 and PIV, as well as how the organization has planned to meet the Directive. > II. Purpose and Scope <Describe the purpose and scope of the operations plan.> III. Applicable Laws, Directives, Policies, Regulations & Standards <Identify all Laws, Directives, Policies, Regulations and Standards that govern PIV Card issuance at the Organization.> IV. PCI Roles and Responsibilities <Identify the accreditation-related roles and responsibilities of all key personnel within the PCI.> V. Assignment of Roles <Document how the various roles that have been identified in the section above are appointed. These can be either specific individuals or positions within the organization. Provide contact information for all the roles assigned.> VI. PCI Description <Provide a description of the organization’s PCI. Details such as structure and geographic dispersion should be included.> VII. PCI Facility Details <Identify all the PCI Facilities that are included within the PCI that are part of the accreditation boundary. Provide details such as the location, PIV Card functions performed (e.g. enrollment and/or registration) at the facility and the approximate number of PIV Cards supported at each facility. > VIII. PCI Management
<This section discusses various management aspects of the PCI. > a. Coordination and Interaction <Describe management interactions within the PCI, both at an organization level, and between the organization and the facility(s). > b. Staffing <Describe the procedures employed to make sure that adequate staff is available for performing PIV Card related functions. > c. Training <Describe the procedures employed to ensure that the staff is properly trained to perform their respective duties. > d. Procurement <Describe the mechanism typically used for procuring products/services related to the organization’s HSPD-12 implementation. > e. Outsourcing <Describe the PIV Card functions being outsourced at the PCI (if applicable). > IX. PCI Policies and Procedures
<Describe in this section the various policies and procedures that apply for (i) sponsorship, (ii) Enrollment and Identity proofing, (iii)Adjudication, (iv) card production, (v) card activation and issuance and (vi) maintenance. Also discuss the procedures for temporary badges, as well as for non-PIV badges employed by the organization. > a. Sponsorship b. Enrollment/Identity Proofing c. Adjudication d. Card Production e. Card Activation/Issuance f. Maintenance i. Card Termination ii. Card Renewal iii. Card Re-issuance b. Temporary/Non-PIV Badges X. PCI Information System (s) Description <Provide a description of the technical aspects of the organization’s PIV system, including system architecture, network connectivity, connections to external system and information shared both internally and externally, the PKI provider as well as the information system accreditation status. > a. Architecture b. Interconnections and Information Sharing c. Information System Inventory d. Public Key Infrastructure e. SP 800-37 C&A Information XI. Card Personalization & Production <Describe the organization’s PIV Card graphical layout(s), as well the optional data containers being used. Provide details if there are any PIV Card expiration date requirements levied by the organization. Also describe the mechanisms in place for securing both pre-personalized and personalized PIV Card stock > a. PIV Card Graphical Topology b. PIV Card Electronic Data Elements c. Expiration Date Requirements d. Card Inventory Management XII. Card Reporting Requirements <Describe how the organization collects information from its facilities relating to the number of PIV Cards issued, background investigations completed etc, as required by OMB. Also provide detail on how the organization consolidates this information and provides its report to OMB on the status of their HSPD-12 implementation. > XIII. PCI Controls <This section documents the PCI Controls and provides the following information for each: (i) PCI control identifier and description, (ii) control owner, (iii) whether the control is organization-specific or facility- specific and (iv) a description of how the PCI control has been implemented by the organization. > a. PCI Control Identifier and Description b. PCI Control Owner c. Organization/Facility Specific d. How the PCI control is implemented Appendix A - Memoranda of Appointment <Attached copies of signed memoranda-of-appointment that record the various roles that have been assigned and the personnel fulfilling these roles that have accepted the position and its associated responsibilities. > Appendix B - Privacy Requirements <Attached copies of the privacy-related information as identified below. > a. Privacy Policy b. Privacy Impact Assessment c. System of Record Notice d. Privacy Act Statement/Notice e. Rules of Conduct f. Privacy Processes i. Requests to review personal information ii. Requests to amend personal information iii. Appeal procedures iv. Complaint procedures Appendix C – Service Level Agreements, Memoranda of Understanding (MOU) <Attached copies of any service level agreements and memoranda of understanding executed between the organization and any external service provider that has been contracted to provide certain PIV related functions.>
After · SP 800-79-2
The following is a suggested outline for the PCI operations plan. It is highly recommended that an organization follow this template to document its PCI operations comprehensively and to the full extent as needed to support a successful accreditation.
I. Background <Provide a brief background on HSPD-12, FIPS 201-1 and PIV, as well as how the organization has planned to meet the Directive. > II. Purpose and Scope <Describe the purpose and scope of the operations plan.> III. Applicable Laws, Directives, Policies, Regulations & Standards <Identify all Laws, Directives, Policies, Regulations and Standards that govern PIV Card issuance at the Organization.> IV. PCI Roles and Responsibilities <Identify the accreditation-related roles and responsibilities of all key personnel within the PCI.> V. Assignment of Roles <Document how the various roles that have been identified in the section above are appointed. These can be either specific individuals or positions within the organization. Provide contact information for all the roles assigned.> VI. PCI Description <Provide a description of the organization’s PCI. Details such as structure and geographic dispersion should be included.> VII. PCI Facility Details <Identify all the PCI Facilities that are included within the PCI that are part of the accreditation boundary. Provide details such as the location, PIV Card functions performed (e.g. enrollment and/or registration) at the facility and the approximate number of PIV Cards supported at each facility. > VIII. PCI Management
<This section discusses various management aspects of the PCI. > a. Coordination and Interaction <Describe management interactions within the PCI, both at an organization level, and between the organization and the facility(s). > b. Staffing <Describe the procedures employed to make sure that adequate staff is available for performing PIV Card related functions. > c. Training <Describe the procedures employed to ensure that the staff is properly trained to perform their respective duties. > d. Procurement <Describe the mechanism typically used for procuring products/services related to the organization’s HSPD-12 implementation. > e. Outsourcing <Describe the PIV Card functions being outsourced at the PCI (if applicable). > IX. PCI Policies and Procedures
<Describe in this section the various policies and procedures that apply for (i) sponsorship, (ii) Enrollment and Identity proofing, (iii)Adjudication, (iv) card production, (v) card activation and issuance and (vi) maintenance. Also discuss the procedures for temporary badges, as well as for non-PIV badges employed by the organization. > a. Sponsorship b. Enrollment/Identity Proofing c. Adjudication d. Card Production e. Card Activation/Issuance f. Maintenance i. Card Termination ii. Card Renewal iii. Card Re-issuance b. Temporary/Non-PIV Badges X. PCI Information System (s) Description <Provide a description of the technical aspects of the organization’s PIV system, including system architecture, network connectivity, connections to external system and information shared both internally and externally, the PKI provider as well as the information system accreditation status. > a. Architecture b. Interconnections and Information Sharing c. Information System Inventory d. Public Key Infrastructure e. SP 800-37 C&A Information XI. Card Personalization & Production <Describe the organization’s PIV Card graphical layout(s), as well the optional data containers being used. Provide details if there are any PIV Card expiration date requirements levied by the organization. Also describe the mechanisms in place for securing both pre-personalized and personalized PIV Card stock > a. PIV Card Graphical Topology b. PIV Card Electronic Data Elements c. Expiration Date Requirements d. Card Inventory Management XII. Card Reporting Requirements <Describe how the organization collects information from its facilities relating to the number of PIV Cards issued, background investigations completed etc, as required by OMB. Also provide detail on how the organization consolidates this information and provides its report to OMB on the status of their HSPD-12 implementation. > XIII. PCI Controls <This section documents the PCI Controls and provides the following information for each: (i) PCI control identifier and description, (ii) control owner, (iii) whether the control is organization-specific or facility- specific and (iv) a description of how the PCI control has been implemented by the organization. > a. PCI Control Identifier and Description b. PCI Control Owner c. Organization/Facility Specific d. How the PCI control is implemented Appendix A - Memoranda of Appointment <Attached copies of signed memoranda-of-appointment that record the various roles that have been assigned and the personnel fulfilling these roles that have accepted the position and its associated responsibilities. > Appendix B - Privacy Requirements <Attached copies of the privacy-related information as identified below. > a. Privacy Policy b. Privacy Impact Assessment c. System of Record Notice d. Privacy Act Statement/Notice e. Rules of Conduct f. Privacy Processes i. Requests to review personal information ii. Requests to amend personal information iii. Appeal procedures iv. Complaint procedures Appendix C – Service Level Agreements, Memoranda of Understanding (MOU) <Attached copies of any service level agreements and memoranda of understanding executed between the organization and any external service provider that has been contracted to provide certain PIV related functions.>