Appendix E ASSESSMENT REPORT TEMPLATE
All changes in this version
Title changed
Before · SP 800-79-1
ASSESSMENT REPORT TEMPLATE
After · SP 800-79-2
ASSESSMENT REPORT TEMPLATE
Control changed
Before · SP 800-79-1
Below is a template to use when generating the assessment report. This is to be completed for each PCI control. An example using a specific PCI control follows.
Accreditation Focus Area
PCI Control Identifier—
PCI Control Description —
PCI Control Owner / Control Level — (External Service Provider, Organization specific, Facility specific)
Assessment Result — (Satisfied, Partially Satisfied, Not Satisfied, Not Applicable)
Assessment Findings —
Assessment Deficiency and Potential Impact —
Recommendation —
Card Activation/Issuance Process
PCI Control Identifier— AI-7
PCI Control Description — The issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the enrollment record. On a successful match, the PIV Card may be released to the applicant
PCI Control Owner — External Service Provider, Facility Specific
Assessment Result — Partially Satisfied
Assessment Findings — There is operational evidence that a 1:1 biometric match is carried out before the card is released to the applicant.
Assessment Deficiency and Potential Impact — The requirement to carry out this task is not documented clearly enough in the operations plan. Although personnel are knowledgeable about this requirement, and the task was observed to be performed correctly during card issuance, the lack of documentation could be a problem if there is turnover in staff.
Recommendation — Update the issuance process description within the operations plan to include a clear description of this task in the process.
Summary Report Template
PAT (% Satisfied, % Partially Satisfied, % Not Satisfied) For each Accreditation Focus Area (% PCI controls Satisfied, % Partially Satisfied, % Not Satisfied) (% Review Assessments Satisfied, % Interview Assessments Satisfied, % Observe Assessments Satisfied, % Test Assessments Satisfied)
After · SP 800-79-2
Below is a template to use when generating the assessment report. This is to be completed for each PCI control. An example using a specific PCI control follows.
Accreditation Focus Area
PCI Control Identifier—
PCI Control Description —
PCI Control Owner / Control Level — (External Service Provider, Organization specific, Facility specific)
Assessment Result — (Satisfied, Partially Satisfied, Not Satisfied, Not Applicable)
Assessment Findings —
Assessment Deficiency and Potential Impact —
Recommendation —
Card Activation/Issuance Process
PCI Control Identifier— AI-7
PCI Control Description — The issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the enrollment record. On a successful match, the PIV Card may be released to the applicant
PCI Control Owner — External Service Provider, Facility Specific
Assessment Result — Partially Satisfied
Assessment Findings — There is operational evidence that a 1:1 biometric match is carried out before the card is released to the applicant.
Assessment Deficiency and Potential Impact — The requirement to carry out this task is not documented clearly enough in the operations plan. Although personnel are knowledgeable about this requirement, and the task was observed to be performed correctly during card issuance, the lack of documentation could be a problem if there is turnover in staff.
Recommendation — Update the issuance process description within the operations plan to include a clear description of this task in the process.
Summary Report Template
PAT (% Satisfied, % Partially Satisfied, % Not Satisfied) For each Accreditation Focus Area (% PCI controls Satisfied, % Partially Satisfied, % Not Satisfied) (% Review Assessments Satisfied, % Interview Assessments Satisfied, % Observe Assessments Satisfied, % Test Assessments Satisfied)