Appendix G PCI CONTROLS AND ASSESSMENT PROCEDURES
All changes in this version
Title changed
Before · SP 800-79-1
PCI CONTROLS AND ASSESSMENT PROCEDURES
After · SP 800-79-2
PCI CONTROLS AND ASSESSMENT PROCEDURES
Control changed
Before · SP 800-79-1
DO-1 The organization develops and implements a PCI operations plan according to the template in Appendix D. The operations plan references other documents as needed. Determine that: (i) the operations plan includes the relevant elements from the template in Appendix D (review); (ii) the operations plan includes the list of PCI controls and the PCI control owner for each, how they were implemented and whether they are organization or facility specific (review); (iii) documentation that is not included in the operations plan is referenced accurately (review); (iv) the operations plan has been reviewed and approved by the DAA within the organization (review, interview). SP 800-79-1, Section 2.11 – Accreditation Package and Supporting Documentation
DO-2 The organization has a written policy and procedures for enrollment/identity proofing that are approved by the head of the organization. Determine that : (i) the organization has developed and documented written policy and procedures for identity proofing and enrollment for personnel requiring a PIV Card (e.g. employees, contractors and foreign nationals) (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). Preparation and Maintenance of Documentation
DO-3 The organization has a written policy and procedures for issuance that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for issuance (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPS 201-1, Section 2.3 – PIV Issuance and Maintenance Requirements DO-4 The organization has a written policy and procedures describing the conditions for PIV Card renewal that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for card renewal (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
DO-5 The organization has a written policy and procedures describing the conditions for PIV Card termination that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for PIV Card termination (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy as required (review, interview). FIPS 201-1 Section 5.3.2.4 - – PIV Card Termination
DO-6 The organization has a written policy and procedures describing the conditions for PIV Card re-issuance that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for re-issuance (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPS 201-1 Section 5.3.2.2 – PIV Card Reissuance
DO-7 In cases where a PIV Card is not required, such as temporary employees and contractors employed for less than 6 months and visitors, the organization has a written policy and procedures describing the conditions for temporary badges. Determine that : (i) the organization has developed and documented a written policy and procedures for the issuance of temporary badges (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the organization will periodically review and update the policy and procedures as required (review, interview). OMB Memorandum 05-24 RR-1 The organization has appointed the role of Senior Authorizing Official (SAO). Determine that : (i) the organization has defined the role of Senior Authorizing Official and its responsibilities according to the requirements of SP 800-79-1 (review); (ii) the organization has assigned the role of Senior Authorizing Official (review); SP 800-79-1, Section 2.6 – Roles and Responsibilities
RR-2 The organization has appointed the role of Designated Accreditation Authority (DAA). Determine that : (i) the organization has defined the role of Designated Accreditation Authority and its responsibilities according to the requirements of SP 800-79-1 (review); (ii) the organization has assigned the role of Designated Accreditation Authority (review, interview); SP 800-79-1, Section 2.6 – Roles and Responsibilities
RR-3 The organization has appointed the role of Organization Identity Management Official (OIMO). Determine that : (i) the organization has defined the role of Organization Identity Management Official and its responsibilities according to the requirements of SP 800-79-1 (interview); (ii) the organization has assigned the role of Organization Identity Management Official (review, interview). SP 800-79-1, Section 2.6 – Roles and Responsibilities
RR-4 The organization has appointed the role of Assessor. Determine that : (i) the organization has defined the role of Assessor and its responsibilities according to the requirements of SP 800- 79-1 (review); (ii) the organization has assigned the role of Assessor (review); (iii) the Assessor is independent of, and organizationally separate from, the persons and office(s) directly responsible for the day-to-day operation of the organization (review, interview). SP 800-79-1, Section 2.6 – Roles and Responsibilities Assignment of Roles and Responsibilities
RR-5 The organization has appointed the role of Privacy Official (PO). Determine that : (i) the organization has defined the role of Privacy Official and its responsibilities according to the requirements of SP 800-79-1 (review); (ii) the organization has assigned the role of Privacy Official in the operations plan (review, interview); (iii) the Privacy Official does not have any other roles in the PCI (review, interview). SP 800-79-1, Section 2.6 – Roles and Responsibilities RR-6 The PCI Facility employs processes which adhere to the principle of separation of duties to ensure that no single individual has the capability to issue a PIV Card without the cooperation of another authorized person. Determine that : (i) the PCI facility standard operating procedures document the principle of separation of duties (review); (ii) the PCI facility’s processes demonstrate adherence to the principle of separation of duties (interview, observe). FIPS 201-1, Section 5.2 – PIV Registration
Facility FP-1 Minimum physical controls at the PCI Facility are implemented. These include: (i) use of locked rooms, safes, and cabinets (as appropriate); (ii) physical access to key areas within the facility is restricted to authorized personnel, (iii) security monitoring and automated alarms are implemented, (iv) emergency power and lighting are available, and (v) fire prevention and protection mechanisms are implemented. Determine that: (i) the OIMO and PCIF Managers(s) are aware of the minimum set of physical controls that need to be in place at the facility(ies) (interview); (ii) the minimum physical security controls are implemented by the PCI Facility (observe). Commonly accepted security readiness measures
FP-2 PCI Documentation (e.g., operations plan, standard operating procedures, and contracts) are maintained at each PCI Facility. Determine that: (i) the most current versions of the PCI documentation is available at the PCI Facility for reference as needed (interview, review); Commonly accepted security readiness measures
Equipment FP-3 The PCIF Manager(s) has a copy of the contingency/disaster recovery plan for the information systems, which is stored securely. Determine that : (i) the contingency plan/ disaster recovery plan is stored (ii) securely at the facility (interview, observe); (iii) the PCIF Manager is knowledgeable on how to restore/reconstitute the information systems in case of system failures (interview). Commonly accepted security readiness measures Facility and Personnel Readiness
FP-4 The information systems are managed using a system development life cycle (SDLC) methodology that includes information security considerations Determine that : (i) the information system used by the organization has been developed using an SDLC methodology (review, interview); (ii) information system security is considered as part of the development life cycle (review). Commonly accepted security readiness measures FP-5 Enrollment/identity proofing and card activation/issuance workstations are situated in an enclosed area (wall or partition) to provide privacy for an applicant or card holder. Determine that : (i) PCI Facility workstations are situated in an enclosed area (wall or partition) such that other individuals cannot see an applicant or card holder’s personal information (observe). Commonly accepted security readiness measures
Key Personnel FP-6 All operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing or card activation/issuance are allowed access to information systems only when authenticated through a PIV Card. Determine that : (i) the requirement that all operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing or card activation/issuance are allowed logical access to information systems only when authenticated through a PIV Card, has been documented in the PCI Facility’s standard operating procedures (review); (ii) Operators use PIV Cards to access information systems in the course of performing their roles in the areas of enrollment/ identity proofing or card activation/issuance access (observe). Commonly accepted security readiness measures
FP-7 All operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing, adjudication and card activation/issuance have undergone training that is specific to their duties prior to being allowed to perform in that function. Determine that : (i) The requirement that all operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing, adjudication and card activation/issuance are allowed access to information systems only after completing a training course specific to their duties. (interview, review); (ii) Records showing that the appropriate training course has been completed by PCI Facility personnel are stored by the facility for audit purposes (review). Commonly accepted security readiness measures
FP-8 All pre-personalized and personalized smart card stock received from card vendors and card production facilities are received only by authorized personnel who ensure that the card stock is stored securely in the PCI Facility. Determine that : (i) the PCI facility has an authorized list of personnel that are responsible for ensuring that smart card stock is received and stored securely in the PCI Facility (interview); (ii) procedures for receiving and storing smart card stock are documented in the PCI Facility’s standard operating procedures (review); (iii) the authorized personnel are knowledgeable of the procedures on how to receive and store smart card stock (interview). Commonly accepted security readiness measures FP-9 The organization maintains a current list of designated points of contact and alternate points of contact for all PCIFs used by the organization for enrollment/identity proofing and card activation/issuance. Determine that : (i) the organization maintains a current list of designated points of contact and alternate points of contact for all PCIFs used by the organization for enrollment/identity proofing and card activation/issuance (review). Commonly accepted security readiness measures
ST-1 The PCI information systems that contain information in identifiable form are handled in compliance with Federal laws and policies, including the Privacy Act of 1974. Determine that : (i) the PCI Facility does not disclose any record which is contained in the system of records to any person, or to another organization unless written consent has been given by the individual to whom the record pertains unless one of the exceptions for disclosure in the Privacy Act are met (review, interview); (ii) individuals are permitted to gain access to their personal record and the information is provided in a form comprehensible to them (review, interview); (iii) individuals are able to request amendments to records pertaining to them, corrections are made promptly and if not, the individual is provided with a reason for the refusal and is able to request a review of the refusal (review, interview); (iv) the organization notifies an individual when their record is made available to any person under a compulsory legal process when such a process becomes a matter of public record (review, interview). FIPS 201-1, Section 2.4 - PIV Privacy Requirements
Protection of Stored and Transmitted Data
ST-2 The information systems protect the integrity and confidentiality of transmitted information. Determine that : (i) the integrity of transmitted information is protected (interview, test, review) (ii) the confidentiality of transmitted information is protected (interview, test, review) FIPS 201-1, Section 2.4 - PIV Privacy Requirements PR-1 Privacy act statement/notice, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees violating privacy policies shall be developed and posted by the organization in multiple locations at the PCI facility (e.g., internet site, human resource offices, regional offices, and contractor orientation handouts). Determine that : (i) the PCI Facility has posted privacy act statement/notice, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees violating privacy policies (interview, review). OMB Memorandum 05-24
PR-2 The organization has conducted a Privacy Impact Assessment of their PCI information system (s), compliant with Section 208 of the E-Government Act of 2002 and based on guidance found in Appendix E of OMB Memorandum 06-06. Determine that: (i) the organization has conducted a Privacy Impact Assessment of their PCI information system (s) based on guidance found in Appendix E of OMB Memorandum 06- 06 (review); (ii) the organization has submitted the Privacy Impact Assessment of their PCI information system (s) to OMB (interview, review). OMB Memorandum 05-24
PR-3 The organization’s employee and contractor identification systems of records notices (SORN’s) are updated to reflect any changes in the disclosure of information to other organizations in order to be consistent with the Privacy Act of 1974 and OMB Circular A-130, Appendix 1. Determine that: (i) the organization updates SORN’s to reflect changes in the disclosure of information (review, interview). OMB Memorandum 05-24 Enforcement of Privacy Requirements
PR-4 The applicant is notified of what information in identifiable form is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information. Determine that: (i) Before receiving the PIV Card, the PCI Facility requires the applicant to be notified of the personally identifiable information that is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (review, observe) (ii) the applicant is informed of what personally identifiable information is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (interview) FIPS 201-1, Section 2.4 – PIV Privacy Requirements PR-5 The PCI Facility employs technologies that allow for continuous auditing of compliance with privacy policies and practices. Determine that: (i) the PCI Facility employs technologies that allow for the continuous auditing of compliance with privacy policies and practices. This could include the use of technology to monitor data access, data flows between information systems and the use of personally identifiable information (interview, test). FIPS 201-1, Section 2.4 – PIV Privacy Requirements
PR-6 In the case of termination, any personally identifiable information that has been collected from the cardholder is disposed of in accordance with the stated privacy and data retention policies. Determine that: (i) as a part of PIV Card termination, the organization disposes of personally identifiable information in accordance with its privacy and data retention policies (review, interview). FIPS 201-1, Section 5.3.2.4 – PIV Card Termination
Infrastructure Elements DP-1 In order to be compliant with the provisions of OMB Circular A- 130, App III, the PCI information system(s) are certified in accordance with NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems. Determine that: (i) the organization has a letter showing the current accreditation decision of each information system used to support the PCI (review). FIPS 201-1, Appendix B.2 – Security Certification and Accreditation of IT System(s)
DP-2 Every product utilized by a PCI facility that it falls within one of the categories listed by the GSA FIPS 201 Evaluation program, shall be listed in the GSA FIPS 201 Evaluation Program’s Approved Product List (APL) Determine that: (i) for each product that falls within one of the categories in the GSA FIPS 201 Evaluation Program, its presence (make, model, versions) is checked on the APL (review) OMB Memorandum 05-24 Deployed Products & Information Systems
DP-3 The organization has submitted a personalized PIV Card from their production system to GSA for testing, and it has been approved. Determine that: (i) the organization has a letter from the GSA showing approval of the configuration of their PIV Card (review). OMB Memorandum 07-06
PAT = Infrastructure Elements PAT = Infrastructure Elements CI-1 For legacy Public Key Infrastructures (PKI’s), the organization’s CA shall be cross-certified with the Federal Bridge (FBCA) at a Medium-HW or High Assurance Level. Determine that: the PKI is listed on the FBCA’s website as being cross-certified at a Medium-HW or High Assurance Level. (review). FIPS 201-1, Section 5.4.4 – Migration from Legacy PKIs
CI-2 For non-legacy PKI’s, the CA that issues certificates to support PIV Card authentication participates in the hierarchical PKI for the Common Policy managed by the Federal PKI. Determine that: (i) the PKI is listed on the Federal PKI Policy Authority’s website as being a shared service provider (review). FIPS 201-1, Section 5.4.1 – Architecture
CI-3 When cards are personalized, card management keys are set to be specific to each PIV Card. That is, each PIV Card shall contain a unique card management key. Determine that: (i) the CMS vendor’s documentation shows the use of unique card management keys (review); (ii) the OIMO indicates that card management keys are unique (interview). FIPS 201-1, Section 4.1.6.2 – Activation by Card Management System
CI-4 Fingerprint images retained by organizations shall be formatted according to SP 800-76-1. Determine that: (i) the fingerprint images are formatted according to Table 4 in SP 800-76-1 and INCITS 381 (review, test). SP 800-76-1, Section 3.4 – Fingerprint Template Specifications
CI-5 Facial images collected during enrollment/identity proofing are formatted such that they conform to SP 800-76-1. Determine that: (i) the facial images are formatted according to Table 6 in SP 800-76-1 and INCITS 385 (review, test). SP 800-76-1, Section 5.2 – Acquisition and Format Implementation of Credentialing Infrastructures
CI-6 The fingerprint templates stored on the PIV Card are prepared from images of the primary and secondary fingers where the choice of fingers is based on the order of priority, as provided in FIPS 201-1, Section 4.4.1. Determine that: (i) the procedures used to fingerprint the applicant are based on the primary and secondary finger designations as required by the standard (review, observe); (ii) the fingerprint templates are prepared from images of the primary and secondary fingers (test). SP 800-76-1, Section 3.4.1 – Source Images SP-1 A request is created in order to issue a PIV Card. Determine that: (i) the process for making a request is documented (review); (ii) A PIV Request is created in order to issue a PIV Card (observe). FIPS 201-1, Section 2.1 – Control Objectives
Sponsorship Process SP-2 The PCI Facility collects personal information using only forms approved by OMB under the Paperwork Reduction Act of 1995. Determine that : (i) forms used to collect personal information have been approved by OMB (review, observe). OMB Memorandum 07-06
EI-1 The PCI Facility has a process in place to verify the authenticity of the source documents and match them to the identity claimed by the applicant. Determine that: (i) the PCI Facility has a process in place to verify the authenticity of the source documents and match them to the identity claimed by the applicant (interview, observe); (ii) the PCI Facility has materials used to train enrollment/identity proofing officials on how to verify the authenticity of the source documents (review). FIPS 201-1, Section 2.1 – Control Objectives
EI-2 The PCI Facility requires the applicant to appear in-person at least once before the issuance of a PIV Card. Determine that: (i) the requirement that an applicant appear in-person at least once before the issuance of a PIV Card is documented (review); (ii) the applicant appears in-person at least once before the issuance of a PIV Card (observe).
EI-3 Two identity source documents are checked in accordance with the requirements of Form I-9, OMB No. 1115-0136, Employment Eligibility Verification. Determine that: (i) the requirement to check two identity source documents in accordance with the requirements of Form I-9 is documented (review); (ii) two identity source documents are checked in accordance with the requirements of Form I-9 during enrollment/identity proofing (observe). Enrollment / Identity Proofing Process
EI-4 One of the identity source documents used to verify the claimed identity of the applicant is a valid Federal or state government- issued photo identification. Determine that: (i) the requirement that one of the identity source documents is a valid Federal or state government issued photo ID is documented (review); (ii) one of the identity source documents used to verify the claimed identity of the applicant is a valid Federal or state government-issued photo identification (observe). EI-5 The PCI Facility performs the entire identity proofing and enrollment/identity proofing process prior to re-issuing a PIV Card. Determine that: (i) the requirement to perform the entire identity proofing and enrollment process prior to re-issuing a PIV Card is documented (review); (ii) the PCI Facility performs the entire identity proofing and enrollment process prior to re-issuing a PIV Card (observe). FIPS 201-1, Section 5.3.2.2 PIV Card Reissuance
EI-6 A new facial image is collected at the time of reissuance. Determine that: (i) the requirement to capture a new facial image is documented within the reissuance process (review); (ii) a new facial image is collected at the time of reissuance (observe). FIPS 201-1, Section 4.4 – Biometric Data Specifications
EI-7 The biometrics (fingerprints and facial image) that are used to personalize the PIV Card must be captured during the enrollment/identity proofing process. Determine that: (i) the requirement to capture biometrics (fingerprints and facial image) that are used to personalize the PIV Card must be captured during enrollment/identity proofing process is documented (review); (ii) The biometrics (fingerprints and facial image) that are used to personalize the PIV Card are captured during the enrollment/identity proofing process (observe). FIPS 201-1, Section 5.2 – PIV Registration Requirement
EI-8 A cardholder waits until six weeks prior to the expiration of a valid PIV Card before applying for renewal (please note: this applies to normal renewal only and not for lost or damaged cards). Determine that: (i) the requirement that a cardholder must wait until six weeks prior to the expiration of a valid PIV Card before applying for renewal is documented (review); (ii) a cardholder waits until six weeks prior to the expiration of a valid PIV Card before applying for renewal (interview). FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
EI-9 The PCI Facility captures the applicant’s fingerprints in accordance with any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or (iii) rolled ink card. (i) the PCI Facility captures the applicant’s fingerprints in accordance with any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or (iii) rolled ink card (observe). SP 800-76-1, Section 3.3 – Fingerprint Image Acquisition EI-10 The PCI Facility has an attending official present at the time of fingerprint capture. Determine that: (i) the requirement that the PCI Facility has an attending official present at the time of fingerprint capture is documented (review); (ii) the PCI Facility has an attending official present at the time of fingerprint capture (observe). SP 800-76-1, Section 3.3 – Fingerprint Image Acquisition
EI-11 The PCI Facility acquires fingerprint images in accordance with Table 2 in 800-76-1. Determine that: (i) fingers are inspected for the absence of foreign materials (observe); (ii) scanner and card surfaces are clean (observe); (iii) the presentation of fingers for a plain live scan, rolled live scan, and rolled ink card are based on procedures in Table 1 (observe); (iv) multi-finger plain impression images are properly segmented into single finger images (observe). SP 800-76-1, Section 3.3 – Fingerprint Image Acquisition
EI-12 The PCI Facility captures the 10 fingerprints of the applicant. In the case where less than ten fingers are available, the missing fingers are labeled before transmitting to the FBI. Determine that: (i) the requirement that the PCI Facility captures the 10 fingerprints of the applicant and labels any missing fingers is documented (review); (ii) the PCI Facility captures the 10 fingerprints of the applicant and labels any missing fingers (observe). SP 800-76-1, Section 3.3 – Fingerprint image acquisition
Adjudication Process AP-1 The organization conducts a National Agency Check with Written Inquiries (NACI), or other Office of Personnel Management (OPM) or National Security community investigation for each applicant for whom a successfully adjudicated NACI cannot be referenced on file. Determine that: (i) the requirement that the organization conduct a National Agency Check with Written Inquiries (NACI), or other Office of Personnel Management (OPM) or National Security community investigation for each applicant for whom a successfully adjudicated NACI cannot be referenced on file is documented (review); (ii) the organization conducts a National Agency Check with Written Inquiries (NACI), or other Office of Personnel Management (OPM) or National Security community investigation for each applicant for whom a successfully adjudicated NACI cannot be referenced on file (interview). AP-2 The organization successfully adjudicates the FBI National Criminal History Check (fingerprint check) and initiates the National Agency Check with Written Inquires (NACI) before the PIV Card is issued. Determine that: (i) the requirement that the organization successfully adjudicates the FBI National Criminal History Check (fingerprint check) and initiates the National Agency Check with Written Inquires (NACI) before the PIV Card is issued is documented (review); (ii) the organization successfully adjudicates the FBI National Criminal History Check (fingerprint check) and initiates the National Agency Check with Written Inquires (NACI) before the PIV Card is issued (interview).
CP-1 The PIV Card implements security features that aid in reducing counterfeiting, are resistant to tampering, and provide visual evidence of tampering attempts. Determine that: (i) the PIV Card contains at least one security feature. Examples of these security features include the following: (i) Optical varying structures, (ii) Optical varying inks, (iii) Laser etching and engraving, (iv) Holograms, (v) Holographic images, (vi) Watermarks (interview, observe ). FIPS 201-1, Section 4.1.2 – Tamper Proofing and Resistance
CP-2 The PIV Card is not embossed. Determine that: (i) the PIV Card is not embossed (review, observe) FIPS 201-1, Section 4.1.3 – Physical Characteristics and Durability
CP-3 Decals are not adhered to the PIV Card. Determine that: (i) decals are not adhered to the PIV Card (review, observe). FIPS 201-1, Section 4.1.3 – Physical Characteristics and Durability Card Production Process
CP-4 If organizations choose to punch an opening in the card body to enable the card to be worn on a lanyard, all such alterations are closely coordinated with the card vendor and/or manufacturer to ensure the card material integrity is not adversely impacted. Determine that: (i) the integrity of a PIV Card is not affected by a punched opening (test); (ii) Documentation from the PIV Card vendor shows that durability and operational requirements have not been compromised (review). FIPS 201-1, Section 4.1.3 – Physical Characteristics and Durability AI-1 The personalized PIV Card complies with all the mandatory items on the front of the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 for (i)a photograph; (ii) name; (iii) employee affiliation; (iv) and expiration date (observe, test). FIPS 201-1, Section 4.1.4.1 – Mandatory Items on the Front of the PIV Card
AI-2 The personalized PIV Card complies with all the mandatory items on the back of the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 for (i) an organization card serial number; (ii) and issuer identification (observe, test). FIPS 201-1, Section 4.1.4.2 – Mandatory Items on the Back of the Card
AI-3 If one or more optional items are printed on the front of the PIV Card, they comply with the requirements for the optional items on the front on the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 if it includes optional items on the front of the card, such as (i) a signature; (ii) organization specific text area; (iii) rank; (iv) portable data file; (v) header; (vi) organization seal; (vii) footer; (viii) issue date; (ix) color-coding employee affiliation; (x) photo border for employee affiliation; (xi) organization-specific data (observe, test). FIPS 201-1, Section 4.1.4.3 – Optional Items on the Front of the Card
AI-4 If one or more optional items are printed on the back of the PIV Card, they comply with the requirements for the optional items on the back on the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 if it includes optional items on the front of the card, such as (i) magnetic stripe; (ii) return to address (iii) physical characteristics of the cardholder; (iv) additional language for emergency responder officials; (v) standard Section 499, Title 18 language; (vi) linear 3 of 9 bar code; (vii) organization-specific text (zones 9 & 10) (observe, test). FIPS 201-1, Section 4.1.4.4 – Optional Items on the Back of the Card
AI-5 The PIV Card includes mechanisms to limit the number of PIN guesses an adversary can attempt if a card is lost or stolen. Determine that: (i) the PIV Card limits the number of incorrect PIN guesses (test, review). FIPS 201-1, Section 4.1.6.1 – Activation by Cardholder Card Activation / Issuance Process
AI-6 The PIV Card is valid for no more than five years. Determine that: (i) the expiration date printed on the PIV Card is no more than five years from the issuance date (observe). (ii) the expiration date is printed in the CHUID (test) (iii) the two dates (printed on the card and the expiration date in the CHUID) are the same (test) FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal AI-7 The PCI Facility performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record before releasing the PIV Card to the applicant. Determine that: (i) the requirement that the issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record is documented (review); (ii) the issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record (observe). FIPS 201-1, Section 5.3.1 – PIV Card Issuance
AI-8 The PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to renewal. Determine that: (i) the requirement that the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to renewal is documented (review); (ii) the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to renewal (observe). FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
AI-9 The PCI Facility advises applicants that the PIN on the PIV Card should not be easily-guess-able or otherwise individually- identifiable in nature. Determine that: (i) the requirement that the PCI Facility advises applicants that the PIN on the PIV Card should not be easily-guess- able or otherwise individually-identifiable in nature is documented (review); (ii) the PCI Facility advises applicants that the PIN on the PIV Card should not be easily-guess-able or otherwise individually-identifiable in nature (observe). FIPS 201-1, Section 4.1.6.1 Activation by Cardholder
AI-10 Identity cards issued to individuals without a completed NACI or equivalent are electronically distinguishable from identity cards issued to individuals who have a completed investigation. Determine that: (i) the PCI Facility has procedures for how to update the NACI interim indicator extension for identity cards issued to individuals without a completed NACI or equivalent (review, interview); (ii) for individuals without a completed NACI or equivalent, the NACI interim indicator is set to true (test); (iii) for individuals with a completed NACI or equivalent, the NACI interim indicator is set to false (test). AI-11 During a PIN reset on a locked PIV Card, the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to releasing the unlocked PIV Card back to the Card holder. Determine that: (i) the requirement that, during a PIN reset on the PIV Card, the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card before releasing the PIV Card is documented (review); (ii) after PIN reset on the PIV Card, the PCI Facility performs a 1:1 biometric match of the PIV Card Holder against the biometric included in the PIV before releasing the PIV Card (observe). FIPS 201-1, Section 5.3.2.3 – PIV Card PIN Reset
AI-12 The PCI Facility issues an electro-magnetically opaque sleeve or other protection technology to protect against any unauthorized contactless access to information stored on a PIV credential. Determine that : (i) the requirement that the PCI Facility issue an electro- magnetically opaque sleeve with every PIV Card is documented (review); (ii) the PCI Facility issues an electro-magnetically opaque sleeve with every PIV Card ( interview, observe). FIPS 201-1, Section 2.4 – Privacy Requirements
AI-13 The organization verifies that the PIV cardholder remains in good standing, and personnel records are current before renewing/reissuing the card and associated credentials. Determine that : (i) the procedures that are followed to determine that the cardholder’s records are current are documented (review); (ii) the procedures to determine the currency of the cardholder’s records are followed by the PCI facility prior to renewal or reissuance of a PIV Card (observe) FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
Maintenance Process MP-1 The PIV FASC-N is not modified post-issuance. Determine that: (i) the PIV FASC-N is not modified post-issuance (review, interview). FIPS 201-1, Section 4.2 – Cardholder Unique Identifier MP-2 In the case of a renewal, re-issuance and termination, the PIV Card is collected and destroyed whenever possible. Determine that: (i) in the case of a renewal, re-issuance and termination, the requirement that the PIV Card is collected and destroyed whenever possible is documented (review); (ii) in the case of a renewal, re-issuance and termination, the PIV Card is collected and destroyed whenever possible (interview). FIPS 201-1, Section 2.3 – PIV Issuance and Maintenance Requirements
MP-3 Normal operational procedures must be in place to ensure proper card revocation during PIV Card re-issuance and termination: (i) The PIV Card itself is revoked; (ii) Databases containing Federal Agency Smart Credential Number (FASC-N) values must be updated to reflect the change in status; (iii) The Certification Authority (CA) is informed and CRLs are updated ; and (iv) Online Certificate Status Protocol (OCSP) responders are updated so that queries with respect to certificates on the PIV Card are answered appropriately. Determine that: (i) the PIV Card is revoked during card revocation (review, interview); (ii) databases containing Federal Agency Smart Credential Number (FASC-N) values must be updated to reflect the change in status (interview); (iii) the CA is informed and the revoked certificates on the PIV Card are placed on the CRL (test, review); (iv) online Certificate Status Protocol (OCSP) responders are updated (test, review). FIPS 201-1 Section 5.3.2.4 PIV Card Termination
MP-4 If the PIV Card cannot be collected and destroyed, normal operating procedures are completed within 18 hours of notification. Determine that: (i) documentation includes the requirement that if PIV Card cannot be collected and destroyed, normal operating procedures are completed within 18 hours of notification (review); (ii) if the PIV Card cannot be collected and destroyed, normal operating procedures are completed within 18 hours of notification (observe). FIPS 201-1, Section 5.3.2.2 – PIV Card Reissuance
MP-5 Upon PIV Card termination, the organization enforces a standard methodology of updating systems of records to indicate employee termination, and this status is distributed effectively throughout systems used for physical and logical access to organization facilities and resources. Determine that: (i) the PCI Facility has documented its procedures for updating information systems to indicate employee termination (review); (ii) the PCI Facility updates information systems to indicate employee termination (interview, observe). FIPS 201-1, Section 5.3.2 - PIV Card Maintenance
MP-6 The organization posts a quarterly report, to the organization’s website, stating the number of PIV Cards issued to date, and the link is emailed to OMB. OMB Memorandum 07-06 Determine that : (i) the organization develops and posts a quarterly report to the organization’s website according to the requirements of the attachment to OMB memorandum 07-06 (review); (ii) the organization sends the link to the report to OMB on a quarterly basis (review, interview). MP-7 The organization has completed a lifecycle walkthrough at one year intervals since the last accreditation date, and the results are documented in a report to the DAA. Determine that : (i) the organization has completed a lifecycle walkthrough to cover sponsorship, enrollment/identity proofing, card production, card activation/issuance and maintenance processes (interview); (ii) a lifecycle walkthrough has been completed at one year intervals since the last accreditation date (interview); (iii) the results of the PCI lifecycle walkthrough have been documented and reviewed by the DAA (review, interview). SP 800-79-1, Section 5.4 - Monitoring Phase
After · SP 800-79-2
DO-1 The organization develops and implements a PCI operations plan according to the template in Appendix D. The operations plan references other documents as needed. Determine that: (i) the operations plan includes the relevant elements from the template in Appendix D (review); (ii) the operations plan includes the list of PCI controls and the PCI control owner for each, how they were implemented and whether they are organization or facility specific (review); (iii) documentation that is not included in the operations plan is referenced accurately (review); (iv) the operations plan has been reviewed and approved by the DAA within the organization (review, interview). SP 800-79-1, Section 2.11 – Accreditation Package and Supporting Documentation
DO-2 The organization has a written policy and procedures for enrollment/identity proofing that are approved by the head of the organization. Determine that : (i) the organization has developed and documented written policy and procedures for identity proofing and enrollment for personnel requiring a PIV Card (e.g. employees, contractors and foreign nationals) (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). Preparation and Maintenance of Documentation
DO-3 The organization has a written policy and procedures for issuance that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for issuance (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPS 201-1, Section 2.3 – PIV Issuance and Maintenance Requirements DO-4 The organization has a written policy and procedures describing the conditions for PIV Card renewal that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for card renewal (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
DO-5 The organization has a written policy and procedures describing the conditions for PIV Card termination that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for PIV Card termination (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy as required (review, interview). FIPS 201-1 Section 5.3.2.4 - – PIV Card Termination
DO-6 The organization has a written policy and procedures describing the conditions for PIV Card re-issuance that are approved by the head of the organization. Determine that : (i) the organization has developed and documented a written policy and procedures for re-issuance (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the policy and procedures have been signed off by the head of the organization (review); (iv) the organization will periodically review and update the policy and procedures as required (review, interview). FIPS 201-1 Section 5.3.2.2 – PIV Card Reissuance
DO-7 In cases where a PIV Card is not required, such as temporary employees and contractors employed for less than 6 months and visitors, the organization has a written policy and procedures describing the conditions for temporary badges. Determine that : (i) the organization has developed and documented a written policy and procedures for the issuance of temporary badges (review); (ii) the policy is consistent with the organization’s mission and functions, FIPS 201-1 and applicable laws, directives, policies, regulations, standards, and guidance (review); (iii) the organization will periodically review and update the policy and procedures as required (review, interview). OMB Memorandum 05-24 RR-1 The organization has appointed the role of Senior Authorizing Official (SAO). Determine that : (i) the organization has defined the role of Senior Authorizing Official and its responsibilities according to the requirements of SP 800-79-1 (review); (ii) the organization has assigned the role of Senior Authorizing Official (review); SP 800-79-1, Section 2.6 – Roles and Responsibilities
RR-2 The organization has appointed the role of Designated Accreditation Authority (DAA). Determine that : (i) the organization has defined the role of Designated Accreditation Authority and its responsibilities according to the requirements of SP 800-79-1 (review); (ii) the organization has assigned the role of Designated Accreditation Authority (review, interview); SP 800-79-1, Section 2.6 – Roles and Responsibilities
RR-3 The organization has appointed the role of Organization Identity Management Official (OIMO). Determine that : (i) the organization has defined the role of Organization Identity Management Official and its responsibilities according to the requirements of SP 800-79-1 (interview); (ii) the organization has assigned the role of Organization Identity Management Official (review, interview). SP 800-79-1, Section 2.6 – Roles and Responsibilities
RR-4 The organization has appointed the role of Assessor. Determine that : (i) the organization has defined the role of Assessor and its responsibilities according to the requirements of SP 800- 79-1 (review); (ii) the organization has assigned the role of Assessor (review); (iii) the Assessor is independent of, and organizationally separate from, the persons and office(s) directly responsible for the day-to-day operation of the organization (review, interview). SP 800-79-1, Section 2.6 – Roles and Responsibilities Assignment of Roles and Responsibilities
RR-5 The organization has appointed the role of Privacy Official (PO). Determine that : (i) the organization has defined the role of Privacy Official and its responsibilities according to the requirements of SP 800-79-1 (review); (ii) the organization has assigned the role of Privacy Official in the operations plan (review, interview); (iii) the Privacy Official does not have any other roles in the PCI (review, interview). SP 800-79-1, Section 2.6 – Roles and Responsibilities RR-6 The PCI Facility employs processes which adhere to the principle of separation of duties to ensure that no single individual has the capability to issue a PIV Card without the cooperation of another authorized person. Determine that : (i) the PCI facility standard operating procedures document the principle of separation of duties (review); (ii) the PCI facility’s processes demonstrate adherence to the principle of separation of duties (interview, observe). FIPS 201-1, Section 5.2 – PIV Registration
Facility FP-1 Minimum physical controls at the PCI Facility are implemented. These include: (i) use of locked rooms, safes, and cabinets (as appropriate); (ii) physical access to key areas within the facility is restricted to authorized personnel, (iii) security monitoring and automated alarms are implemented, (iv) emergency power and lighting are available, and (v) fire prevention and protection mechanisms are implemented. Determine that: (i) the OIMO and PCIF Managers(s) are aware of the minimum set of physical controls that need to be in place at the facility(ies) (interview); (ii) the minimum physical security controls are implemented by the PCI Facility (observe). Commonly accepted security readiness measures
FP-2 PCI Documentation (e.g., operations plan, standard operating procedures, and contracts) are maintained at each PCI Facility. Determine that: (i) the most current versions of the PCI documentation is available at the PCI Facility for reference as needed (interview, review); Commonly accepted security readiness measures
Equipment FP-3 The PCIF Manager(s) has a copy of the contingency/disaster recovery plan for the information systems, which is stored securely. Determine that : (i) the contingency plan/ disaster recovery plan is stored (ii) securely at the facility (interview, observe); (iii) the PCIF Manager is knowledgeable on how to restore/reconstitute the information systems in case of system failures (interview). Commonly accepted security readiness measures Facility and Personnel Readiness
FP-4 The information systems are managed using a system development life cycle (SDLC) methodology that includes information security considerations Determine that : (i) the information system used by the organization has been developed using an SDLC methodology (review, interview); (ii) information system security is considered as part of the development life cycle (review). Commonly accepted security readiness measures FP-5 Enrollment/identity proofing and card activation/issuance workstations are situated in an enclosed area (wall or partition) to provide privacy for an applicant or card holder. Determine that : (i) PCI Facility workstations are situated in an enclosed area (wall or partition) such that other individuals cannot see an applicant or card holder’s personal information (observe). Commonly accepted security readiness measures
Key Personnel FP-6 All operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing or card activation/issuance are allowed access to information systems only when authenticated through a PIV Card. Determine that : (i) the requirement that all operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing or card activation/issuance are allowed logical access to information systems only when authenticated through a PIV Card, has been documented in the PCI Facility’s standard operating procedures (review); (ii) Operators use PIV Cards to access information systems in the course of performing their roles in the areas of enrollment/ identity proofing or card activation/issuance access (observe). Commonly accepted security readiness measures
FP-7 All operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing, adjudication and card activation/issuance have undergone training that is specific to their duties prior to being allowed to perform in that function. Determine that : (i) The requirement that all operators who perform roles within a PCI Facility in the areas of enrollment/ identity proofing, adjudication and card activation/issuance are allowed access to information systems only after completing a training course specific to their duties. (interview, review); (ii) Records showing that the appropriate training course has been completed by PCI Facility personnel are stored by the facility for audit purposes (review). Commonly accepted security readiness measures
FP-8 All pre-personalized and personalized smart card stock received from card vendors and card production facilities are received only by authorized personnel who ensure that the card stock is stored securely in the PCI Facility. Determine that : (i) the PCI facility has an authorized list of personnel that are responsible for ensuring that smart card stock is received and stored securely in the PCI Facility (interview); (ii) procedures for receiving and storing smart card stock are documented in the PCI Facility’s standard operating procedures (review); (iii) the authorized personnel are knowledgeable of the procedures on how to receive and store smart card stock (interview). Commonly accepted security readiness measures FP-9 The organization maintains a current list of designated points of contact and alternate points of contact for all PCIFs used by the organization for enrollment/identity proofing and card activation/issuance. Determine that : (i) the organization maintains a current list of designated points of contact and alternate points of contact for all PCIFs used by the organization for enrollment/identity proofing and card activation/issuance (review). Commonly accepted security readiness measures
ST-1 The PCI information systems that contain information in identifiable form are handled in compliance with Federal laws and policies, including the Privacy Act of 1974. Determine that : (i) the PCI Facility does not disclose any record which is contained in the system of records to any person, or to another organization unless written consent has been given by the individual to whom the record pertains unless one of the exceptions for disclosure in the Privacy Act are met (review, interview); (ii) individuals are permitted to gain access to their personal record and the information is provided in a form comprehensible to them (review, interview); (iii) individuals are able to request amendments to records pertaining to them, corrections are made promptly and if not, the individual is provided with a reason for the refusal and is able to request a review of the refusal (review, interview); (iv) the organization notifies an individual when their record is made available to any person under a compulsory legal process when such a process becomes a matter of public record (review, interview). FIPS 201-1, Section 2.4 - PIV Privacy Requirements
Protection of Stored and Transmitted Data
ST-2 The information systems protect the integrity and confidentiality of transmitted information. Determine that : (i) the integrity of transmitted information is protected (interview, test, review) (ii) the confidentiality of transmitted information is protected (interview, test, review) FIPS 201-1, Section 2.4 - PIV Privacy Requirements PR-1 Privacy act statement/notice, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees violating privacy policies shall be developed and posted by the organization in multiple locations at the PCI facility (e.g., internet site, human resource offices, regional offices, and contractor orientation handouts). Determine that : (i) the PCI Facility has posted privacy act statement/notice, complaint procedures, appeals procedures for those denied identification or whose identification cards are revoked, and sanctions for employees violating privacy policies (interview, review). OMB Memorandum 05-24
PR-2 The organization has conducted a Privacy Impact Assessment of their PCI information system (s), compliant with Section 208 of the E-Government Act of 2002 and based on guidance found in Appendix E of OMB Memorandum 06-06. Determine that: (i) the organization has conducted a Privacy Impact Assessment of their PCI information system (s) based on guidance found in Appendix E of OMB Memorandum 06- 06 (review); (ii) the organization has submitted the Privacy Impact Assessment of their PCI information system (s) to OMB (interview, review). OMB Memorandum 05-24
PR-3 The organization’s employee and contractor identification systems of records notices (SORN’s) are updated to reflect any changes in the disclosure of information to other organizations in order to be consistent with the Privacy Act of 1974 and OMB Circular A-130, Appendix 1. Determine that: (i) the organization updates SORN’s to reflect changes in the disclosure of information (review, interview). OMB Memorandum 05-24 Enforcement of Privacy Requirements
PR-4 The applicant is notified of what information in identifiable form is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information. Determine that: (i) Before receiving the PIV Card, the PCI Facility requires the applicant to be notified of the personally identifiable information that is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (review, observe) (ii) the applicant is informed of what personally identifiable information is collected, how it will be used, what information will be disclosed and to whom, and what protections are provided to ensure the security of this information (interview) FIPS 201-1, Section 2.4 – PIV Privacy Requirements PR-5 The PCI Facility employs technologies that allow for continuous auditing of compliance with privacy policies and practices. Determine that: (i) the PCI Facility employs technologies that allow for the continuous auditing of compliance with privacy policies and practices. This could include the use of technology to monitor data access, data flows between information systems and the use of personally identifiable information (interview, test). FIPS 201-1, Section 2.4 – PIV Privacy Requirements
PR-6 In the case of termination, any personally identifiable information that has been collected from the cardholder is disposed of in accordance with the stated privacy and data retention policies. Determine that: (i) as a part of PIV Card termination, the organization disposes of personally identifiable information in accordance with its privacy and data retention policies (review, interview). FIPS 201-1, Section 5.3.2.4 – PIV Card Termination
Infrastructure Elements DP-1 In order to be compliant with the provisions of OMB Circular A- 130, App III, the PCI information system(s) are certified in accordance with NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems. Determine that: (i) the organization has a letter showing the current accreditation decision of each information system used to support the PCI (review). FIPS 201-1, Appendix B.2 – Security Certification and Accreditation of IT System(s)
DP-2 Every product utilized by a PCI facility that it falls within one of the categories listed by the GSA FIPS 201 Evaluation program, shall be listed in the GSA FIPS 201 Evaluation Program’s Approved Product List (APL) Determine that: (i) for each product that falls within one of the categories in the GSA FIPS 201 Evaluation Program, its presence (make, model, versions) is checked on the APL (review) OMB Memorandum 05-24 Deployed Products & Information Systems
DP-3 The organization has submitted a personalized PIV Card from their production system to GSA for testing, and it has been approved. Determine that: (i) the organization has a letter from the GSA showing approval of the configuration of their PIV Card (review). OMB Memorandum 07-06
PAT = Infrastructure Elements PAT = Infrastructure Elements CI-1 For legacy Public Key Infrastructures (PKI’s), the organization’s CA shall be cross-certified with the Federal Bridge (FBCA) at a Medium-HW or High Assurance Level. Determine that: the PKI is listed on the FBCA’s website as being cross-certified at a Medium-HW or High Assurance Level. (review). FIPS 201-1, Section 5.4.4 – Migration from Legacy PKIs
CI-2 For non-legacy PKI’s, the CA that issues certificates to support PIV Card authentication participates in the hierarchical PKI for the Common Policy managed by the Federal PKI. Determine that: (i) the PKI is listed on the Federal PKI Policy Authority’s website as being a shared service provider (review). FIPS 201-1, Section 5.4.1 – Architecture
CI-3 When cards are personalized, card management keys are set to be specific to each PIV Card. That is, each PIV Card shall contain a unique card management key. Determine that: (i) the CMS vendor’s documentation shows the use of unique card management keys (review); (ii) the OIMO indicates that card management keys are unique (interview). FIPS 201-1, Section 4.1.6.2 – Activation by Card Management System
CI-4 Fingerprint images retained by organizations shall be formatted according to SP 800-76-1. Determine that: (i) the fingerprint images are formatted according to Table 4 in SP 800-76-1 and INCITS 381 (review, test). SP 800-76-1, Section 3.4 – Fingerprint Template Specifications
CI-5 Facial images collected during enrollment/identity proofing are formatted such that they conform to SP 800-76-1. Determine that: (i) the facial images are formatted according to Table 6 in SP 800-76-1 and INCITS 385 (review, test). SP 800-76-1, Section 5.2 – Acquisition and Format Implementation of Credentialing Infrastructures
CI-6 The fingerprint templates stored on the PIV Card are prepared from images of the primary and secondary fingers where the choice of fingers is based on the order of priority, as provided in FIPS 201-1, Section 4.4.1. Determine that: (i) the procedures used to fingerprint the applicant are based on the primary and secondary finger designations as required by the standard (review, observe); (ii) the fingerprint templates are prepared from images of the primary and secondary fingers (test). SP 800-76-1, Section 3.4.1 – Source Images SP-1 A request is created in order to issue a PIV Card. Determine that: (i) the process for making a request is documented (review); (ii) A PIV Request is created in order to issue a PIV Card (observe). FIPS 201-1, Section 2.1 – Control Objectives
Sponsorship Process SP-2 The PCI Facility collects personal information using only forms approved by OMB under the Paperwork Reduction Act of 1995. Determine that : (i) forms used to collect personal information have been approved by OMB (review, observe). OMB Memorandum 07-06
EI-1 The PCI Facility has a process in place to verify the authenticity of the source documents and match them to the identity claimed by the applicant. Determine that: (i) the PCI Facility has a process in place to verify the authenticity of the source documents and match them to the identity claimed by the applicant (interview, observe); (ii) the PCI Facility has materials used to train enrollment/identity proofing officials on how to verify the authenticity of the source documents (review). FIPS 201-1, Section 2.1 – Control Objectives
EI-2 The PCI Facility requires the applicant to appear in-person at least once before the issuance of a PIV Card. Determine that: (i) the requirement that an applicant appear in-person at least once before the issuance of a PIV Card is documented (review); (ii) the applicant appears in-person at least once before the issuance of a PIV Card (observe).
EI-3 Two identity source documents are checked in accordance with the requirements of Form I-9, OMB No. 1115-0136, Employment Eligibility Verification. Determine that: (i) the requirement to check two identity source documents in accordance with the requirements of Form I-9 is documented (review); (ii) two identity source documents are checked in accordance with the requirements of Form I-9 during enrollment/identity proofing (observe). Enrollment / Identity Proofing Process
EI-4 One of the identity source documents used to verify the claimed identity of the applicant is a valid Federal or state government- issued photo identification. Determine that: (i) the requirement that one of the identity source documents is a valid Federal or state government issued photo ID is documented (review); (ii) one of the identity source documents used to verify the claimed identity of the applicant is a valid Federal or state government-issued photo identification (observe). EI-5 The PCI Facility performs the entire identity proofing and enrollment/identity proofing process prior to re-issuing a PIV Card. Determine that: (i) the requirement to perform the entire identity proofing and enrollment process prior to re-issuing a PIV Card is documented (review); (ii) the PCI Facility performs the entire identity proofing and enrollment process prior to re-issuing a PIV Card (observe). FIPS 201-1, Section 5.3.2.2 PIV Card Reissuance
EI-6 A new facial image is collected at the time of reissuance. Determine that: (i) the requirement to capture a new facial image is documented within the reissuance process (review); (ii) a new facial image is collected at the time of reissuance (observe). FIPS 201-1, Section 4.4 – Biometric Data Specifications
EI-7 The biometrics (fingerprints and facial image) that are used to personalize the PIV Card must be captured during the enrollment/identity proofing process. Determine that: (i) the requirement to capture biometrics (fingerprints and facial image) that are used to personalize the PIV Card must be captured during enrollment/identity proofing process is documented (review); (ii) The biometrics (fingerprints and facial image) that are used to personalize the PIV Card are captured during the enrollment/identity proofing process (observe). FIPS 201-1, Section 5.2 – PIV Registration Requirement
EI-8 A cardholder waits until six weeks prior to the expiration of a valid PIV Card before applying for renewal (please note: this applies to normal renewal only and not for lost or damaged cards). Determine that: (i) the requirement that a cardholder must wait until six weeks prior to the expiration of a valid PIV Card before applying for renewal is documented (review); (ii) a cardholder waits until six weeks prior to the expiration of a valid PIV Card before applying for renewal (interview). FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
EI-9 The PCI Facility captures the applicant’s fingerprints in accordance with any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or (iii) rolled ink card. (i) the PCI Facility captures the applicant’s fingerprints in accordance with any of the three imaging modes: (i) plain live scan, (ii) rolled live scan, or (iii) rolled ink card (observe). SP 800-76-1, Section 3.3 – Fingerprint Image Acquisition EI-10 The PCI Facility has an attending official present at the time of fingerprint capture. Determine that: (i) the requirement that the PCI Facility has an attending official present at the time of fingerprint capture is documented (review); (ii) the PCI Facility has an attending official present at the time of fingerprint capture (observe). SP 800-76-1, Section 3.3 – Fingerprint Image Acquisition
EI-11 The PCI Facility acquires fingerprint images in accordance with Table 2 in 800-76-1. Determine that: (i) fingers are inspected for the absence of foreign materials (observe); (ii) scanner and card surfaces are clean (observe); (iii) the presentation of fingers for a plain live scan, rolled live scan, and rolled ink card are based on procedures in Table 1 (observe); (iv) multi-finger plain impression images are properly segmented into single finger images (observe). SP 800-76-1, Section 3.3 – Fingerprint Image Acquisition
EI-12 The PCI Facility captures the 10 fingerprints of the applicant. In the case where less than ten fingers are available, the missing fingers are labeled before transmitting to the FBI. Determine that: (i) the requirement that the PCI Facility captures the 10 fingerprints of the applicant and labels any missing fingers is documented (review); (ii) the PCI Facility captures the 10 fingerprints of the applicant and labels any missing fingers (observe). SP 800-76-1, Section 3.3 – Fingerprint image acquisition
Adjudication Process AP-1 The organization conducts a National Agency Check with Written Inquiries (NACI), or other Office of Personnel Management (OPM) or National Security community investigation for each applicant for whom a successfully adjudicated NACI cannot be referenced on file. Determine that: (i) the requirement that the organization conduct a National Agency Check with Written Inquiries (NACI), or other Office of Personnel Management (OPM) or National Security community investigation for each applicant for whom a successfully adjudicated NACI cannot be referenced on file is documented (review); (ii) the organization conducts a National Agency Check with Written Inquiries (NACI), or other Office of Personnel Management (OPM) or National Security community investigation for each applicant for whom a successfully adjudicated NACI cannot be referenced on file (interview). AP-2 The organization successfully adjudicates the FBI National Criminal History Check (fingerprint check) and initiates the National Agency Check with Written Inquires (NACI) before the PIV Card is issued. Determine that: (i) the requirement that the organization successfully adjudicates the FBI National Criminal History Check (fingerprint check) and initiates the National Agency Check with Written Inquires (NACI) before the PIV Card is issued is documented (review); (ii) the organization successfully adjudicates the FBI National Criminal History Check (fingerprint check) and initiates the National Agency Check with Written Inquires (NACI) before the PIV Card is issued (interview).
CP-1 The PIV Card implements security features that aid in reducing counterfeiting, are resistant to tampering, and provide visual evidence of tampering attempts. Determine that: (i) the PIV Card contains at least one security feature. Examples of these security features include the following: (i) Optical varying structures, (ii) Optical varying inks, (iii) Laser etching and engraving, (iv) Holograms, (v) Holographic images, (vi) Watermarks (interview, observe ). FIPS 201-1, Section 4.1.2 – Tamper Proofing and Resistance
CP-2 The PIV Card is not embossed. Determine that: (i) the PIV Card is not embossed (review, observe) FIPS 201-1, Section 4.1.3 – Physical Characteristics and Durability
CP-3 Decals are not adhered to the PIV Card. Determine that: (i) decals are not adhered to the PIV Card (review, observe). FIPS 201-1, Section 4.1.3 – Physical Characteristics and Durability Card Production Process
CP-4 If organizations choose to punch an opening in the card body to enable the card to be worn on a lanyard, all such alterations are closely coordinated with the card vendor and/or manufacturer to ensure the card material integrity is not adversely impacted. Determine that: (i) the integrity of a PIV Card is not affected by a punched opening (test); (ii) Documentation from the PIV Card vendor shows that durability and operational requirements have not been compromised (review). FIPS 201-1, Section 4.1.3 – Physical Characteristics and Durability AI-1 The personalized PIV Card complies with all the mandatory items on the front of the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 for (i)a photograph; (ii) name; (iii) employee affiliation; (iv) and expiration date (observe, test). FIPS 201-1, Section 4.1.4.1 – Mandatory Items on the Front of the PIV Card
AI-2 The personalized PIV Card complies with all the mandatory items on the back of the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 for (i) an organization card serial number; (ii) and issuer identification (observe, test). FIPS 201-1, Section 4.1.4.2 – Mandatory Items on the Back of the Card
AI-3 If one or more optional items are printed on the front of the PIV Card, they comply with the requirements for the optional items on the front on the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 if it includes optional items on the front of the card, such as (i) a signature; (ii) organization specific text area; (iii) rank; (iv) portable data file; (v) header; (vi) organization seal; (vii) footer; (viii) issue date; (ix) color-coding employee affiliation; (x) photo border for employee affiliation; (xi) organization-specific data (observe, test). FIPS 201-1, Section 4.1.4.3 – Optional Items on the Front of the Card
AI-4 If one or more optional items are printed on the back of the PIV Card, they comply with the requirements for the optional items on the back on the PIV Card. Determine that: (i) the PIV Card meets specific requirements in FIPS 201-1 if it includes optional items on the front of the card, such as (i) magnetic stripe; (ii) return to address (iii) physical characteristics of the cardholder; (iv) additional language for emergency responder officials; (v) standard Section 499, Title 18 language; (vi) linear 3 of 9 bar code; (vii) organization-specific text (zones 9 & 10) (observe, test). FIPS 201-1, Section 4.1.4.4 – Optional Items on the Back of the Card
AI-5 The PIV Card includes mechanisms to limit the number of PIN guesses an adversary can attempt if a card is lost or stolen. Determine that: (i) the PIV Card limits the number of incorrect PIN guesses (test, review). FIPS 201-1, Section 4.1.6.1 – Activation by Cardholder Card Activation / Issuance Process
AI-6 The PIV Card is valid for no more than five years. Determine that: (i) the expiration date printed on the PIV Card is no more than five years from the issuance date (observe). (ii) the expiration date is printed in the CHUID (test) (iii) the two dates (printed on the card and the expiration date in the CHUID) are the same (test) FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal AI-7 The PCI Facility performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record before releasing the PIV Card to the applicant. Determine that: (i) the requirement that the issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record is documented (review); (ii) the issuer performs a 1:1 biometric match of the applicant against the biometric included in the PIV Card or in the PIV enrollment record (observe). FIPS 201-1, Section 5.3.1 – PIV Card Issuance
AI-8 The PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to renewal. Determine that: (i) the requirement that the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to renewal is documented (review); (ii) the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to renewal (observe). FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
AI-9 The PCI Facility advises applicants that the PIN on the PIV Card should not be easily-guess-able or otherwise individually- identifiable in nature. Determine that: (i) the requirement that the PCI Facility advises applicants that the PIN on the PIV Card should not be easily-guess- able or otherwise individually-identifiable in nature is documented (review); (ii) the PCI Facility advises applicants that the PIN on the PIV Card should not be easily-guess-able or otherwise individually-identifiable in nature (observe). FIPS 201-1, Section 4.1.6.1 Activation by Cardholder
AI-10 Identity cards issued to individuals without a completed NACI or equivalent are electronically distinguishable from identity cards issued to individuals who have a completed investigation. Determine that: (i) the PCI Facility has procedures for how to update the NACI interim indicator extension for identity cards issued to individuals without a completed NACI or equivalent (review, interview); (ii) for individuals without a completed NACI or equivalent, the NACI interim indicator is set to true (test); (iii) for individuals with a completed NACI or equivalent, the NACI interim indicator is set to false (test). AI-11 During a PIN reset on a locked PIV Card, the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card prior to releasing the unlocked PIV Card back to the Card holder. Determine that: (i) the requirement that, during a PIN reset on the PIV Card, the PCI Facility performs a 1:1 biometric match of the PIV Card holder against the biometric included in the PIV Card before releasing the PIV Card is documented (review); (ii) after PIN reset on the PIV Card, the PCI Facility performs a 1:1 biometric match of the PIV Card Holder against the biometric included in the PIV before releasing the PIV Card (observe). FIPS 201-1, Section 5.3.2.3 – PIV Card PIN Reset
AI-12 The PCI Facility issues an electro-magnetically opaque sleeve or other protection technology to protect against any unauthorized contactless access to information stored on a PIV credential. Determine that : (i) the requirement that the PCI Facility issue an electro- magnetically opaque sleeve with every PIV Card is documented (review); (ii) the PCI Facility issues an electro-magnetically opaque sleeve with every PIV Card ( interview, observe). FIPS 201-1, Section 2.4 – Privacy Requirements
AI-13 The organization verifies that the PIV cardholder remains in good standing, and personnel records are current before renewing/reissuing the card and associated credentials. Determine that : (i) the procedures that are followed to determine that the cardholder’s records are current are documented (review); (ii) the procedures to determine the currency of the cardholder’s records are followed by the PCI facility prior to renewal or reissuance of a PIV Card (observe) FIPS 201-1, Section 5.3.2.1 – PIV Card Renewal
Maintenance Process MP-1 The PIV FASC-N is not modified post-issuance. Determine that: (i) the PIV FASC-N is not modified post-issuance (review, interview). FIPS 201-1, Section 4.2 – Cardholder Unique Identifier MP-2 In the case of a renewal, re-issuance and termination, the PIV Card is collected and destroyed whenever possible. Determine that: (i) in the case of a renewal, re-issuance and termination, the requirement that the PIV Card is collected and destroyed whenever possible is documented (review); (ii) in the case of a renewal, re-issuance and termination, the PIV Card is collected and destroyed whenever possible (interview). FIPS 201-1, Section 2.3 – PIV Issuance and Maintenance Requirements
MP-3 Normal operational procedures must be in place to ensure proper card revocation during PIV Card re-issuance and termination: (i) The PIV Card itself is revoked; (ii) Databases containing Federal Agency Smart Credential Number (FASC-N) values must be updated to reflect the change in status; (iii) The Certification Authority (CA) is informed and CRLs are updated ; and (iv) Online Certificate Status Protocol (OCSP) responders are updated so that queries with respect to certificates on the PIV Card are answered appropriately. Determine that: (i) the PIV Card is revoked during card revocation (review, interview); (ii) databases containing Federal Agency Smart Credential Number (FASC-N) values must be updated to reflect the change in status (interview); (iii) the CA is informed and the revoked certificates on the PIV Card are placed on the CRL (test, review); (iv) online Certificate Status Protocol (OCSP) responders are updated (test, review). FIPS 201-1 Section 5.3.2.4 PIV Card Termination
MP-4 If the PIV Card cannot be collected and destroyed, normal operating procedures are completed within 18 hours of notification. Determine that: (i) documentation includes the requirement that if PIV Card cannot be collected and destroyed, normal operating procedures are completed within 18 hours of notification (review); (ii) if the PIV Card cannot be collected and destroyed, normal operating procedures are completed within 18 hours of notification (observe). FIPS 201-1, Section 5.3.2.2 – PIV Card Reissuance
MP-5 Upon PIV Card termination, the organization enforces a standard methodology of updating systems of records to indicate employee termination, and this status is distributed effectively throughout systems used for physical and logical access to organization facilities and resources. Determine that: (i) the PCI Facility has documented its procedures for updating information systems to indicate employee termination (review); (ii) the PCI Facility updates information systems to indicate employee termination (interview, observe). FIPS 201-1, Section 5.3.2 - PIV Card Maintenance
MP-6 The organization posts a quarterly report, to the organization’s website, stating the number of PIV Cards issued to date, and the link is emailed to OMB. OMB Memorandum 07-06 Determine that : (i) the organization develops and posts a quarterly report to the organization’s website according to the requirements of the attachment to OMB memorandum 07-06 (review); (ii) the organization sends the link to the report to OMB on a quarterly basis (review, interview). MP-7 The organization has completed a lifecycle walkthrough at one year intervals since the last accreditation date, and the results are documented in a report to the DAA. Determine that : (i) the organization has completed a lifecycle walkthrough to cover sponsorship, enrollment/identity proofing, card production, card activation/issuance and maintenance processes (interview); (ii) a lifecycle walkthrough has been completed at one year intervals since the last accreditation date (interview); (iii) the results of the PCI lifecycle walkthrough have been documented and reviewed by the DAA (review, interview). SP 800-79-1, Section 5.4 - Monitoring Phase