Appendix H ASSESSMENT AND ACCREDITATION TASKS FOR PIV CARD ISSUERS
All changes in this version
Title changed
Before · SP 800-79-1
ASSESSMENT AND ACCREDITATION TASKS FOR PIV CARD ISSUERS
After · SP 800-79-2
ASSESSMENT AND ACCREDITATION TASKS FOR PIV CARD ISSUERS
Control changed
Before · SP 800-79-1
(PCIS)
Initiation Phase
Task 1: Preparation
Subtask 1.1: Confirm that the PCI and its operations have been fully described and documented in the PCI‘s operations plan. OIMO
Subtask 1.2: Confirm that processes conducted by the PCI Facility are in accordance with the policies and procedures specified in the PCI operations plan and are documented in Standard Operating Procedures. OIMO, PCIF Manager
Task 2: Resource Identification
Subtask 2.1: Identify the Senior Authorizing Official (SAO), Designated Accreditation Authority (DAA), Privacy Official (PO), PCIF Managers, Assessor, and other key personnel at the facility level, who are performing functions such as enrollment/identity proofing, card production, and card activation/issuance. OIMO
Subtask 2.2: Determine the accreditation boundary for the PCI. OIMO, DAA
Subtask 2.3: Determine the resources and the time needed for the accreditation of the PCI, and prepare for execution of the assessment. OIMO, DAA
Task 3: Operations Plan Analysis and Acceptance
Subtask 3.1: Review the list of required PCI controls documented in the organization’s PCI operation plan to confirm that they have been implemented properly. DAA, OIMO
Subtask 3.2: Analyze the PCI operations plan to determine if there are deficiencies in satisfying all the policies, procedures, and other requirements in FIPS 201-1 that could result in a DATO being issued. DAA, OIMO
Subtask 3.3: Verify that the PCI operations plan is acceptable. DAA
Assessment Phase Task 4: PCI Control Assessment
Subtask 4.1: Review the suggested and selected assessment methods for each PCI control in preparation for the assessment. Assessor
Subtask 4.2: Assemble all documentation and supporting materials necessary for the assessment of the PCI; if these documents include previous assessments, review the findings and determine if they are applicable to the current assessment. OIMO, Assessor
Subtask 4.3: Assess the required PCI controls using the prescribed assessment procedures found in Appendix G. Assessor
Subtask 4.4: Prepare the assessment report. Assessor
Task 5: Assessment Documentation
Subtask 5.1: Provide the OIMO with the assessment report. Assessor Subtask 5.2: Revise the PCI operations plan (if necessary) and implement its new provisions. OIMO
Subtask 5.3: Prepare the corrective actions plan (CAP). OIMO Subtask 5.4: Assemble the accreditation submission package and submit to the DAA. OIMO
Accreditation Phase
Task 6: Accreditation Decision
Subtask 6.1: Review the assessment decision package to see if it is complete and that all applicable PCI controls have been fully assessed using the designated assessment procedures. DAA
Subtask 6.2: Determine that the risk to the organization’s operations, assets, or potentially affected individuals is acceptable, that the PCI controls have been adequately assessed and prepare the final accreditation decision letter DAA
Task 7: Accreditation Documentation
Subtask 7.1: Provide copies of the final accreditation package, in either paper or electronic form, to the OIMO and any other organization officials having interests, roles, or responsibilities in the PCI DAA Subtask 7.2: Update the PCI’s operations plan. OIMO
Monitoring Phase
Task 8: Operations Plan Update
Subtask 8.1: Document all relevant changes in the PCI within the operations plan OIMO
Subtask 8.2: Analyze the proposed or actual changes to the PCI, and determine the impact of such changes. OIMO
Task 9: Annual Lifecycle Walkthrough
Subtask 9.1: Observe all the processes involved in getting a PIV Card, including those from sponsorship to maintenance. Observe each process, and compare its controls against the applicable list of required PCI controls. If a PCI has several facilities, this process should be repeated using randomly selected PCIFs. OIMO (or designated appointee)
Subtask 9.2: The results of the lifecycle walkthrough are summarized in a report to the DAA. Deficiencies must be highlighted along with corrective actions that must be implemented to correct any deficiencies. OIMO, DAA
After · SP 800-79-2
(PCIS)
Initiation Phase
Task 1: Preparation
Subtask 1.1: Confirm that the PCI and its operations have been fully described and documented in the PCI‘s operations plan. OIMO
Subtask 1.2: Confirm that processes conducted by the PCI Facility are in accordance with the policies and procedures specified in the PCI operations plan and are documented in Standard Operating Procedures. OIMO, PCIF Manager
Task 2: Resource Identification
Subtask 2.1: Identify the Senior Authorizing Official (SAO), Designated Accreditation Authority (DAA), Privacy Official (PO), PCIF Managers, Assessor, and other key personnel at the facility level, who are performing functions such as enrollment/identity proofing, card production, and card activation/issuance. OIMO
Subtask 2.2: Determine the accreditation boundary for the PCI. OIMO, DAA
Subtask 2.3: Determine the resources and the time needed for the accreditation of the PCI, and prepare for execution of the assessment. OIMO, DAA
Task 3: Operations Plan Analysis and Acceptance
Subtask 3.1: Review the list of required PCI controls documented in the organization’s PCI operation plan to confirm that they have been implemented properly. DAA, OIMO
Subtask 3.2: Analyze the PCI operations plan to determine if there are deficiencies in satisfying all the policies, procedures, and other requirements in FIPS 201-1 that could result in a DATO being issued. DAA, OIMO
Subtask 3.3: Verify that the PCI operations plan is acceptable. DAA
Assessment Phase Task 4: PCI Control Assessment
Subtask 4.1: Review the suggested and selected assessment methods for each PCI control in preparation for the assessment. Assessor
Subtask 4.2: Assemble all documentation and supporting materials necessary for the assessment of the PCI; if these documents include previous assessments, review the findings and determine if they are applicable to the current assessment. OIMO, Assessor
Subtask 4.3: Assess the required PCI controls using the prescribed assessment procedures found in Appendix G. Assessor
Subtask 4.4: Prepare the assessment report. Assessor
Task 5: Assessment Documentation
Subtask 5.1: Provide the OIMO with the assessment report. Assessor Subtask 5.2: Revise the PCI operations plan (if necessary) and implement its new provisions. OIMO
Subtask 5.3: Prepare the corrective actions plan (CAP). OIMO Subtask 5.4: Assemble the accreditation submission package and submit to the DAA. OIMO
Accreditation Phase
Task 6: Accreditation Decision
Subtask 6.1: Review the assessment decision package to see if it is complete and that all applicable PCI controls have been fully assessed using the designated assessment procedures. DAA
Subtask 6.2: Determine that the risk to the organization’s operations, assets, or potentially affected individuals is acceptable, that the PCI controls have been adequately assessed and prepare the final accreditation decision letter DAA
Task 7: Accreditation Documentation
Subtask 7.1: Provide copies of the final accreditation package, in either paper or electronic form, to the OIMO and any other organization officials having interests, roles, or responsibilities in the PCI DAA Subtask 7.2: Update the PCI’s operations plan. OIMO
Monitoring Phase
Task 8: Operations Plan Update
Subtask 8.1: Document all relevant changes in the PCI within the operations plan OIMO
Subtask 8.2: Analyze the proposed or actual changes to the PCI, and determine the impact of such changes. OIMO
Task 9: Annual Lifecycle Walkthrough
Subtask 9.1: Observe all the processes involved in getting a PIV Card, including those from sponsorship to maintenance. Observe each process, and compare its controls against the applicable list of required PCI controls. If a PCI has several facilities, this process should be repeated using randomly selected PCIFs. OIMO (or designated appointee)
Subtask 9.2: The results of the lifecycle walkthrough are summarized in a report to the DAA. Deficiencies must be highlighted along with corrective actions that must be implemented to correct any deficiencies. OIMO, DAA