2.3 Purpose and Scope
All changes in this version
Title changed
Before · SP 800-116
Purpose and Scope
After · SP 800-116 Rev. 1
Purpose and Scope
Control changed
Before · SP 800-116
The purpose of this document is to describe a strategy allowing agencies to PIV-enable their PACS, and migrate to government-wide interoperability. Specifically, the document recommends a risk-based approach for selecting appropriate PIV authentication mechanisms to manage physical access to Federal government facilities and assets. With the intent to facilitate and encourage greater use of PIV Cards, this document:
+ Describes the desired characteristics of a target implementation of PIV-enabled PACS.
+ Describes trust and infrastructure challenges that must be overcome to achieve government-wide credential interoperability.
+ Discusses the PIV Card capabilities so that risk-based assessment can be aligned with the appropriate PIV authentication mechanism.
+ Recommends to Federal agencies an overall strategy for the implementation of PIV authentication mechanisms with agency facility PACS.
+ Proposes a PIMM to measure the progress of facility and agency implementations.
As stated above, this document focuses on the use of PIV Cards to gain access to Federal buildings and facilities. This document does not address non-PIV authentication mechanisms. Although the ergonomic design of PACS components is outside the scope of this publication, the 1998 Amendment to Section 508 of the Rehabilitation Act has special relevance to PACS components. [SECTION508] PACS access controls are intended to be unavoidable. Section 508 should be considered early during projects that integrate the PIV System with PACS. Section 508 should be considered as it applies to enrollment software, smart card and biometric readers, monitoring systems, and access control point sensors and actuators. Note that FIPS 201, Section 4.4.1, states that an alternative to BIO or BIO-A authentication mechanism should be used if one or more fingers cannot be enrolled. Further information can be found at [SECTION508], in [FIPS201], and in [SP800-76]. Many other aspects of physical access control are outside the scope of this publication. Authorization (i.e., granting permission within a PACS for an identified person to pass access control points) is a critical security function, but is out of scope for the PIV System. Other out- of-scope functions include area protection, intrusion detection, monitoring and tracking (other than at access control points), and enforcement of access control decisions. It is understood that PACS may also be integrated with surveillance systems, fire control systems, evacuation systems, etc., within a facility. This document does not address the integration of PACS with other facility-centric information technology (IT) systems, although it has been written to minimize conflicts during such integration. Therefore, if the integration of the measures outlined in this document creates a life-safety risk, organizations will need to mitigate these risks before applying the measures. The evaluation of specific PACS architectures or implementations is also outside the scope of this publication, as is the standardization of PACS. The creation of specific migration plans for each agency and facility is also not the intent of this document, although it offers advice on the construction of such plans. Unless normatively referenced, this document is a best practice guideline. Recommendation: This document recommends a risk-based approach for selecting appropriate PIV authentication mechanisms to manage physical access to Federal government facilities and assets. Agencies should seek recommendations on PACS architectures, authorization, and facility protection from other sources.
After · SP 800-116 Rev. 1
The purpose of this document is to describe a strategy allowing agencies to PIV-enable their PACS, and migrate to government-wide interoperability. Specifically, the document recommends a risk-based approach for selecting appropriate PIV authentication mechanisms to manage physical access to Federal government facilities and assets. With the intent to facilitate and encourage greater use of PIV Cards, this document:
+ Describes the desired characteristics of a target implementation of PIV-enabled PACS.
+ Describes trust and infrastructure challenges that must be overcome to achieve government-wide credential interoperability.
+ Discusses the PIV Card capabilities so that risk-based assessment can be aligned with the appropriate PIV authentication mechanism.
+ Recommends to Federal agencies an overall strategy for the implementation of PIV authentication mechanisms with agency facility PACS.
+ Proposes a PIMM to measure the progress of facility and agency implementations.
As stated above, this document focuses on the use of PIV Cards to gain access to Federal buildings and facilities. This document does not address non-PIV authentication mechanisms. Although the ergonomic design of PACS components is outside the scope of this publication, the 1998 Amendment to Section 508 of the Rehabilitation Act has special relevance to PACS components. [SECTION508] PACS access controls are intended to be unavoidable. Section 508 should be considered early during projects that integrate the PIV System with PACS. Section 508 should be considered as it applies to enrollment software, smart card and biometric readers, monitoring systems, and access control point sensors and actuators. Note that FIPS 201, Section 4.4.1, states that an alternative to BIO or BIO-A authentication mechanism should be used if one or more fingers cannot be enrolled. Further information can be found at [SECTION508], in [FIPS201], and in [SP800-76]. Many other aspects of physical access control are outside the scope of this publication. Authorization (i.e., granting permission within a PACS for an identified person to pass access control points) is a critical security function, but is out of scope for the PIV System. Other out- of-scope functions include area protection, intrusion detection, monitoring and tracking (other than at access control points), and enforcement of access control decisions. It is understood that PACS may also be integrated with surveillance systems, fire control systems, evacuation systems, etc., within a facility. This document does not address the integration of PACS with other facility-centric information technology (IT) systems, although it has been written to minimize conflicts during such integration. Therefore, if the integration of the measures outlined in this document creates a life-safety risk, organizations will need to mitigate these risks before applying the measures. The evaluation of specific PACS architectures or implementations is also outside the scope of this publication, as is the standardization of PACS. The creation of specific migration plans for each agency and facility is also not the intent of this document, although it offers advice on the construction of such plans. Unless normatively referenced, this document is a best practice guideline. Recommendation: This document recommends a risk-based approach for selecting appropriate PIV authentication mechanisms to manage physical access to Federal government facilities and assets. Agencies should seek recommendations on PACS architectures, authorization, and facility protection from other sources.