8 PACS Use Cases
All changes in this version
Title changed
Before · SP 800-116
PACS Use Cases
After · SP 800-116 Rev. 1
PACS Use Cases
Control changed
Before · SP 800-116
HSPD-12 requires that PIV credentials include graduated criteria, from least secure to most secure, for authentication to ensure flexibility in selecting the appropriate level of security for each application. PIV credentials, as defined in FIPS 201, offer a range of security which is discussed in Section 7. This section provides recommendations for the appropriate use of graduated security in PIV credentials for the PACS. PIV credentials can be used at Federally-owned buildings or leased spaces, single or multi-tenant occupancy, commercial spaces shared with non-government tenants, and government-owned contractor-operated facilities. This includes existing and new construction or major modernizations, standalone facilities, and Federal campuses. Thus, PIV credentials apply to facilities requiring varying levels of security with differing security requirements. To begin, the agency must know the security requirements for its facility. Since this is beyond the scope of this document, it is assumed that the agency has completed its facility security risk assessment. It is also assumed that the agency is using the FSL Determination 12 to derive the security requirement for its facility. The FSL takes into account size and population, as well as several other factors that capture the value of the facility to the government and to potential adversaries. Other factors, including mission criticality, symbolism, and threat to tenant agency, are also considered. For the purposes of protecting assets and placement of proper security measures, size and population may not be as important as the mission criticality, symbolism, and threat to the tenant agency. Although there is no simple one-to-one mapping between FSL and the authentication mechanism(s), the FSL indicates the general risk to the facility. Based on the FSL, an agency should identify and categorize PACS perimeters as protecting Controlled, Limited, or Exclusion areas. Appropriate security measures can then be implemented based on the areas identified for the facility in consultation with the real property authority and legal authority. This section provides example use cases of PIV authentication mechanisms in the following facility environments:
+ Single-Tenant Facility—A facility that only includes a Federal tenant, or multiple components of the same department or agency that fall under one “umbrella” for security purposes.
+ Multi-Tenant Facility—A facility that includes tenants from multiple Federal departments and agencies, but no non-Federal tenants.
+ Mixed-Multi-Tenant Facility—A facility that includes tenants from multiple Federal departments and agencies as well as one or more non-Federal tenants.
+ Single-Tenant Campus—Federal facilities with two or more buildings surrounded (and thus defined) by a perimeter.
+ Multi-Tenant Campus—Two or more Federal facilities located contiguous to one another and typically sharing some aspects of the environment, such as parking, courtyards, private vehicle access roads or gates, entrances to connected facilities, etc. May also be referred to as a “Federal center” or “Complex”.
12 FSL determination is the criteria and process used in determining the facilities security level of a Federal facility.
After · SP 800-116 Rev. 1
HSPD-12 requires that PIV credentials include graduated criteria, from least secure to most secure, for authentication to ensure flexibility in selecting the appropriate level of security for each application. PIV credentials, as defined in FIPS 201, offer a range of security which is discussed in Section 7. This section provides recommendations for the appropriate use of graduated security in PIV credentials for the PACS. PIV credentials can be used at Federally-owned buildings or leased spaces, single or multi-tenant occupancy, commercial spaces shared with non-government tenants, and government-owned contractor-operated facilities. This includes existing and new construction or major modernizations, standalone facilities, and Federal campuses. Thus, PIV credentials apply to facilities requiring varying levels of security with differing security requirements. To begin, the agency must know the security requirements for its facility. Since this is beyond the scope of this document, it is assumed that the agency has completed its facility security risk assessment. It is also assumed that the agency is using the FSL Determination 12 to derive the security requirement for its facility. The FSL takes into account size and population, as well as several other factors that capture the value of the facility to the government and to potential adversaries. Other factors, including mission criticality, symbolism, and threat to tenant agency, are also considered. For the purposes of protecting assets and placement of proper security measures, size and population may not be as important as the mission criticality, symbolism, and threat to the tenant agency. Although there is no simple one-to-one mapping between FSL and the authentication mechanism(s), the FSL indicates the general risk to the facility. Based on the FSL, an agency should identify and categorize PACS perimeters as protecting Controlled, Limited, or Exclusion areas. Appropriate security measures can then be implemented based on the areas identified for the facility in consultation with the real property authority and legal authority. This section provides example use cases of PIV authentication mechanisms in the following facility environments:
+ Single-Tenant Facility—A facility that only includes a Federal tenant, or multiple components of the same department or agency that fall under one “umbrella” for security purposes.
+ Multi-Tenant Facility—A facility that includes tenants from multiple Federal departments and agencies, but no non-Federal tenants.
+ Mixed-Multi-Tenant Facility—A facility that includes tenants from multiple Federal departments and agencies as well as one or more non-Federal tenants.
+ Single-Tenant Campus—Federal facilities with two or more buildings surrounded (and thus defined) by a perimeter.
+ Multi-Tenant Campus—Two or more Federal facilities located contiguous to one another and typically sharing some aspects of the environment, such as parking, courtyards, private vehicle access roads or gates, entrances to connected facilities, etc. May also be referred to as a “Federal center” or “Complex”.
12 FSL determination is the criteria and process used in determining the facilities security level of a Federal facility.