D.3 Invalidation of PACS Derived PIV
NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
All changes in this version
Title
Invalidation of PACS Derived PIV
Control
A derived PIV credential that is used for physical access SHALL be invalidated when the associated PIV identity account is terminated or when the PACS credential or the device on which it resides has been lost or compromised. The IdMS SHALL revoke the card authentication certificate associated with the lost or compromised device or all such certificates associated with the terminated PIV identity account. The home agency IdMS SHOULD direct all physical access control systems known to use the credential to remove it from their access control lists.