BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1.2 FAL2

NIST PIV and digital identity SP 800-217 (Draft)
All changes in this version
first version loaded 4 Federation Assurance Level (FAL) 788 part of 4.1

Title

FAL2

Control

All of the requirements for FAL1 apply at FAL2 except when more specific or stringent requirements in this section override them.

As defined in [SP800-63C] , FAL2 requires the assertion presentation to be protected against injection by an attacker at the RP. To accomplish this, PIV federation at FAL2 SHALL use back-channel presentation methods.

The establishment of the trust agreement and determination of the PIV IdP at FAL2 SHALL be performed prior to the start of the federation transaction. In this establishment, the RP SHALL ensure that the PIV IdP is the home agency IdP that 823 824 825 826

827 828 829

830 831

832 833 834 835 836 837 838 839 840 841

842 843 844 845 846 847 848 849 850 851 852

853 854 855 856 857

858 859 860 represents the population of accounts in question. This process MAY be augmented by automated processes (e.g., key exchange) and facilitated by trusted parties (e.g., federation authority).