IA-02(12) Acceptance of PIV Credentials
All changes in this version
Title
Acceptance of PIV Credentials
Control
Accept and electronically verify Personal Identity Verification-compliant credentials.
Discussion
Acceptance of Personal Identity Verification (PIV)-compliant credentials applies to organizations implementing logical access control and physical access control systems. PIV-compliant credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. The adequacy and reliability of PIV card issuers are authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03) . Acceptance of PIV-compliant credentials includes derived PIV credentials, the use of which is addressed in [SP 800-166](#e8552d48-cf41-40aa-8b06-f45f7fb4706c) . The DOD Common Access Card (CAC) is an example of a PIV credential.
Assessment objective
IA-02(12) Personal Identity Verification-compliant credentials are accepted and electronically verified.
STIG rules that implement this control 19
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001060 CAT II The macOS system must set smart card certificate trust to moderate.
- APPL-15-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-15-003030 CAT II The macOS system must allow smart card authentication.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001060 CAT II The macOS system must set smart card certificate trust to moderate.
- APPL-26-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-26-003030 CAT II The macOS system must allow smart card authentication.
Application Security and Development V6R5
- APSC-DV-001560 CAT II The application must accept Personal Identity Verification (PIV) credentials.
- APSC-DV-001570 CAT II The application must electronically verify Personal Identity Verification (PIV) credentials.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-612015 CAT II Ubuntu 22.04 LTS must accept personal identity verification (PIV) credentials.
- UBTU-22-612025 CAT II Ubuntu 22.04 LTS must electronically verify personal identity verification (PIV) credentials.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100900 CAT II Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials.
- UBTU-24-100910 CAT II Ubuntu 24.04 LTS must accept Personal Identity Verification (PIV) credentials managed through the Privileged Access Management (PAM) framework.
- UBTU-24-400060 CAT II Ubuntu 24.04 LTS must electronically verify Personal Identity Verification (PIV) credentials.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200620 CAT II RHEL 10 must have the "opensc" package installed.
- RHEL-10-200730 CAT II RHEL 10 must have the "pkcs11-provider" package installed.
- RHEL-10-701230 CAT II RHEL 10 must implement certificate status checking for multifactor authentication.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-215075 CAT II RHEL 9 must have the openssl-pkcs11 package installed.
- RHEL-09-611170 CAT II RHEL 9 must implement certificate status checking for multifactor authentication.
- RHEL-09-611185 CAT II RHEL 9 must have the opensc package installed.