NIST.FIPS.201-3-draft.pdf

FIPS PUB 201-3 (DRAFT)

Federal Information Processing Standards Publication (Supersedes FIPS 201-2)

Personal Identity Verification (PIV) of Federal Employees and Contractors

Category: Information Security Subcategory: Identity

Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8900

This publication is available free of charge from:

https://doi.org/10.6028/NIST.FIPS.201-3-draft

Issued November 2020

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Undersecretary of Commerce for Standards and Technology https://doi.org/10.6028/NIST.FIPS.201-3-draft

FOREWORD

The Federal Information Processing Standards Publication Series of the National Institute of Standards and Technology is the oÿcial series of publications relating to standards and guidelines adopted and promulgated under the provisions of the Federal Information Security Modernization Act (FISMA) of 2014.

Comments concerning Federal Information Processing Standard publications are welcomed and should be addressed to the Director, Information Technology Laboratory, National Institute of Standards and Technology, 100 Bureau Drive, Stop 8900, Gaithersburg, MD 20899-8900.

Charles H. Romine, Director Information Technology Laboratory i

ABSTRACT

Authentication of an individual’s identity is a fundamental component of physical and logical access control. An access control decision must be made when an individual attempts to access security-sensitive buildings, information systems, and applications. An accurate determination of an individual’s identity supports making sound access control decisions.

This document establishes a standard for a Personal Identity Verification (PIV) system that meets the control and security objectives of Homeland Security Presidential Directive-12 [HSPD-12]. It is based on secure and reliable forms of identity credentials issued by the Federal Government to its employees and contractors. These credentials are used by mechanisms that authenticate individuals who require access to federally controlled facilities, information systems, and applications. This Standard addresses requirements for initial identity proofing, infrastructure to support interoperability of identity credentials, and accreditation of organizations and processes issuing PIV credentials.

ii

Keywords: authentication, authenticator, biometrics, credential, cryptography, derived PIV credentials, digital identity, Federal Information Processing Standards (FIPS), HSPD-12, federation, identification, identity proofing, integrated circuit card, Personal Identity Verification, PIV, PIV account, public key infrastructure, verification

Federal Information Processing Standards Publication 201-3

November 2020

Announcing the Standard for

Personal Identity Verification (PIV) of Federal Employees and Contractors

Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National Institute of Standards and Technology (NIST) after approval by the Secretary of Commerce pursuant to Section 5131 of the Information Technology Management Reform Act of 1996 (Public Law 104-106) and the Computer Security Act of 1987 (Public Law 100-235).

1. Name of Standard. Personal Identity Verification (PIV) of Federal Employees and Contractors (FIPS 201-3).

2. Category of Standard. Information Security. Subcategory. Identity.

3. Explanation. Homeland Security Presidential Directive-12 [HSPD-12], dated August 27, 2004, entitled “Policy for a Common Identification Standard for Federal Employees and Contractors,” directs the promulgation of a federal standard for secure and reliable forms of identification for federal employees and contractors. It further specifies secure and reliable identification that

a) is issued based on sound criteria for verifying an individual employee’s identity;

b) is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation;

c) can be rapidly authenticated electronically; and

d) is issued only by providers whose reliability has been established by an oÿcial accreditation process.

The directive stipulates that the Standard include graduated criteria from least secure to most secure in order to ensure flexibility in selecting the appropriate level of security for each application. Executive departments and agencies are required to implement the Standard for identification issued to federal employees and contractors in gaining physical access to controlled facilities and logical access to controlled information systems.

4. Approving Authority. Secretary of Commerce.

5. Maintenance Agency. Department of Commerce, NIST, Information Technology Laboratory (ITL).

iii

6. Applicability. This Standard is applicable to identification issued by federal departments and agencies to federal employees and contractors for gaining physical access to federally controlled facilities and logical access to federally controlled information systems, except for “national security systems” as defined by 44 U.S.C. 3542(b)(2) and [SP 800-59]. Except as provided in [HSPD-12], nothing in this Standard alters the ability of government entities to use the Standard for additional applications.

6.1 Special-Risk Security Provision. The U.S. Government has personnel, facilities, and other assets deployed and operating worldwide under a vast range of threats (e.g., terrorist, technical, intelligence), the severity of which is particularly heightened overseas.

For cardholders with particularly sensitive threats while outside of the contiguous United States, the issuance, holding, and/or use of PIV credentials with full technical capabilities as described herein may result in unacceptably high risk. In such cases of risk (e.g., to facilities, individuals, operations, national interest, or national security) by the presence and/or use of full-capability PIV credentials, the head of a department or independent agency may issue a select number of maximum-security PIV credentials that do not contain (or otherwise do not fully support) the wireless and/or biometric capabilities otherwise required/referenced herein. To the greatest extent practicable, heads of departments and independent agencies should minimize the issuance of such special-risk security PIV credentials so as to support interagency interoperability and the President’s policy. Use of other risk-mitigating technical (e.g., high-assurance on/o˙ switches for the wireless capability) and procedural mechanisms in such situations is preferable and, as such, is also explicitly permitted and encouraged. As protective security technology advances, the need for this provision will be reassessed when the Standard undergoes the normal review and update process.

7. Implementations. This Standard satisfies the control objectives, security requirements, and technical interoperability requirements of [HSPD-12]. The Standard specifies implementation and processes for binding identities to authenticators, such as integrated circuit cards and derived credentials used in the federal PIV system.

In implementing PIV systems and pursuant to Section 508 of the Rehabilitation Act of 1973 (the Act), as amended, agencies have the responsibility to accommodate federal employees and contractors with disabilities to have access to and use of information and data comparable to the access to and use of such information and data by federal employees and contractors who are not individuals with disabilities. In instances where federal agencies assert exceptions to Section 508 accessibility requirements (e.g., undue burden, national security, commercial non-availability), Sections 501 and 504 of the Act require federal agencies to provide reasonable accommodation for federal employees and contractors with disabilities whose needs are not met by the baseline accessibility provided under Section 508. While Section 508 compliance is the responsibility of federal agencies and departments, this Standard specifies several options to aid in the implementation of the requirements:

iv

• Section 4.1.4.3 specifies Zones 21F and 22F as options for orientation markers of the PIV Card.

• Section 2.8 and Section 2.9 specify alternatives for the biometric capture device interactions required at PIV Card issuance, reissuance, and reset.

• Section 2.10 defines alternatives to smart card-based PIV credentials in the form of derived PIV credentials.

• Section 6 defines authentication mechanisms with varying characteristics for both physical and logical access (e.g., with or without PIN, over contact, contactless, or virtual contact interface).

• Section 7 defines federation as a means for a relying system to interoperate with credentials issued by other agencies.

The Oÿce of Management and Budget (OMB) provides implementation oversight for this Standard.

PIV cards can only be issued by accredited issuers. The responsibility and authority for PIV card issuance and management rests in the departments and agencies employing federal employees and contractors regardless of whether these functions are performed in-house or outsourced to an external public or private organization. To ensure consistency in the operations of issuers, NIST provides guidelines for the accreditation of PIV Card issuers and derived PIV credential issuers in [SP 800-79]. The Standard also covers security and interoperability requirements for PIV Cards. For this purpose, NIST has established the PIV Validation Program, which tests implementations for conformance with this Standard as specified in [SP 800-73] and [SP 800-78] (see Appendix A.3).

FIPS 201 compliance of PIV components and subsystems is provided in accordance with OMB [M-19-17] through products and services from the U.S. General Services Administration’s (GSA) Interoperability Test Program and Approved Products and Services List (see Appendix A.5). Implementation guidance for PIV-enabled federal facilities and information systems in accordance with OMB [M-19-17] will be outlined by [FICAM] as playbooks and best practice repositories. See also [SP 800-116] and

[ISC-RISK].

8. Patents. Aspects of the implementation of this Standard may be covered by U.S. or foreign patents.

9. E˙ective Date. This Standard will be e˙ective immediately upon final publication of this revision, superseding FIPS 201-2. Features of this Standard that depend upon the release of new or revised NIST Special Publications, including features that are optional, deprecated, or removed, are e˙ective upon final publication of the supporting Special Publications.

10. Specifications. Federal Information Processing Standards (FIPS) 201 Personal Identity Verification (PIV) of Federal Employees and Contractors.

v

11. Qualifications. The security provided by the PIV system is dependent on many factors outside the scope of this Standard. Organizations must be aware that the overall security of the personal identification system relies on

• assurance provided by the issuer of an identity credential that the individual in possession of the credential has been correctly identified;

• protection provided to an identity credential stored within the PIV Card and transmitted between the card and the PIV issuance and relying subsystems;

• infrastructure protection provided for derived PIV credential in the binding, maintenance and use of the identity credential; and

• protection provided to the identity verification system infrastructure and components throughout the entire lifecycle.

Although it is the intent of this Standard to specify mechanisms and support systems that provide high assurance personal identity verification, conformance to this Standard does not assure that a particular implementation is secure. It is the implementer’s responsibility to ensure that components, interfaces, communications, storage media, managerial processes, and services used within the identity verification system are designed and built in a secure manner.

Similarly, the use of a product that conforms to this Standard does not guarantee the security of the overall system in which the product is used. The responsible authority in each department and agency must ensure that an overall system provides the acceptable level of security.

Because a standard of this nature must be flexible enough to adapt to advancements and innovations in science and technology, NIST has a policy to review this Standard within five years to assess its adequacy.

12. Waiver Procedure. FISMA does not allow for waivers to a FIPS that is made mandatory by the Secretary of Commerce.

13. Where to Obtain Copies of the Standard. This publication is available through the internet by accessing https://csrc.nist.gov/publications/. Other computer security publications are available at the same website.

vi https://csrc.nist.gov/publications/

Federal Information Processing Standards Publication 201-3

November 2020

Standard for

Personal Identity Verification (PIV) of Federal Employees and Contractors

Table of Contents

1. Introduction

1.1 Purpose

1.2 Scope

1.3 Change Management

1.3.1 Backward Compatible Change

1.3.2 Backward Incompatible Change

1.3.3 New Features

1.3.4 Deprecated and Removed Features

1.3.5 FIPS 201 Version Management

1.3.6 Section Number Stability

1.4 Document Organization

2. Common Identification, Security, and Privacy Requirements

2.1 Control Objectives

2.2 Credentialing Requirements

2.3 Biometric Data Collection for Background Investigations

2.4 Biometric Data Collection for PIV Card

2.5 Biometric Data Use

2.6 PIV Enrollment Records

2.7 PIV Identity Proofing and Registration Requirements

2.7.1 Supervised Remote Identity Proofing

2.8 PIV Card Issuance Requirements

2.8.1 Special Rule for Pseudonyms

2.8.2 Grace Period

2.9 PIV Card Maintenance Requirements

2.9.1 PIV Card Reissuance Requirements

2.9.2 PIV Card Post-Issuance Update Requirements

2.9.3 PIV Card Activation Reset

2.9.4 PIV Card Termination Requirements

2.10 Derived PIV Credentials

2.10.1 Derived PIV Credential Issuance Requirements

2.10.2 Derived PIV Credential Invalidation Requirements

vii

2.11 PIV Privacy Requirements

3. PIV System Overview

3.1 Functional Components

3.1.1 PIV Front-End Subsystem

3.1.2 PIV Issuance and Management Subsystem

3.1.3 PIV Relying Subsystem

3.2 PIV Card Lifecycle Activities

3.3 Connections Between System Components

4. PIV Front-End Subsystem

4.1 PIV Card Physical Characteristics

4.1.1 Printed Material

4.1.2 Tamper-proofing and Resistance

4.1.3 Physical Characteristics and Durability

4.1.4 Visual Card Topography

4.1.5 Color Representation

4.2 PIV Card Logical Characteristics

4.2.1 Cardholder Unique Identifier

4.2.2 Cryptographic Specifications

4.2.3 Biometric Data Specifications

4.2.4 PIV Unique Identifiers

4.3 PIV Card Activation

4.3.1 Activation by Cardholder

4.3.2 Activation by Card Management System

4.4 Card Reader Requirements

4.4.1 Contact Reader Requirements

4.4.2 Contactless Reader Requirements

4.4.3 Reader Interoperability

4.4.4 Card Activation Device Requirements

5. PIV Key Management Requirements

5.1 Architecture

5.2 PKI Certificate

5.2.1 X.509 Certificate Contents

5.3 X.509 Certificate Revocation List Contents

5.4 Legacy PKIs

5.5 PKI Repository and Online Certificate Status Protocol Responders

5.5.1 Certificate and CRL Distribution

5.5.2 OCSP Status Responders

6. PIV Cardholder Authentication

6.1 PIV Assurance Levels

6.1.1 Relationship to Federal Identity Policy

6.2 PIV Card Authentication Mechanisms

viii

6.2.1 O˙-Card Biometric One-to-One Comparison

6.2.2 On-Card Biometric One-to-One Comparison

6.2.3 PIV Asymmetric Cryptography

6.2.4 Symmetric Card Authentication Key

6.2.5 CHUID

6.2.6 PIV Visual Credentials

6.3 PIV Support of Graduated Authenticator Assurance Levels

6.3.1 Physical Access

6.3.2 Logical Access

7. Federation Considerations for PIV

7.1 Connecting PIV to Federation

7.2 Federation Assurance Level

7.3 Benefits of Federation

Appendix A. PIV Validation, Certification, and Accreditation A.1 Accreditation of PIV Card Issuers and Derived PIV Credential Issuers A.2 Application of Risk Management Framework to IT Systems A.3 Conformance Testing of PIV Card Application and Middleware A.4 Cryptographic Testing and Validation A.5 FIPS 201 Evaluation Program

Appendix B. PIV Object Identifiers and Certificate Extension B.1 PIV Object Identifiers B.2 PIV Background Investigation Indicator Certificate Extension

Appendix C. Glossary of Terms, Acronyms, and Notations C.1 Glossary of Terms C.2 Acronyms and Abbreviations C.3 Notations

Appendix D. References Appendix E. Revision History

List of Tables Table 4-1 Name Examples Table 4-2 Color Representation Table 6-1 Applicable PIV Authentication Mechanisms for Physical Access Table 6-2 Applicable PIV Authentication Mechanisms for Logical Access Table B-1 PIV Object Identifiers for PIV eContent Types Table B-2 PIV Object Identifiers for PIV Attributes Table B-3 PIV Object Identifiers for PIV Extended Key Usage ix

List of Figures Fig. 3-1 PIV System Overview Fig. 3-2 PIV Card Lifecycle Activities Fig. 3-3 PIV System Connections Fig. 3-4 PIV System Federation Connections Fig. 4-1 Card Front: Printable Areas and Required Data Fig. 4-2 Card Front: Optional Data Placement (Example 1) Fig. 4-3 Card Front: Optional Data Placement (Example 2) Fig. 4-4 Card Front: Optional Data Placement (Example 3) Fig. 4-5 Card Front: Optional Data Placement (Example 4) Fig. 4-6 Card Back: Printable Areas and Required Data Fig. 4-7 Card Back: Optional Data Placement (Example 1) Fig. 4-8 Card Back: Optional Data Placement (Example 2) x

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV)

1. Introduction

This section is informative except where otherwise marked as normative. It provides background information for understanding the scope of this Standard.

Authentication of an individual’s identity is a fundamental component of both physical and logical access control. An access control decision must be made when an individual attempts to access security-sensitive buildings, information systems, and applications. An accurate determination of an individual’s identity supports making sound access control decisions.

In the past, a wide range of legacy mechanisms has been employed to authenticate an individual, utilizing various classes of identity credentials. For physical access, an individual’s identity has been authenticated using paper or other non-automated, hand-carried credentials such as badges and driver’s licenses. For logical access, authorization to access computers and data has been based on identities authenticated through user-selected passwords. Today, cryptographic mechanisms and biometric techniques are replacing these legacy mechanisms in physical and logical security applications. The strength of authentication that is achieved depends on the type of credential, the process used to issue the credential, and the authentication mechanism used to validate the credential.

This document establishes a standard for a Personal Identity Verification (PIV) system that meets the control and security objectives of [HSPD-12]. The Standard specifies implementation and processes for binding identities to authenticators, such as integrated circuit cards and derived credentials used in the federal PIV system. It is based on secure and reliable forms of identity credentials issued by the Federal Government to its employees and contractors. These credentials are intended to authenticate individuals who require access to federally controlled facilities, information systems, and applications.

This Standard addresses requirements for initial identity proofing, infrastructure to support interoperability of identity credentials, and accreditation of organizations and processes issuing PIV credentials.

1.1 Purpose

This Standard defines reliable, government-wide identity credentials for use in applications such as access to federally controlled facilities and information systems.

This Standard has been developed within the context and constraints of federal laws, regulations, and policies based on currently available and evolving information processing technology.

This Standard specifies a PIV system within which common identity credentials can be created and later used to verify a claimed identity. The Standard also identifies federal

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV) government-wide requirements for security levels that are dependent on risks to federal facilities or information being protected.

1.2 Scope

[HSPD-12], signed by President George W. Bush on August 27, 2004, established the requirements for a common identification standard for identity credentials issued by federal departments and agencies to federal employees and contractors (including contractor employees) for gaining physical access to federally controlled facilities and logical access to federally controlled information systems. HSPD-12 directs the Department of Commerce to develop a Federal Information Processing Standards (FIPS) publication to define such common identity credentials. In accordance with HSPD-12, this Standard defines the following technical requirements for these identity credentials:

• They are issued based on sound criteria for verifying an individual employee’s identity.

• They are strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation.

• They can be rapidly authenticated electronically.

• They are issued only by providers whose reliability has been established by an oÿcial accreditation process.

Upon enrollment, a collection of records known as a PIV account is created and managed within the issuer’s enterprise identity management system (IDMS). The PIV account includes the attributes of the PIV cardholder, the enrollment data, and information regarding the PIV Card and any derived PIV credentials bound to the account.

This Standard defines authentication mechanisms that o˙er varying degrees of security for both logical and physical access applications. Federal departments and agencies will determine the level of security and authentication mechanisms appropriate for their applications. The scope of this Standard is limited to the authentication of an individual’s identity. Authorization and access control decisions are outside of the scope of this Standard. Moreover, requirements for a temporary credential used until a new or replacement PIV credential arrives are out of the scope of this Standard.

While this Standard remains predominantly focused on PIV Cards, derived PIV credentials and federation protocols also play important roles in the use of PIV accounts.

Section 2.10 of this Standard defines mechanisms for derived PIV credentials associated with an active PIV account. Derived PIV credentials have authentication and lifecycle requirements that may di˙er from the PIV Card itself. This Standard also discusses federation protocols in Section 7 as a means of accepting PIV credentials issued by other agencies. See Section 3 for more information on components of the PIV system.

1.3 Change Management

Every revision of this Standard introduces refinements and changes that may impact existing implementations. FIPS 201 and associated normative specifications encourage implementation approaches that reduce the high cost of configuration and change management by architecting resilience to change into system processes and components.

Nevertheless, changes and modifications are required over time.

This section provides change management principles and guidance to implementers of relying systems to manage newly introduced changes and modifications to the previous version of this Standard.

1.3.1 Backward Compatible Change

A backward compatible change is a change or modification to an existing feature that does not break relying systems using the feature. For example, changing the card authentication certificate from optional to mandatory does not a˙ect the systems using the card authentication certificate for authentication (i.e., using the PKI-CAK authentication mechanism).

1.3.2 Backward Incompatible Change

A backward incompatible change is a change or modification to an existing feature such that the modified feature cannot be used with existing relying systems. For example, changing the format of the biometric data records would not be compatible with the existing system because a biometric authentication attempt with the modified format would fail. Similarly, all systems interacting with the PIV Card would need to change if the PIV Card Application Identifier (AID) changed (defined in [SP 800-73]), indicating a backward incompatible change.

1.3.3 New Features

New features are features that are added to the Standard. These features can be optional or mandatory. New features do not interfere with backward compatibility because they are not part of the existing relying systems. For example, the optional biometric on-card comparison (OCC) authentication mechanism (OCC-AUTH) was a new feature introduced in FIPS 201-2. The optional mechanism did not a˙ect the features of existing systems. Systems had to be updated only if an agency decided to support the OCC-AUTH mechanism.

1.3.4 Deprecated and Removed Features

This subsection is normative.

When a feature is to be discontinued or is no longer needed, it is deprecated. In general, a feature that is currently in use by relying systems would only be deprecated if there were a compelling reason to do so (e.g., security). Deprecated features MAY continue to be used but SHOULD be phased out in future systems since the feature will likely be removed in the next revision of the Standard. Removed features SHALL NOT be used. For example, the CHUID authentication mechanism (Section 6.2.5) has been removed from this version of the Standard and relying systems SHALL NOT use this authentication mechanism.1 The PIV Visual Credentials (VIS) authentication mechanism (Section 6.2.6) has been deprecated as a stand-alone authentication mechanism, but it MAY still be used in conjunction with other authentication mechanisms.

In the case of deprecated features on PIV Cards such as the magnetic stripe (Section 4.1.4.4), existing PIV Cards with the deprecated features remain valid. However, new PIV Cards SHOULD NOT include the deprecated features.

1.3.5 FIPS 201 Version Management

Subsequent revisions of this Standard may necessitate FIPS 201 version management that introduces new version numbers for FIPS 201 products. Components that may be a˙ected by version management include but are not limited to PIV Cards, PIV middleware software, and card issuance systems.

New version numbers will be assigned in [SP 800-73], if needed, based on the nature of the change. For example, new mandatory features introduced in a revision of this Standard may necessitate a new PIV Card Application version number so that systems can quickly discover the new mandatory features. Optional features may be discoverable by an on-card discovery mechanism.

1.3.6 Section Number Stability

Section numbers have not been changed in this revision. Any deleted sections have had their contents removed and replaced with a removal notice while retaining the section header and number. New subsections have been added at the end of their respective sections with a new subsection number.

1The CHUID data element has not been removed and continues to be mandatory.

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV)

1.4 Document Organization

This Standard describes the minimum requirements for a federal personal identity verification system that meets the control and security objectives of [HSPD-12], including identity proofing, registration, and issuance. It provides detailed technical specifications to support the control and security objectives of [HSPD-12] as well as interoperability among federal departments and agencies. This Standard describes the policies and minimum requirements of a PIV Card and derived PIV credentials that allow interoperability of credentials for physical and logical access. It specifies the use of federation protocols as a means of accepting PIV Card credentials and derived PIV credentials issued by other agencies. The physical card characteristics, storage media, and data elements that make up identity credentials are specified in this Standard. The interfaces and card architecture for storing and retrieving identity credentials from a smart card are specified in [SP 800-73]. Similarly, the requirements for collection, formatting, and use of biometric data records are specified in [SP 800-76]. The requirements for cryptographic algorithms are specified in [SP 800-78]. The requirements for the accreditation of PIV Card issuers are specified in [SP 800-79]. The unique organizational codes for federal agencies are assigned in [SP 800-87]. The requirements for PIV Card readers are provided in [SP 800-96]. The format for encoding PIV enrollment records for import and export is specified in [SP 800-156]. The requirements for issuing derived PIV credentials are specified in [SP 800-157].

This Standard contains normative references to other documents. Should normative text in this Standard conflict with normative text in a referenced document, the normative text in this Standard prevails for this Standard.

All sections in this document indicate whether they are normative (i.e., provide requirements for compliance) or informative (i.e., provide information details that do not a˙ect compliance). This document is structured as follows:

• Section 1, Introduction, provides background information for understanding the scope of this Standard. This section is informative unless otherwise marked as normative.

• Section 2, Common Identification, Security, and Privacy Requirements, outlines the requirements for identity proofing, registration, and issuance, by establishing the control and security objectives for compliance with [HSPD-12]. This section is normative.

• Section 3, PIV System Overview, provides an overview of the di˙erent components of the PIV system. This section is informative.

• Section 4, PIV Front-End Subsystem, provides the requirements for the components of the PIV front-end subsystem. It defines requirements for the PIV Card, logical data elements, biometric is normative.

data records, cryptography, and card readers. This section

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV)

• Section 5, PIV Key Management Requirements, defines the processes and components required for managing a PIV Card’s lifecycle. It also provides the requirements and specifications related to key management. This section is normative.

• Section 6, PIV Cardholder Authentication, defines a suite of authentication mechanisms that are supported by the PIV Card and their applicability in meeting the requirements of graduated levels of identity assurance. This section is normative.

• Section 7, Federation, defines a set of mechanisms for using federation technologies to interoperate with PIV credentials issued by other agencies. This section is normative.

• Appendix A, PIV Validation, Certification, and Accreditation, provides additional information regarding compliance with this document. This appendix is normative.

• Appendix B, PIV Object Identifiers and Certificate Extension, provides additional details for the PIV objects identified in Section 4. This appendix is normative.

• Appendix C, Glossary of Terms, Acronyms, and Notations, describes the vocabulary and textual representations used in the document. This appendix is informative.

• Appendix D, References, lists the specifications and standards referred to in this document. This appendix is informative.

• Appendix E, Revision History, lists changes made to this Standard from its inception. This appendix is informative.

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV)

2. Common Identification, Security, and Privacy Requirements

This section is normative. It addresses the fundamental control and security objectives outlined in [HSPD-12], including the identity proofing requirements for federal employees and contractors.

2.1 Control Objectives

[HSPD-12] establishes control objectives for secure and reliable identification of federal employees and contractors. These control objectives, provided in paragraph 3 of the directive, are quoted here:

(3) “Secure and reliable forms of identification” for purposes of this directive means identification that (a) is issued based on sound criteria for verifying an individual employee’s identity; (b) is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation; (c) can be rapidly authenticated electronically; and (d) is issued only by providers whose reliability has been established by an oÿcial accreditation process.

Each agency’s PIV implementation SHALL meet the four control objectives (a) through

(d) listed above such that

• A credential is issued only to an individual whose identity has been verified and who has been appropriately vetted as per Section 2.2 after a proper authority has authorized issuance of the credential.

• A credential is issued only after an individual’s eligibility has been favorably adjudicated based on the prerequisite federal investigation (See Section 2.2). If there is no investigation meeting the investigative standards, the PIV credential eligibility may be approved upon favorable initiation of the prerequisite investigation2 and once the Federal Bureau of Investigation (FBI) National Criminal History Check (NCHC) portion of the background investigation is completed and favorably adjudicated.

• An individual is issued a credential only after presenting two identity source documents, at least one of which is a Federal or State Government-issued picture

ID.

• Fraudulent identity source documents are not accepted as genuine or unaltered.

2The initiation of a background investigation is defined as the submission of an investigative request to the Defense Counterintelligence and Security Agency or other authorized federal investigative service provider.

• A person suspected or known to the government as being a terrorist is not issued a credential.

• No substitution occurs in the identity proofing process. More specifically, the individual who appears for identity proofing and whose fingerprints are checked against databases is the person to whom the credential is issued.

• No credential is issued unless requested by the proper authority.

• A credential remains serviceable only up to its expiration date. More precisely, a revocation process exists such that expired or invalidated credentials are swiftly revoked.

• A single corrupt oÿcial in the process may not issue a credential with an incorrect identity or to a person not entitled to the credential.

• An issued credential is not duplicated or forged.

• An issued credential is not modified by an unauthorized entity.

2.2 Credentialing Requirements

Federal departments and agencies SHALL use the credentialing eligibility standards issued by the Director of the Oÿce of Personnel Management (OPM)3 and OMB.4

Federal departments and agencies must follow investigative requirements established by the Suitability and Credentialing Executive Agent and the Security Executive Agent. Departments and agencies SHALL use position designation guidance issued by the Executive Agents. The designation of the position determines the prerequisite investigative requirement. Individuals being processed for a PIV Card SHALL receive the required investigation and are subject to any applicable reinvestigation or continuous vetting requirements to maintain their PIV eligibility.

The minimum requirement for PIV Credential eligibility determination is a completed and favorably adjudicated Tier 1 investigation, formerly called a National Agency Check with Written Inquiries (NACI).5

Before an individual is determined eligible to be issued a PIV Card when no corresponding prior investigation exists, the appropriate required investigation SHALL be initiated with the authorized federal investigative service provider and the FBI NCHC portion of the background investigation SHALL be completed and favorably adjudicated.

Once the investigation is completed, the authorized adjudicative entity SHALL adjudicate the investigation and report the final eligibility determination to the Central Verification

3For example, [FCS] and the Federal Investigative Standards or subsequent standards.

4For example, OMB [M-05-24].

5NACI investigations were replaced with Tier 1 investigations upon implementation of the 2012 Federal Investigative Standards.

System (or successor). This determination SHALL be recorded in the PIV enrollment record to reflect PIV eligibility for the PIV cardholder and, if applicable, their enrollment in the Continuous Vetting Program.

For full guidance on PIV credentialing investigative and adjudicative requirements, issuers must work closely with their personnel security/suitability oÿces to ensure adherence to the latest federal personnel vetting guidance as provided by the Executive Agents.

2.3 Biometric Data Collection for Background Investigations

A full set of fingerprints SHALL be collected from each PIV applicant.

Biometric identification using fingerprints is the primary input to law enforcement checks.

In cases where ten fingerprints are not available, then as many fingers as possible SHALL be imaged as per guidance in [SP 800-76]. In cases where no fingers are available to be imaged, agencies SHALL seek guidance from their respective investigative service provider for alternative means of performing law enforcement checks.

This collection is not necessary for applicants who have a completed and favorably adjudicated Tier 1 or higher federal background investigation on record that can be located and referenced.

Fingerprint collection SHALL conform to the procedural and technical specifications of

[SP 800-76].

2.4 Biometric Data Collection for PIV Card

The following biometric data SHALL be collected from each PIV applicant:

• Two fingerprints for o˙-card one-to-one comparison. These fingerprints MAY be taken from the full set of fingerprints collected in Section 2.3.

• An electronic facial image.

The following biometric data MAY be collected from a PIV applicant:

• An electronic image of the left iris.

• An electronic image of the right iris.

• Two fingerprints for on-card comparison (OCC). These fingerprints MAY be taken from the full set of fingerprints collected in Section 2.3 and SHOULD be imaged from fingers not imaged for o˙-card one-to-one comparison.

If the identity proofing and enrollment process is performed over multiple visits, a biometric verification attempt comparing the applicant’s newly captured biometric characteristics against biometric data collected during a previous visit SHALL be performed at each visit and return a positive verification decision.

If collection of biometric data as specified in this section and in Section 2.3 occur on separate occasions, a biometric comparison SHALL be performed to confirm that the two fingerprints collected for o˙-card one-to-one comparisons elicit a positive biometric verification decision when compared to the same two fingerprints from the original set of ten fingerprints.

Biometric data collection SHALL conform to the procedural and technical specifications of [SP 800-76]. The choice of fingers to use for mandatory fingerprint templates and optional fingerprint templates MAY vary between persons. The recommended selection and order is specified in [SP 800-76].

2.5 Biometric Data Use

The full set of fingerprints SHALL be used for biometric identification against databases of fingerprints maintained by the FBI.

The two mandatory fingerprints SHALL be used for the preparation of biometric templates to be stored on the PIV Card as described in Section 4.2.3.1. The fingerprints provide an interoperable authentication mechanism through an o˙-card comparison scheme (BIO or BIO-A) as described in Section 6.2.1. These fingerprints are also the primary means of authentication during PIV issuance and maintenance processes.

The optional fingerprints MAY be used for the preparation of biometric templates for OCC as described in Section 4.2.3.1. OCC MAY be used to support card activation as described in Section 4.3.1. OCC MAY also be used for cardholder authentication (OCC- AUTH) as described in Section 6.2.2.

Agencies MAY choose to collect electronic iris images as an additional biometric characteristic. If collected, the electronic iris images SHALL be stored on the PIV Card as described in Section 4.2.3.1. The images MAY be used for cardholder authentication (BIO or BIO-A) as described in Section 6.2.1. Electronic iris images are an additional means of authentication during PIV issuance and maintenance processes when fingerprint biometric data records are unavailable.

The electronic facial image SHALL be stored on the PIV Card as described in Section 4.2.3.1. It SHALL be printed on the PIV Card according to Section 4.1.4.1.

The image MAY be used for cardholder authentication (BIO or BIO-A) as described in Section 6.2.1. It MAY be retrieved and displayed on guard workstations to augment other authentication processes from Section 6.2. The electronic facial image is a secondary means of authentication during operator-attended PIV issuance and maintenance processes when fingerprint biometric data records are unavailable.

PIV background investigation, identity proofing, registration, and issuance processes MAY be performed across multiple sessions at di˙erent facilities. If multiple sessions are needed, the applicant SHALL be linked through a positive biometric verification decision by comparing biometric characteristics captured at a previous session with biometric characteristics captured during the current session. Issuers SHALL follow applicable federal laws and regulations regarding the retention and destruction of biometric data.

2.6 PIV Enrollment Records

Note: This section was formerly entitled “Chain-of-Trust”.

A card issuer SHALL maintain the enrollment record for each issued PIV Card. These enrollment records are created and maintained through the methods of contemporaneous acquisition at each step of the PIV issuance process—typically including identity proofing, registration and biometric enrollment—and are generally stored as part of the cardholder’s PIV account.

PIV enrollment records maintain an auditable sequence of enrollment events to facilitate binding an applicant to multiple transactions that might take place at di˙erent times and locations.6

PIV enrollment records SHOULD include the following data:

• A log of activities that documents who took the action, what action was taken, when and where the action took place, and what data was collected.

• An enrollment data record that contains the most recent collection of each of the biometric data collected. The enrollment data record describes the circumstances of biometric acquisition including the name and role of the acquiring agent, the oÿce and organization, time, place, and acquisition method. The enrollment data record MAY also document unavailable biometric data or failed attempts to collect biometric data. The enrollment data record MAY contain historical biometric data records.

• The most recent unique identifiers issued to the individual, such as the Federal Agency Smart Credential Number (FASC-N) and the card Universally Unique Identifier (UUID). The record MAY contain historical unique identifiers.

6For example, ten fingerprints for law enforcement checks may be collected at one time and place, and two fingerprints for PIV Card templates may be collected at a later time and di˙erent place, provided that a biometric comparison confirms that the two fingerprints belong to the original set of ten fingerprints.

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV)

• Information about the authorizing entity who has approved the issuance of a credential.

• Current status of the background investigation, including the results of the investigation once completed.

• The evidence of authorization if the credential is issued under a pseudonym.

• Any data or any subsequent changes in the data about the cardholder. If the changed data is the cardholder’s name, then the issuer SHOULD include the evidence of a formal name change.

The biometric data records in the PIV enrollment records SHALL be valid for a maximum of 12 years. In order to mitigate aging e˙ects and thereby maintain operational readiness of a cardholder’s PIV Card, agencies MAY require biometric enrollment more frequently than 12 years.

PIV enrollment records contain Personally Identifiable Information (PII). PII SHALL be protected in a manner that protects the individual’s privacy and maintains the integrity of the records both in transit and at rest.

To facilitate interoperability between PIV issuers, systems may import and export enrollment records in the manner and representation described in [SP 800-156].

PIV enrollment records can be applied in several situations, including the following:

Extended enrollment A PIV applicant enrolls a full set of fingerprints for background investigations at one place and time and two fingerprints for the PIV Card at another place and time. The enrollment record would contain identifiers and two enrollment data records: one with the full set of fingerprint images collected for background investigations and one with two fingerprint templates collected for the PIV Card. The two fingerprint templates would be compared to the corresponding fingers in the ten-fingerprint data set in the PIV enrollment record.

Reissuance A PIV cardholder loses their card. Since the card issuer has biometric data records from enrollment, the cardholder can perform a biometric comparison against the biometric data stored in the PIV enrollment record. The card issuer NEED NOT repeat the identity proofing and registration process on a positive biometric verification decision. Instead, the card issuer revokes the lost card and proceeds to issue a new card as described in Section 2.9.1.

Interagency transfer A federal employee is transferred from one agency to another. When the employee leaves the old agency, they surrender their PIV Card and it is destroyed. When the employee arrives at the new agency and is processed in, the card issuer in the new

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV) agency requests and receives the employee’s PIV enrollment record from the card issuer in the old agency. The employee performs a biometric comparison against the biometric data stored in this record, and the interaction proceeds as described in Section 2.8.2.

2.7 PIV Identity Proofing and Registration Requirements

Identity proofing and registration requirements for the issuance of PIV Cards meet Identity Assurance Level (IAL) 3 since they follow a tailored process based on [SP 800-63A] IAL3 requirements. Departments and agencies SHALL follow an identity proofing and registration process that meets the requirements defined below when issuing PIV Cards.

The organization SHALL adopt and use an identity proofing and registration process that is approved in accordance with [SP 800-79].

The organization SHALL follow investigative requirements as outlined in Section 2.2.

Biometric data SHALL be captured as specified in Section 2.3 and Section 2.4.

The applicant SHALL appear in person at least once before the issuance of a PIV Card, either at the issuing facility or at a supervised remote identity proofing station (as described in Section 2.7.1).

During identity proofing, the applicant SHALL be required to provide two original forms of identity source documents.7 These documents SHALL be validated to ensure they are genuine and authentic, not counterfeit, fake, or forgeries. Validation of physical security features SHALL be performed by trained sta˙. When they are available, cryptographic security features SHOULD be used to validate evidence. The identity source documents SHALL be bound to the applicant and SHALL NOT be expired or cancelled. If the two identity source documents bear di˙erent names, evidence of a formal name change SHALL be provided. At least one identity source document SHALL meet the requirements of Strong evidence as specified in [SP 800-63A] and be one of the following forms of identification:

• U.S. Passport or a U.S. Passport Card

• Permanent Resident Card or Alien Registration Receipt Card (Form I-551)

• foreign passport

• Employment Authorization Document that contains a photograph (Form I-766)

7Departments and agencies may choose to accept only a subset of the identity source documents listed in this section. For example, in cases where identity proofing for PIV Card issuance is performed prior to verification of employment authorization, departments and agencies may choose to require the applicant to provide identity source documents that satisfy the requirements of Form I-9, Employment Eligibility Verification, in addition to the requirements specified in this section.

FIPS 201-3 (DRAFT) Personal Identity Verification (PIV)

• driver’s license or ID card that is compliant with [REAL-ID] enforcement requirements pursuant to DHS regulations

• U.S. Military ID card

• U.S. Military dependent’s ID card

• PIV Card

The second piece of evidence MAY be from the list above, but it SHALL NOT be of the same type as the primary identity source document.8 The second identity source document MAY also be one of the following:

• ID card issued by a federal, state, or local government agency or entity, provided that it contains a photograph

• voter’s registration card

• U.S. Coast Guard Merchant Mariner Card

• Certificate of U.S. Citizenship (Form N-560 or N-561)

• Certificate of Naturalization (Form N-550 or N-570)

• U.S. Citizen ID Card (Form I-197)

• Identification Card for Use of Resident Citizen in the United States (Form I-179)

• Certification of Birth Abroad or Certification of Report of Birth issued by the Department of State (Form FS-545 or Form DS-1350)

• Reentry Permit (Form I-327)

• Employment authorization document issued by the Department of Homeland Security (DHS)

• driver’s license issued by…