ITL Bulletin for October 2013

ITL Updates Federal Information Processing Standard (FIPS) for

Personal Identity Verification (PIV) of Federal Employees and Contractors

On September 5, 2013, ITL released Revision 2 of FIPS 201 (FIPS 201-2), Personal Identity Verification of Federal Employees and Contractors. The revision includes adaptations to changes in the environment and new technology since the first revision of the standard. FIPS 201-2 also provides clarifications to existing text, additional text to remove ambiguities, and specific changes requested by federal agencies and implementers. The updated standard will not require anyone to replace their current PIV card, but will make the new cards, based on the revised specification, more flexible and effective.

Among the numerous improvements in the revised standard are the abilities to:

create additional credential(s) for use on mobile devices such as smart phones;

offer additional capabilities, such as secure messaging, iris biometric recognition and on-card fingerprint comparison, to provide more flexibility in selecting the appropriate level of security for federal applications that use the PIV card for authentication;

add detail for remote update for the PIV card’s credentials;

introduce chain-of-trust and grace period for PIV card reissuance processes; and

add new options for physical card characteristics to help agencies achieve Section 508 compliance for PIV card orientation.

FIPS 201 was mandated by Homeland Security Presidential Directive-12 (HSPD-12), dated August 2004, which established the requirements for a common identification standard for identity credentials issued by federal departments and agencies to federal employees and contractors (including contractor employees) for gaining physical access to federally controlled facilities and logical access to federally controlled information systems. HSPD-12 directed the Department of Commerce to develop a FIPS to define such a common identity credential. NIST issued FIPS 201 in April 2005 and FIPS 201-1 in March 2006. NIST initiated a review of FIPS 201-1 in 2011 in keeping with its policy of reviewing the FIPS every five years.

FIPS 201-2 was effective on September 5, 2013, and supersedes FIPS 201-1 including Change Notice 1. To comply with FIPS 201-2, all new and replacement PIV Cards shall be issued with the mandatory PIV Card features no later than 12 months after the effective date of this standard.

ITL Bulletin Publisher:

Elizabeth Lennon, Writer/Editor

Information Technology Laboratory

National Institute of Standards and Technology

Email elizabeth.lennon@nist.gov

Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST nor does it imply that the products mentioned are necessarily the best available for the purpose.