FIPS 201 REQUIREMENT TRACEABILITY MATRIX

<table>
<colgroup>
<col style="width: 5%" />
<col style="width: 29%" />
<col style="width: 6%" />
<col style="width: 10%" />
<col style="width: 10%" />
<col style="width: 9%" />
<col style="width: 7%" />
<col style="width: 9%" />
<col style="width: 5%" />
<col style="width: 6%" />
</colgroup>
<thead>
<tr class="header">
<th>Req#</th>
<th>Requirement</th>
<th><p>FIPS201</p>
<p>Ref.</p>
<p>sect/pg</p></th>
<th>FIPS 201 Section Title</th>
<th><p>Applicable</p>
<p>Component</p>
<p>/System Function</p></th>
<th>PIV Subsystem</th>
<th><p>Target</p>
<p>System</p>
<p>(may be combine w impacts col)</p></th>
<th><p>Requirement Impacts:</p>
<p>Process</p>
<p>/Component</p>
<p>-Type</p></th>
<th><p>Requirement Type*</p>
<p>General/</p>
<p>Specific/</p></th>
<th><p>BPA Approval Process</p>
<p>#</p></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>1-1</td>
<td>The organization shall adopt and use an approved identity proofing
and registration process.</td>
<td>2.2/6</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>Identity proofing and registration</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>1-2</td>
<td><p>The process shall begin with initiation of a National Agency
Check with Written Inquiries (NACI) or other Office of Personnel
Management (OPM) or National Security community investigation required
for Federal employment. This requirement may also be satisfied by
locating and referencing a completed and successfully adjudicated NACI.
At a minimum, the National Agency Check (NAC) shall be completed before
credential issuance.</p>
<p>Appendix C, Background Check Descriptions, provides further details
on NAC and NACI.</p></td>
<td>2.2/6</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>Identity proofing and registration</td>
<td>Card Issuance and Management</td>
<td>IDMS</td>
<td>Process</td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>1-3</td>
<td>The applicant must appear in-person at least once before the
issuance of a PIV credential.</td>
<td>2.2/6</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>Identity proofing and registration</td>
<td>Card Issuance and Management</td>
<td>IDMS</td>
<td>Process</td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>1-4</td>
<td>During identity proofing, the applicant shall be required to provide
two forms of identity source documents in original form. The identity
source documents must come from the list of acceptable documents
included in Form I-9, OMB No. 1115-0136, Employment Eligibility
Verification. At least one document shall be a valid State or Federal
government-issued picture identification (ID).</td>
<td>2.2/6</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>Identity proofing and registration</td>
<td>Card Issuance and Management</td>
<td>IDMS</td>
<td>Process</td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>1-5</td>
<td>The PIV identity proofing, registration and issuance process shall
adhere to the principle of separation of duties to ensure that no single
individual has the capability to issue a PIV credential without the
cooperation of another authorized person.</td>
<td>2.2/6</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>identity proofing and registration</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>1-6</td>
<td>Assign an individual to the role of senior agency official for
privacy. The senior agency official for privacy is the individual who
oversees privacy-related matters in the PIV system and is responsible
for implementing the privacy requirements in the standard. The
individual serving in this role may not assume any other operational
role in the PIV system.</td>
<td>2.4/7</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>1-7</td>
<td>Conduct a comprehensive Privacy Impact Assessment (PIA) on systems
containing personal information in identifiable form for the purpose of
implementing PIV, consistent with [E-Gov] and [OMB322]. Consult with
appropriate personnel responsible for privacy issues at the department
or agency (e.g., Chief Information Officer) implementing the PIV
system.</td>
<td>2.4/7</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>1-8</td>
<td>Write, publish, and maintain a clear and comprehensive document
listing the types of information that will be collected (e.g.,
transactional information, personal information in identifiable form
[IIF]), the purpose of collection, what information may be disclosed to
whom during the life of the credential, how the information will be
protected, and the complete set of uses of the credential and related
information at the department or agency. PIV applicants shall be
provided full disclosure of the intended uses of the PIV credential and
the related privacy implications</td>
<td>2.4/7</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>1-9</td>
<td><p>Assure that systems that contain IIF for the purpose of enabling
the implementation of PIV are handled in full compliance with fair
information practices as defined in [PRIVACY].</p>
<p>the Privacy Act of 1974 [PRIVACY]</p></td>
<td>2.4/7</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>1-10</td>
<td>Maintain appeals procedures for those who are denied a credential or
whose credentials are revoked.</td>
<td>2.4/7</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>1-11</td>
<td>Ensure that only personnel with a legitimate need for access to IIF
in the PIV system are authorized to access the IIF, including but not
limited to information and databases maintained for registration and
credential issuance.</td>
<td>2.4/7</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>1-12</td>
<td>Coordinate with appropriate department or agency officials to define
consequences for violating privacy policies of the PIV system.</td>
<td>2.4/7</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>1-13</td>
<td>Assure that the technologies used in the department or agency’s
implementation of the PIV system allow for continuous auditing of
compliance with stated privacy policies and practices governing the
collection, use, and distribution of information in the operation of the
program.</td>
<td>2.4/8</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>1-14</td>
<td>Utilize security controls described in NIST SP 800-53, Recommended
Security Controls for Federal Information Systems, to accomplish privacy
goals, where applicable. [SP800-53]</td>
<td>2.4/8</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>1-15</td>
<td>Ensure that the technologies used to implement PIV sustain and do
not erode privacy protections relating to the use, collection, and
disclosure of information in identifiable form. Specifically, employ an
electromagnetically opaque sleeve or other technology to protect against
any unauthorized contactless access to information stored on a PIV
credential.</td>
<td>2.4/8</td>
<td>PIV Privacy Requirements</td>
<td>PIV System Privacy</td>
<td>Card Issuance and Management</td>
<td>PIV System</td>
<td>Process</td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-1</td>
<td>The PIV Card shall comply with physical characteristics as described
in International Organization for Standardization (ISO)/International
Electrotechnical Commission (IEC) 7810 [ISO7810], ISO/IEC 10373
[ISO10373], ISO/IEC 7816 for contact cards [ISO7816], and ISO/IEC 14443
for contactless cards [ISO14443].</td>
<td>4.1/15</td>
<td>Physical PIV Card Topology</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-2</td>
<td>The printed material shall not rub off during the life of the PIV
Card, nor shall the printing process deposit debris on the printer
rollers during printing and laminating.</td>
<td>4.1.1/15</td>
<td>Physical PIV Card Topology</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-3</td>
<td>Printed material shall not interfere with the contact and
contactless ICC(s) and related components, nor shall it obstruct access
to machine-readable information.</td>
<td>4.1.1/15</td>
<td>Physical PIV Card Topology</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-4</td>
<td><p>The PIV Card shall contain security features that aid in reducing
counterfeiting, are resistant to tampering, and provide visual evidence
of tampering attempts. At a minimum, a PIV Card shall incorporate one
such security feature. Examples of these security features include the
following:</p>
<p>+ Optical varying structures</p>
<p>+ Optical varying inks</p>
<p>+ Laser etching and engraving</p>
<p>+ Holograms</p>
<p>+ Holographic images</p>
<p>+ Watermarks.</p></td>
<td>4.1.2/15</td>
<td>Tamper Proofing and Resistance</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-5</td>
<td><p>Incorporation of security features shall—</p>
<p>+ Be in accordance with durability requirements [ISO7810]</p>
<p>+ Be free of defects, such as fading and discoloration</p>
<p>+ Not obscure printed information</p>
<p>+ Not impede access to machine-readable information.</p></td>
<td>4.1.2/16</td>
<td>Tamper Proofing and Resistance</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-6</td>
<td>The PIV Card shall contain a contact and a contactless ICC
interface.</td>
<td>4.1.3/16</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-7</td>
<td>The card body structure shall consist of card material(s) that
satisfy the card characteristics in [ISO7810] and test methods in
American National Standards Institute (ANSI) 322. [ANSI322] Although the
[ANSI322] test methods do not currently specify compliance requirements,
the tests shall be used to evaluate card material durability and
performance. The [ANSI322] tests minimally shall include card flexure,
static stress, plasticizer exposure, impact resistance, card structural
integrity, surface abrasion, temperature and humidity-induced dye
migration, ultraviolet light exposure, and a laundry test. Cards shall
not malfunction or delaminate after hand cleaning with a mild soap and
water mixture. The reagents called out in Section 5.4.1.1 of [ISO10373]
shall be modified to include a two percent soap solution.</td>
<td>4.1.3/16</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-8</td>
<td>The card shall be subjected to actual, concentrated, or artificial
sunlight to appropriately reflect 2000 hours of southwestern United
States’ sunlight exposure in accordance with [ISO10373], Section 5.12.
Concentrated sunlight exposure shall be performed in accordance with
[G90-98] and accelerated exposure in accordance with [G155-00]. After
exposure, the card shall be subjected to the [ISO10373] dynamic bending
test and shall have no visible cracks or failures. Alternatively, the
card may be subjected to the [ANSI322] tests for ultraviolet and
daylight fading resistance and subjected to the same [ISO10373] dynamic
bending test.</td>
<td>4.1.3/16</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-9m</td>
<td>The card shall be 27- to 33-mil thick (before lamination) in
accordance with [ISO7810].</td>
<td>4.1.3/16</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-10m</td>
<td>The PIV Card shall not be embossed.</td>
<td>4.1.3/16</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-11m</td>
<td>Decals shall not be adhered to the card.</td>
<td>4.1.3/16</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-12m</td>
<td><p>Departments and agencies may choose to punch an opening in the
card body to enable the card to be worn on a lanyard. Departments and
agencies should ensure such alterations are closely coordinated with the
card vendor and/or manufacturer to ensure the card material integrity is
not adversely impacted. Departments and agencies are strongly encouraged
to ensure such alterations do not—</p>
<ul>
<li><p>Compromise card body durability requirements and
characteristics</p></li>
<li><p>Invalidate card manufacturer warranties or other product
claims</p></li>
<li><p>Alter or interfere with printed information, including the
photo</p></li>
<li><p>Damage or interfere with machine-readable technology, such as the
embedded antenna.</p></li>
</ul></td>
<td>4.1.3/16</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-13</td>
<td>The card material shall withstand the effects of temperatures
required by the application of a polyester laminate on one or both sides
of the card by commercial off-the-shelf (COTS) equipment. The thickness
added due to a laminate layer shall not interfere with the smart card
reader operation. The card material shall allow production of a flat
card in accordance with [ISO7810] after lamination of one or both sides
of the card.</td>
<td>4.1.3/17</td>
<td>Physical Characteristics and Durability</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-14</td>
<td>The information on a PIV Card shall be in visual printed and
electronic form.</td>
<td>4.1.4/17</td>
<td>Visual Card Topography</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-15</td>
<td>Printed data shall not interfere with machine-readable
technology.</td>
<td>4.1.4/17</td>
<td>Visual Card Topography</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-16</td>
<td>Areas that are marked as reserved should not be used for
printing.</td>
<td>4.1.4/17</td>
<td>Visual Card Topography</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-17</td>
<td>The photograph shall be placed in the upper left corner and be a
full frontal pose from top of the head to shoulder, as depicted in
Figure 4-1. A minimum of 300 dots per inch (dpi) resolution shall be
used. The background should follow recommendations set forth in SP
800-76.</td>
<td>4.1.4.1/17</td>
<td>Mandatory Items on the Front of the PIV Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-18</td>
<td>The full name shall be printed directly under the photograph in
capital letters. The font shall be a minimum of 10 point.</td>
<td>4.1.4.1/18</td>
<td>Mandatory Items on the Front of the PIV Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-19</td>
<td>A printed employee affiliation shall be printed on the card. Some
examples of employee affiliation are “CONTRACTOR,” “ACTIVE DUTY,” and
“CIVILIAN.”</td>
<td>4.1.4.1/18</td>
<td>Mandatory Items on the Front of the PIV Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-20</td>
<td>The Organizational Affiliation shall be printed as depicted in
Figure 4-1.</td>
<td>4.1.4.1/18</td>
<td>Mandatory Items on the Front of the PIV Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-21</td>
<td>The card expiration date shall be printed in a YYYYMMMDD
format.</td>
<td>4.1.4.1/18</td>
<td>Mandatory Items on the Front of the PIV Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-22</td>
<td>Agency Card Serial Number- This item shall be printed as depicted in
Figure 4-6 and contain the unique serial number from the issuing
department or agency. The format shall be at the discretion of the
issuing department or agency.</td>
<td>4.1.4.2/18</td>
<td>Mandatory Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-23</td>
<td>Issuer Identification- This item shall be printed as depicted in
Figure 4-6 and consist of six characters for the department code, four
characters for the agency code, and a five-digit number that uniquely
identifies the issuing facility within the department or agency.</td>
<td>4.1.4.2/18</td>
<td>Mandatory Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-24</td>
<td>Zone 3—Signature. If used, the department or agency shall place the
cardholder signature below the photograph and cardholder name as
depicted in Figure 4-3. The space for the signature shall not interfere
with the contact and contactless placement. Because of card topology
space constraints, placement of a signature may limit the size of the
optional two-dimensional bar code.</td>
<td>4.1.4.3/18</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-25</td>
<td>Zone 4—Agency Specific text area. If used, this area can be used for
printing agency specific requirements, such as employee status.</td>
<td>4.1.4.3/18</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-26</td>
<td>Zone 5—Rank. If used, the cardholder’s rank shall be printed in the
area as illustrated. Data format is at the department or agency’s
discretion.</td>
<td>4.1.4.3/18</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-27</td>
<td>Zone 6—Portable Data File (PDF) Two-Dimensional Bar Code. If used,
the PDF bar code placement shall be as depicted in the diagram (i.e.,
left side of the card). If Zone 3 (a cardholder signature) is used, the
size of the PDF bar code may be affected. The card issuer should confirm
that a PDF used in conjunction with a PIV Card containing a cardholder
signature will satisfy the anticipated PDF data storage
requirements.</td>
<td>4.1.4.3/18</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-28</td>
<td>Zone 9— Header. If used, the text “United States Government” shall
be placed as depicted in Figure 4-1. Departments and agencies may also
choose to use this zone for other department or agency-specific
information, such as identifying a Federal emergency responder role, as
depicted in Figure 4-2.</td>
<td>4.1.4.3/18</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-29</td>
<td>Zone 11—Agency Seal. If used, the seal selected by the issuing
department, agency, or organization shall be printed in the area
depicted. It shall be printed using the guidelines provided in Figure
4-2 to ensure information printed on the seal is legible and clearly
visible.</td>
<td>4.1.4.3/19</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-30</td>
<td>Zone 12—Footer. The footer is the preferred location for the
Emergency Response Official Identification label. If used, a department
or agency may print “Federal Emergency Response Official” as depicted in
Figure 4-2, preferably in red text. Departments and agencies may also
print a secondary line in Zone 9 to further identify the Federal
emergency respondent’s official role. Some examples of official roles
are “Law Enforcement, “Firefighter” and “Emergency Response Team
(ERT)”.</td>
<td>4.1.4.3/19</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-31</td>
<td>Zone 13—Issue Date. If used, the card issuance date shall be printed
above the expiration date in YYYYMMMDD format as depicted in Figure
4-2.</td>
<td>4.1.4.3/19</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-32</td>
<td><p>Zone 15—Color-Coding for Employee Affiliation. Color-coding may
be used for additional identification of employee affiliation. If
color-coding is used, it shall be used as a background color for Zone 2
(name) as depicted in Figure 4-4. The following color scheme shall be
used for the noted categories:</p>
<p>+ Blue—foreign nationals</p>
<p>+ Red—emergency responder officials</p>
<p>+ Green—contractors.</p>
<p>These colors shall be reserved and shall not be employed for other
purposes. Zone 15 may be a solid or patterned line at the department or
agency’s discretion.</p></td>
<td>4.1.4.3/19</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-33</td>
<td>Zone 16—Photo Border for Employee Affiliation. A border may be used
with the photo to further identify employee affiliation, as depicted in
Figure 4-3. This border may be used in conjunction with Zone 15 to
enable departments and agencies to develop various employee categories.
The photo border shall not obscure the photo. The border may be a solid
or patterned line. For solid and patterned lines, red shall be reserved
for emergency response officials, blue for foreign nationals, and green
for contractors. All other colors may be used at the department or
agency’s discretion.</td>
<td>4.1.4.3/19</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-34</td>
<td>Zone 17—Agency Specific Data. In cases in which other defined
optional elements are not used, Zone 17 may be used for other department
or agency-specific information, as depicted in Figure 4-5.</td>
<td>4.1.4.3/19</td>
<td>Optional Items on the Front of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-35</td>
<td>Zone 3—Magnetic Stripe. If used, the magnetic stripe shall be high
coercivity and placed in accordance with [ISO7811], as illustrated in
Figure 4-7.</td>
<td>4.1.4.4/19</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-36</td>
<td>Zone 4—Return To. If used, the “return if lost” language shall be
generally placed on the back of the card as depicted in Figure 4-7.</td>
<td>4.1.4.4/19</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-37</td>
<td>Zone 5—Physical Characteristics of Cardholder. If used, the
cardholder physical characteristics (e.g., height, eye color, hair
color) shall be printed in the general area illustrated in Figure
4-7.</td>
<td>4.1.4.4/19</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-38</td>
<td>Zone 6—Additional Language for Emergency Responder Officials.
Departments and agencies may choose to provide additional information to
identify emergency response officials or to better identify the
cardholder’s authorized access. If used, this additional text shall be
in the general area depicted and shall not interfere with other printed
text or machine-readable components. An example of a printed statement
is provided in Figure 4-7.</td>
<td>4.1.4.4/19</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-39</td>
<td>Zone 7—Standard Section 499, Title 18 Language. If used, standard
Section 499, Title 18, language warning against counterfeiting,
altering, or misusing the card shall be printed in the general area
depicted in Figure 4-7.</td>
<td>4.1.4.4/20</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-40</td>
<td>Zone 8—Linear 3 of 9 Bar Code. If used, a linear 3 of 9 bar code
shall be generally placed as depicted in Figure 4-7. It shall be in
accordance with Association for Automatic Identification and Mobility
(AIM) standards. Beginning and end points of the bar code will be
dependent on the embedded contactless module selected. Departments and
agencies are encouraged to coordinate placement of the bar code with the
card vendor.</td>
<td>4.1.4.4/20</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-41</td>
<td>Zone 9—Agency-Specific Text. In cases in which other defined
optional elements are not used, Zone 9 may be used for other department
or agency-specific information, as depicted in Figure 4-8. For example,
emergency responder officials may use this area to provide additional
details.</td>
<td>4.1.4.4/20</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-42</td>
<td>In the case of the Department of Defense, the back of the card will
have a distinct appearance. This is necessary to display information
required by the Geneva Accord and to facilitate medical entitlements
that are legislatively mandated.</td>
<td>4.1.4.4/20</td>
<td>Optional Items on the Back of the Card</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-43</td>
<td><p>To support a variety of authentication mechanisms, the PIV
logical credentials shall contain multiple data elements for the purpose
of verifying the cardholder's identity at graduated assurance levels.
These mandatory data elements collectively comprise the data model for
PIV logical credentials, and include the following:</p>
<p>+ A PIN</p>
<p>+ A CHUID</p>
<p>+ PIV authentication data (one asymmetric key pair and corresponding
certificate)</p>
<p>+ Two biometric fingerprints.</p></td>
<td>4.1.5.1/29</td>
<td>Logical Credential Data Model</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-44m</td>
<td><p>The PIV data model may be optionally extended to meet department
or agency-specific requirements. If the data model is extended, this
standard establishes requirements for the following four classes of
logical credentials:</p>
<p>+ An asymmetric key pair and corresponding certificate for digital
signatures</p>
<p>+ An asymmetric key pair and corresponding certificate for key
management</p>
<p>+ Asymmetric or symmetric card authentication keys for supporting
additional physical access applications</p>
<p>+ Symmetric key(s) associated with the card management
system.</p></td>
<td>4.1.5.1/29</td>
<td>Logical Credential Data Model</td>
<td>Key Management</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-45</td>
<td>PIV Cards shall implement PIN-based cardholder activation to allow
privileged operations using PIV credentials held by the card.</td>
<td>4.1.6.1/30</td>
<td>Activation by Cardholder</td>
<td>PIN Input Device</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Keyboard</p>
<p>-Biometric Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-46</td>
<td>For PIN-based cardholder activation, the cardholder shall supply a
numeric PIN.</td>
<td>4.1.6.1/30</td>
<td>Activation by Cardholder</td>
<td>PIN Input Device</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Keyboard</p>
<p>-Biometric Reader</p>
<p>-Pin Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-47</td>
<td>The PIN shall be transmitted to the PIV Card and checked by the
card. If the presented PIN is correct, the PIV Card is activated.</td>
<td>4.1.6.1/30</td>
<td>Activation by Cardholder</td>
<td>PIN Input Device</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Keyboard</p>
<p>-Biometric Reader</p>
<p>-Pin Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-48</td>
<td>The PIV Card shall include mechanisms to limit the number of guesses
an adversary can attempt if a card is lost or stolen.</td>
<td>4.1.6.1/30</td>
<td>Activation by Cardholder</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-49</td>
<td>Moreover, the PIN should not be easily-guessable or otherwise
individually-identifiable in nature (e.g., part of a Social Security
Number, phone number).</td>
<td>4.1.6.1/30</td>
<td>Activation by Cardholder</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-50</td>
<td>The PIN authentication mechanism shall meet the identity-based
authentication requirements of FIPS PUB 140-2 Level 2. [FIPS140-2]</td>
<td>4.1.6.1/30</td>
<td>Activation by Cardholder</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-51m</td>
<td>PIV Cards may support card activation by the card management system
to support card personalization and post-issuance card update. To
activate the card for personalization or update, the card management
system shall perform a challenge response protocol using cryptographic
keys stored on the card in accordance with [SP800-73].</td>
<td>4.1.6.2/30</td>
<td>Activation by Card Management System</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Card Mgmt System</p>
<p>-Card Writer</p></td>
<td>S</td>
<td>2-51m conflicts with 2-52</td>
</tr>
<tr class="odd">
<td>2-52</td>
<td>When cards are personalized, card management keys shall be set to be
specific to each PIV Card. That is, each PIV Card shall contain a unique
card management key.</td>
<td>4.1.6.2/30</td>
<td>Activation by Card Management System</td>
<td>Key Management</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Card Writer</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-53</td>
<td>Card management keys shall meet the algorithm and key size
requirements stated in Special Publication 800-78, Cryptographic
Algorithms and Key Sizes for Personal Identity Verification.
[SP800-78]</td>
<td>4.1.6.2/30</td>
<td>Activation by Card Management System</td>
<td>Key Management</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Card Writer</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-54</td>
<td>The PIV Card shall include the CHUID as defined in [SP800-73]. The
CHUID includes an element, the Federal Agency Smart Credential Number
(FASC-N), which uniquely identifies each card.</td>
<td>4.2/30</td>
<td>Cardholder Unique Identifier (CHUID)</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>D.2</p></td>
</tr>
<tr class="even">
<td>2-55</td>
<td>The PIV CHUID shall be accessible from both the contact and
contactless interfaces of the PIV Card without card activation.</td>
<td>4.2/30</td>
<td>Cardholder Unique Identifier (CHUID)</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>C1.1.2</p></td>
</tr>
<tr class="odd">
<td>2-56</td>
<td>The PIV FASC-N shall not be modified post-issuance.</td>
<td>4.2/30</td>
<td>Cardholder Unique Identifier (CHUID)</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Card Mgmt System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-57</td>
<td>In addition to the mandatory FASC-N that identifies a PIV Card, the
CHUID shall include an expiration date. In machine readable format, the
expiration date data element shall specify when the card expires. The
expiration date format and encoding rules are as specified in
[SP800-73].</td>
<td>4.2.1/30</td>
<td>PIV CHUID Data Elements</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td>800-85 C.1.2</td>
</tr>
<tr class="odd">
<td>2-58</td>
<td>This standard requires inclusion of the Asymmetric Signature field
in the CHUID container. The Asymmetric Signature data element of the PIV
CHUID shall be encoded as a Cryptographic Message Syntax (CMS) external
digital signature, as defined in RFC 3852 [RFC3852].</td>
<td>4.2.2/30</td>
<td>Asymmetric Signature Field in CHUID</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>D.2</p></td>
</tr>
<tr class="even">
<td>2-59</td>
<td>The digital signature shall be computed over the entire contents of
the CHUID, excluding the Asymmetric Signature field.</td>
<td>4.2.2/30</td>
<td>Asymmetric Signature Field in CHUID</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>D.2</p></td>
</tr>
<tr class="odd">
<td>2-60</td>
<td><p>The issuer asymmetric signature file is implemented as a
SignedData Type, as specified in [RFC3852], and shall include the
following information:</p>
<p>+ The message shall include a version field specifying version v3</p>
<p>+ The digestAlgorithms field shall be as specified in [SP800-78]</p>
<p>+ The encapContentInfo shall:</p>
<p>– Specify an eContentType of id-PIV CHUIDSecurityObject</p>
<ul>
<li><p>Omit the eContent field</p></li>
</ul>
<p>+ The certificates field shall include only a single X.509
certificate which can be used to verify the signature in the SignerInfo
field</p>
<p>+ The crls field shall be omitted</p>
<p>+ signerInfos shall be present and include only a single
SignerInfo</p>
<p>+ The SignerInfo shall:</p>
<ul>
<li><p>Use the issuerAndSerialNumber choice for
SignerIdentifier</p></li>
<li><p>Specify a digestAlgorithm in accordance with [SP800-78]</p></li>
<li><p>Include, at a minimum, the following signed attributes:</p></li>
</ul>
<blockquote>
<p>• A MessageDigest attribute containing the hash computed over the
concatenated contents of the CHUID, excluding the asymmetric signature
field • A pivSigner-DN attribute containing the subject name that
appears in the PKI certificate for the entity that signed the CHUID –
Include the digital signature.</p>
</blockquote></td>
<td>4.2.2/30</td>
<td>Asymmetric Signature Field in CHUID</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>D.2</p></td>
</tr>
<tr class="even">
<td>2-61</td>
<td>The public key required to verify the digital signature shall be
provided in the certificates field in an X.509 digital signature
certificate issued under [COMMON], and shall meet the format and
infrastructure requirements for PIV digital signature keys specified in
Section 4.3.</td>
<td>4.2.2/31</td>
<td>Asymmetric Signature Field in CHUID</td>
<td>Key Management</td>
<td>Front-End</td>
<td><p>Card</p>
<p>PKI</p></td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>D.8</p></td>
</tr>
<tr class="odd">
<td>2-63</td>
<td>The certificate shall also include an extendedKeyUsage extension
asserting id-PIV-content-signing</td>
<td>4.2.2/31</td>
<td>Asymmetric Signature Field in CHUID</td>
<td>Key Management</td>
<td>Front-End</td>
<td><p>Card</p>
<p>PKI</p></td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>D.2</p></td>
</tr>
<tr class="even">
<td>2-64</td>
<td>At a minimum, the PIV Card must store one asymmetric private key and
a corresponding public key certificate, and perform cryptographic
operations using the asymmetric private key. Cryptographic operations
with this key are performed only through the contact interface
<em>(GENERAL AUTHENTICATE, GENERATE ASYMMETRIC KEY PAIR
command).</em></td>
<td>4.3/31</td>
<td>Cryptographic Specifications</td>
<td>Key Management</td>
<td>Front-End</td>
<td><p>Card</p>
<p>PKI</p></td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>C.3.2.2</p>
<p>D.8</p></td>
</tr>
<tr class="odd">
<td>2-65</td>
<td><p>The PIV Card shall implement the following cryptographic
operations and support functions:</p>
<p>+ RSA or elliptic curve key pair generation</p>
<p>+ RSA or elliptic curve private key cryptographic operations</p>
<p>+ Importation and storage of X.509 certificates.</p></td>
<td>4.3/31</td>
<td>Cryptographic Specifications</td>
<td>Key Management</td>
<td>Front-End</td>
<td><p>Card</p>
<p>PKI</p></td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-66m</td>
<td>The PIV Card may include additional asymmetric keys and PKI
certificates.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>Key Management</td>
<td>Front-End</td>
<td><p>Card</p>
<p>PKI</p></td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-67e</td>
<td>Where digital signature keys are supported, the PIV Card is not
required to implement a secure hash algorithm.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>Key Management</td>
<td>Front-End</td>
<td><p>Card</p>
<p>PKI</p></td>
<td><p>Component</p>
<p>-Card</p>
<p>-applications</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-68m</td>
<td>Message hashing may be performed off-card.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>PIV System</td>
<td>Front-End</td>
<td><p>Host</p>
<p>PKI</p></td>
<td><p>Component</p>
<p>-Host</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-69</td>
<td>PIV Card must contain storage for the AES key and support AES
operations through the contactless interface.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td>conflicts with table?</td>
</tr>
<tr class="even">
<td>2-70m</td>
<td>Cryptographic operations are not mandated for the contactless
interface, but departments and agencies may choose to supplement the
basic functionality with storage for a card authentication key and
support for a corresponding set of cryptographic operations. For
example, if a department or agency wants to utilize Advanced Encryption
Standard (AES) based challenge/response for physical access, the PIV
Card must contain storage for the AES key and support AES operations
through the contactless interface. If the contactless interface utilizes
asymmetric cryptography (e.g., elliptic curve cryptography [ECC]), the
PIV Card may also require storage for a corresponding public key
certificate.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-71</td>
<td>All cryptographic operations using the PIV keys shall be performed
on-card; the PIV Card need not implement any additional cryptographic
functionality (e.g., hashing, signature verification) by additional
cryptographic mechanisms implemented on-card. Algorithms and key sizes
for each PIV key type are specified in [SP800-78].</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-72</td>
<td>The PIV authentication key shall be an asymmetric private key
supporting card authentication for an interoperable environment, and it
is mandatory for each PIV Card.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>C 1.4</p>
<p>E.2</p></td>
</tr>
<tr class="odd">
<td>2-73m</td>
<td>The card authentication key may be either a symmetric (secret) key
or an asymmetric private key for physical access, and it is
optional.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-74</td>
<td>The digital signature key is an asymmetric private key supporting
document signing, and it is optional.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-75</td>
<td>The key management key is an asymmetric private key supporting key
establishment and transport, and it is optional. This can also be used
as an encryption key.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-76</td>
<td>All PIV cryptographic keys shall be generated within a FIPS 140-2
validated cryptomodule with overall validation at Level 2 or above.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>PIV System</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-77</td>
<td>In addition to an overall validation of Level 2, the PIV Card shall
provide Level 3 physical security to protect the PIV private keys in
storage.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-78</td>
<td>PIV Authentication Key. This key shall be generated on the PIV Card.
The PIV Card shall not permit exportation of the PIV authentication key.
The PIV authentication key must be available only through the contact
interface of the PIV Card. Private key operations may be performed using
an activated PIV Card without explicit user action (e.g., the PIN need
not be supplied for each operation)</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td><p>800-85</p>
<p>C.1.2.1 (22)</p>
<p>AS05.03</p></td>
</tr>
<tr class="odd">
<td>2-79</td>
<td>The PIV Card shall store a corresponding X.509 certificate to
support validation of the public key <em>(for Authentication key).</em>
The X.509 certificate shall include the FASC-N in the subject
alternative name extension using the pivFASC-N attribute to support
physical access procedures. The expiration date of the certificate must
be no later than the expiration date of the PIV Card.</td>
<td>4.3/32</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-80</td>
<td>Card Authentication Key. The PIV Card shall not permit exportation
of the card authentication key. Private/secret key operations may be
performed using this key without explicit user action (e.g., the PIN
need not be supplied). This standard does not specify key management
protocols or infrastructure requirements.</td>
<td>4.3/33</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Physical Security System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-81</td>
<td>Digital Signature Key. The PIV digital signature key shall be
generated on the PIV Card. The PIV Card shall not permit exportation of
the digital signature key. If present, cryptographic operations using
the digital signature key may only be performed using the contact
interface of the PIV Card. Private key operations may not be performed
without explicit user action.</td>
<td>4.3/33</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Applications</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-82</td>
<td>The PIV Card shall store a corresponding X.509 certificate to
support validation of the digital signature key.</td>
<td>4.3/33</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Applications</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-83</td>
<td>Key Management Key. This key may be generated on the PIV Card or
imported to the card. If present, the key management key must only be
accessible using the contact interface of the PIV Card. Private key
operations may be performed using an activated PIV Card without explicit
user action (e.g., the PIN need not be supplied for each operation).
This key is sometimes called an encryption key or an encipherment key.
The PIV Card shall import and store a corresponding X.509 certificate to
support validation of the key management key. Section 5.4 of this
document specifies the certificate format and the key management
infrastructure for PIV key management keys.</td>
<td>4.3/33</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-84</td>
<td>Card Management Key. The card management key is imported onto the
card by the issuer. If present, the card management key must only be
accessible using the contact interface of the PIV Card.</td>
<td>4.3/33</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-85m</td>
<td>The PIV Card may also import and store X.509 certificates for use in
PKI path validation. These trust anchor certificates may be accessed
through the contact interface using an activated PIV Card without
explicit cardholder action.</td>
<td>4.3/33</td>
<td>Cryptographic Specifications</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-86m</td>
<td>If supported, initialization and update of trust anchor certificates
shall require explicit cardholder action, in addition to activation of
the card.</td>
<td>4.3/33</td>
<td>Cryptographic Specifications</td>
<td><p>Key Management</p>
<p>PIV Card</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-87</td>
<td><p>The biometric data used during the PIV Card life cycle activities
shall consist of the following:</p>
<p>+ A full set of fingerprints used to perform law enforcement checks
as part of the identity proofing and registration process</p>
<p>+ An electronic facial image used for printing facial image on the
card as well as for performing visual authentication during card usage.
A new facial image must be collected at the time of reissuance. The
facial image is not required to be stored on the card.</p>
<p>+ Two electronic fingerprints to be stored on the card for automated
authentication during card usage.</p>
<p>All three biometric data enumerated above are collected during the
identity proofing and registration process. Implementation requirements
for storage of biometric data on PIV Cards is dependent on use of
specifications contained in NIST SP 800-76 [SP800-76].</p></td>
<td>4.4/33</td>
<td>Biometric Data Specifications</td>
<td><p>PIV Card</p>
<p>Biometric Reader</p>
<p>Identity Proofing &amp; Registration</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-Host</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-88</td>
<td>The two electronic fingerprints stored on the card shall be
accessible only over the contact interface and after the presentation of
a valid PIN.</td>
<td>4.4/34</td>
<td>Biometric Data Specifications</td>
<td><p>PIV Card</p>
<p>Biometric Reader</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-Pin Reader</p>
<p>-Host</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-89</td>
<td>No contactless access is permitted for the biometric data specified
to be stored on the PIV Card under this standard.</td>
<td>4.4/34</td>
<td>Biometric Data Specifications</td>
<td><p>PIV Card</p>
<p>Biometric Reader</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-Host</p></td>
<td>S</td>
<td>?</td>
</tr>
<tr class="even">
<td>2-90</td>
<td>The full set of fingerprints shall be collected from all PIV Card
applicants who can provide them. The technical specifications for the
collection and formatting of the ten fingerprints is contained in
[SP800-76].</td>
<td>4.4.1/34</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance &amp; Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-Host</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-91</td>
<td>The fingerprints shall be used for one-to-many matching with the
database of fingerprints maintained by the FBI.</td>
<td>4.4.1/34</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance &amp; Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Issuance Scanner</p>
<p>-Host System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-92</td>
<td>The fingerprints should be captured using FBI-certified scanners and
transmitted using FBI standard transactions.</td>
<td>4.4.1/34</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance &amp; Management</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Issuance Scanner</p>
<p>-Host System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-93</td>
<td>A facial image shall be collected from all PIV applicants. The
technical specifications for an electronic facial image are contained in
[SP800-76].</td>
<td>4.4.1/34</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance &amp; Management</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Issuance Scanner</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-94m</td>
<td><p>The electronic facial image may be used for the following
purposes:</p>
<p>+ For generating the printed image on the card</p>
<p>+ For generating a visual image on the monitor of a guard workstation
for augmenting the visual authentication process defined in Section
6.2.1.</p>
<p>This approach may be required in the following situations:</p>
<ul>
<li><p>A good live sample of fingerprints cannot be collected from the
PIV cardholder due to damage or injury to fingers</p></li>
<li><p>Fingerprint matching equipment failure – Authenticating PIV
cardholders covered under Section 508.</p></li>
</ul></td>
<td>4.4.1/34</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance &amp; Management</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Issuance Scanner</p>
<p>-Host System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-95m</td>
<td><p>Two electronic fingerprints shall be collected from all PIV
applicants, who can provide them, for storing on the card.
Alternatively, these two electronic fingerprints can also be extracted
from the ten fingerprints collected earlier for law enforcement checks.
The technical specifications for the two electronic fingerprints are
contained in [SP800-76].</p>
<p>The right and left index fingers shall normally be designated as the
primary and secondary finger, respectively. However, if those fingers
cannot be imaged, the primary and secondary designations shall be taken
from the following fingers, in decreasing order of priority: 1. Right
thumb 2. Left thumb 3. Right middle finger 4. Left middle finger 5.
Right ring finger 6. Left ring finger 7. Right little finger 8. Left
little finger</p></td>
<td>4.4.1/34</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance &amp; Management</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Issuance Scanner</p>
<p>-Host System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-96</td>
<td>Even though two fingerprints are available on the card, a department
or agency has the option to use one or both of them for the purpose of
PIV cardholder authentication. If only one fingerprint is used for
authentication, then the primary finger shall be used first. In cases
where there is difficulty in collecting even a single fingerprint of
acceptable quality, the department or agency shall perform
authentication using asymmetric cryptography as described in Section
6.2.4.</td>
<td>4.4.1/34</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>PIV Card</td>
<td>Card Issuance &amp; Management</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Issuance Scanner</p>
<p>-Host System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-97</td>
<td>The format for CBEFF_HEADER and the STD_BIOMETRIC_RECORD is
specified in [SP800-76].</td>
<td>4.4.1/35</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-98</td>
<td>The digital signature shall be computed over the entire CBEFF
structure except the CBEFF_SIGNATURE_BLOCK itself (which means that it
includes the CBEFF_HEADER and STD_BIOMETRIC_RECORD).</td>
<td>4.4.1/35</td>
<td>Biometric Data Collection, Storage, and Usage</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-99</td>
<td><p>The CMS encoding of the CBEFF_SIGNATURE_BLOCK is as a SignedData
type, and shall include the following information:</p>
<p>+ The message shall include a version field specifying version v3</p>
<p>+ The digestAlgorithms field shall be as specified in [SP800-78]</p>
<p>+ The encapcontentInfo shall</p>
<ul>
<li><p>Specify an eContentType of id-PIV-biometricObject</p></li>
<li><p>Omit the eContent field</p></li>
</ul>
<p>+ If the signature on the biometric was generated with the same key
as the signature on the CHUID, the certificates field shall be
omitted</p>
<p>+ If the signature on the biometric was generated with a different
key as the signature on the CHUID, the certificates field shall include
only a single certificate which can be used to verify the signature in
the SignerInfo field</p>
<p>+ The crls field shall be omitted</p>
<p>+ signerInfos shall be present and include only a single
SignerInfo</p>
<p>+ The SignerInfo shall</p>
<ul>
<li><p>Use the issuerAndSerialNumber choice for
SignerIdentifier</p></li>
<li><p>Specify a digestAlgorithm in accordance with [SP800-78]</p></li>
</ul>
<blockquote>
<p>Include at a minimum the following signed attributes: •</p>
<p>A MessageDigest attribute containing the hash of the concatenated
CBEFF_HEADER + STD_BIOMETRIC_RECORD</p>
<p>• A pivFASC-N attribute containing the FASC-N of the PIV Card (to
link the biometric data and PIV Card)</p>
<p>• A pivSigner-DN attribute containing the subject name that appears
in the PKI certificate for the entity that signed the biometric data</p>
<p>– Include the digital signature.</p>
</blockquote></td>
<td>4.4.2/35</td>
<td>Biometric Data Representation and Protection</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-100</td>
<td>Contact card readers shall conform to the [ISO7816] standard for the
card-to-reader interface.</td>
<td>4.5.1/37</td>
<td>Contact Reader Specifications</td>
<td>Card Reader/Writer</td>
<td>Front-End</td>
<td>Card Issuance</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Card Reader</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-101</td>
<td>These readers shall conform to the Personal Computer/Smart Card
(PC/SC) Specification [PCSC] for the reader-to-host system interface in
general desktop computing environment.</td>
<td>4.5.1/37</td>
<td>Contact Reader Specifications</td>
<td>Card Reader/Writer</td>
<td>Front-End</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-</p>
<p>Card Reader</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-102</td>
<td>In physical access control systems where the readers are not
connected to general purpose desktop computing systems, the
reader-to-host system interface is not specified in this standard.</td>
<td>4.5.1/37</td>
<td>Contact Reader Specifications</td>
<td>Card Reader/Writer</td>
<td>Front-End</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card Reader</p>
<p>-Host System</p>
<p>-Desktop</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-103</td>
<td>Contactless card readers shall conform to the [ISO 14443] standard
for the card-to-reader interface.</td>
<td>4.5.2/37</td>
<td>Contactless Reader Specifications</td>
<td>Card Reader/Writer</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card Reader</p>
<p>-Host System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-104</td>
<td>In cases where these readers are connected to general purpose
desktop computing systems, they shall conform to [PCSC] for the
reader-to-host system interface.</td>
<td>4.5.2/37</td>
<td>Contactless Reader Specifications</td>
<td>Card Reader/Writer</td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card Reader</p>
<p>-Desktop</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-105</td>
<td>PIN input devices shall be used for implementing PIN-based PIV Card
activation.</td>
<td>4.5.3/37</td>
<td>PIN Input Device Specifications</td>
<td>PIN Input Device</td>
<td>Front-End</td>
<td>PIN Reader</td>
<td><p>Component</p>
<p>- PIN Reader</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-106</td>
<td>When the PIV Card is used with a PIN for physical access, the PIN
input device shall be integrated with the reader.</td>
<td>4.5.3/37</td>
<td>PIN Input Device Specifications</td>
<td>PIN Input Device</td>
<td>Front-End</td>
<td>PIN Reader</td>
<td><p>Component</p>
<p>- PIN Reader</p>
<p>- Biometric Reader</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-107m</td>
<td>When the PIV Card is used with a PIN for logical access (e.g., to
authenticate to a Web site or other server), the PIN input device may be
integrated with the reader or entered using the computer’s
keyboard.</td>
<td>4.5.3/37</td>
<td>PIN Input Device Specifications</td>
<td>PIN Input Device</td>
<td>Front-End</td>
<td>PIN Reader</td>
<td><p>Component</p>
<p>- PIN Reader</p>
<p>-Desktop</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-108</td>
<td>If the PIN input device is not integrated with the reader, the PIN
shall be transmitted securely and directly to the PIV Card for card
activation.</td>
<td>4.5.3/37</td>
<td>PIN Input Device Specifications</td>
<td>PIN Input Device</td>
<td>Front-End</td>
<td>PIN Reader</td>
<td><p>Component</p>
<p>- PIN Reader</p>
<p>-Desktop</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-109</td>
<td>Each agency’s PIV implementation(s) shall support interoperability
by issuing and managing interoperable PIV Cards and their associated
logical credentials specified in Section 4.</td>
<td>5.1/38</td>
<td>Control Objectives and Interoperability Requirements</td>
<td>PIV System</td>
<td>Card Issuance and Management Subsystem</td>
<td>PIV System</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-110</td>
<td>All PIV-II identity proofing and registration systems must satisfy
the PIV-I objectives and requirements stated in Section 2.2 in order to
be approved.</td>
<td>5.2/39</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>PIV System</td>
<td>Card Issuance and Management Subsystem</td>
<td>Cards</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-111</td>
<td>An additional requirement for PIV-II is that the biometrics
(fingerprints and facial image) that are used to personalize the PIV
Card must be captured during the identity proofing and registration
process.</td>
<td>5.2/39</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance and Management Subsystem</td>
<td>Cards</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-Scanner</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-112</td>
<td>When issuing PIV Cards, Federal agencies and departments must use an
approved identity proofing and registration process. Two approved PIV
identity proofing and registration processes are provided in Appendix A.
Other identity proofing and registration process may be used if
accredited by the department or agency as satisfying the requisite PIV
objectives and requirements and approved in writing by the head of the
Federal department or agency.</td>
<td>5.2/39</td>
<td>PIV Identity Proofing and Registration Requirements</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance and Management Subsystem</td>
<td>Cards</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-Scanner</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-113</td>
<td>An employee or contractor may be issued PIV Card and logical
credentials while a National Agency Check with Written Inquiries (NACI)
or other OPM or National Security community investigation required for
Federal employment is pending. In such cases, the process must verify
successful completion and adjudication of the investigation within six
months of PIV card issuance, or the PIV card and the PIV authentication
certificate for the card shall be revoked.</td>
<td>5.3.1/39</td>
<td>PIV Card Issuance</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance and Management Subsystem</td>
<td>Cards</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-Scanner</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-114</td>
<td>An additional requirement is that the issuer shall perform a 1:1
biometric match of the applicant against the biometric included in the
PIV Card or in the PIV enrollment record. On successful match, the PIV
Card shall be released to the applicant.</td>
<td>5.3.1/39</td>
<td>PIV Card Issuance</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance and Management Subsystem</td>
<td>Cards</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-Scanner</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-115</td>
<td>The heads of Federal departments and agencies may approve other
identity proofing, registration, issuance process sets that are
accredited as satisfying the requisite PIV-I objectives and
requirements.</td>
<td>5.3.1/39</td>
<td>PIV Card Issuance</td>
<td>Identity Proofing &amp; Registration</td>
<td>Card Issuance and Management Subsystem</td>
<td>Cards</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-116</td>
<td>The card issuer shall verify that the employee remains in good
standing and personnel records are current before renewing the card and
associated credentials. When renewing identity credentials to current
employees, the NACI checks shall be followed in accordance with the OPM
guidance.</td>
<td>5.3.2/39</td>
<td>PIV Card Maintenance</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>-Card Issuer</p>
<p>-NACI check</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-117</td>
<td>The data and credentials held by the PIV Card may need to be
invalidated prior to the expiration date of the card. The cardholder may
retire, change jobs, or the employment is terminated, thus requiring
invalidation of a previously active card. The card may be damaged, lost,
or stolen, thus requiring a replacement. The PIV system must ensure that
this information is distributed efficiently within the PIV management
infrastructure and made available to parties authenticating a
cardholder. In this regard, procedures for PIV Card maintenance must be
integrated into department and agency procedures to ensure effective
card management.</td>
<td>5.3.2/39</td>
<td>PIV Card Maintenance</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-118</td>
<td>The PIV Card shall be valid for no more than five years.</td>
<td>5.3.2.1/39</td>
<td>PIV Card Renewal</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Card</td>
<td><p>Component</p>
<p>- PIV Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-119</td>
<td>A cardholder shall be allowed to apply for a renewal starting six
weeks prior to the expiration of a valid PIV Card and until the actual
expiration of the card.</td>
<td>5.3.2.1/39</td>
<td>PIV Card Renewal</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-120</td>
<td>The card issuer will verify the cardholder’s identity against the
biometric information stored on the expiring card.</td>
<td>5.3.2.1/39</td>
<td>PIV Card Renewal</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-121</td>
<td>The expired PIV Card must be collected and destroyed.</td>
<td>5.3.2.1/39</td>
<td>PIV Card Renewal</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-122m</td>
<td>The same biometric data may be reused with the new PIV Card while
the digital signature must be recomputed with the new FASC-N.</td>
<td>5.3.2.1/39</td>
<td>PIV Card Renewal</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-123</td>
<td>The expiration date of the PIV authentication certificate and
optional digital signature certificate cannot be later than the
expiration date of the PIV Card. Hence, a new PIV authentication key and
certificate shall be generated.</td>
<td>5.3.2.1/39</td>
<td>PIV Card Renewal</td>
<td><p>Card Issuance &amp; Maintenance</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-124m</td>
<td>If the PIV Card supports the optional key management key, it may be
imported to the new PIV Card.</td>
<td>5.3.2.1/39</td>
<td>PIV Card Renewal</td>
<td><p>Card Issuance &amp; Maintenance</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-125</td>
<td>In case of reissuance, the entire registration and issuance process,
including fingerprint and facial image capture, shall be conducted.</td>
<td>5.3.2.2/40</td>
<td>PIV Card Reissuance</td>
<td><p>Card Issuance &amp; Maintenance</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-PKI</p>
<p>-Issuance Scanner</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-126</td>
<td>The card issuer shall verify that the employee remains in good
standing and personnel records are current before reissuing the card and
associated credentials.</td>
<td>5.3.2.2/40</td>
<td>PIV Card Reissuance</td>
<td>Card Issuance &amp; Maintenance</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-127</td>
<td>The PIV system must ensure that this information is distributed
efficiently within the PIV management infrastructure and made available
to parties authenticating a cardholder.</td>
<td>5.3.2.2/40</td>
<td>PIV Card Reissuance</td>
<td><p>Card Issuance &amp; Maintenance</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-128</td>
<td>It is recommended that the old PIV Card, if available, is collected
and destroyed. If the card cannot be collected, normal operational
procedures shall complete within 18 hours of notification. In some
cases, 18 hours is an unacceptable delay. In that case, emergency
procedures must be executed to disseminate this information as rapidly
as possible. Departments and agencies are required to have procedures in
place to issue emergency notifications in such cases.</td>
<td>5.3.2.2/40</td>
<td>PIV Card Reissuance</td>
<td><p>Card Issuance &amp; Maintenance</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-129</td>
<td><p>A cardholder shall apply for reissuance of a new PIV Card if the
old PIV Card has been compromised, lost, stolen, or damaged. The
cardholder can also apply for reissuance of a valid PIV Card in the
event of an employee status or attribute change or if one or more
logical credentials have been compromised. When these events are
reported, normal operational procedures must be in place to ensure the
following:</p>
<p>+ The PIV Card itself is revoked. Any local databases that indicate
current valid (or invalid) FASC-N values must be updated to reflect the
change in status.</p>
<p>+ The CA shall be informed and the certificate corresponding to PIV
authentication key on the PIV Card must be revoked. Departments and
agencies may revoke certificates corresponding to the optional digital
signature and key management keys. Certificate revocation lists (CRL)
issued shall include the appropriate certificate serial numbers.</p>
<p>+ Online Certificate Status Protocol (OCSP) responders shall be
updated so that queries with respect to certificates on the PIV Card are
answered appropriately. This may be performed indirectly (by publishing
the CRL above) or directly (by updating the OCSP server’s internal
revocation records).</p></td>
<td>5.3.2.2/40</td>
<td>PIV Card Reissuance</td>
<td><p>Card Issuance &amp; Maintenance</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PIV Card</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-130</td>
<td>Before the reset PIV Card is provided back to the cardholder, the
card issuer shall ensure that the cardholder’s biometric matches the
stored biometric on the reset PIV Card.</td>
<td>5.3.2.3/40</td>
<td>PIV Card PIN Reset</td>
<td><p>Biometric Reader</p>
<p>PIN Input Device</p>
<p>Card Issuance &amp; Maintenance</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-Pin Reader</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-131m</td>
<td>The PIN on a PIV Card may need to be reset if the contents of the
card are locked resulting from the usage of an invalid PIN more than the
allowed number of retries stipulated by the department or agency. PIN
resets may be performed by the card issuer.</td>
<td>5.3.2.3/40</td>
<td>PIV Card PIN Reset</td>
<td><p>PIN Input Device</p>
<p>Card Issuance &amp; Maintenance</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Pin Reader</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-132</td>
<td><p>The termination process is used to permanently destroy or
invalidate the use of the card, including the data and the keys on it,
such that it cannot be used again. The PIV Card shall be terminated
under the following circumstances:</p>
<p>+ An employee separates (voluntarily or involuntarily) from Federal
service</p>
<p>+ An employee separates (voluntarily or involuntarily) from a Federal
contractor</p>
<p>+ A contractor changes positions and no longer needs access to
Federal buildings or systems</p>
<p>+ A cardholder is determined to hold a fraudulent identity</p>
<p>+ A cardholder passes away.</p></td>
<td>5.3.2.4/41</td>
<td>PIV Card Termination</td>
<td>PIV System</td>
<td>Card Issuance and Management Subsystem</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-133</td>
<td><p>Similar to the situation in which the card or a credential is
compromised, normal termination procedures must be in place as to ensure
the following:</p>
<p>+ The PIV Card is collected and destroyed.</p>
<p>+ The PIV Card itself is revoked. Any local databases that indicate
current valid (or invalid) FASC-N values must be updated to reflect the
change in status.</p>
<p>+ The CA shall be informed and the certificate corresponding to PIV
authentication key on the PIV Card must be revoked. Departments and
agencies may revoke certificates corresponding to the optional digital
signature and key management keys. CRLs issued shall include the
appropriate certificate serial numbers.</p>
<p>+ OCSP responders shall be updated so that queries with respect to
certificates on the PIV Card are answered appropriately. This may be
performed indirectly (by publishing the CRL above) or directly (by
updating the OCSP server’s internal revocation records).</p>
<p>+ The IIF that has been collected from the cardholder is disposed of
in accordance with the stated privacy and data retention policies of the
department or agency.</p></td>
<td>5.3.2.4/41</td>
<td>PIV Card Termination</td>
<td><p>PIV System</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-PIV System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-134</td>
<td>The CA that issues certificates to support PIV Card authentication
shall participate in the hierarchical PKI for the Common Policy managed
by the Federal PKI.</td>
<td>5.4.1/41</td>
<td>Architecture</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-135</td>
<td>Self-signed, self-issued, and CA certificates issued by these CAs
shall conform to Worksheet 1: Self-Signed Certificate Profile, Worksheet
2: Self-Issued CA Certificate Profile, and Worksheet 3: Cross
Certificate Profile, respectively, in X.509 Certificate and CRL Profile
for the Common Policy [PROF].</td>
<td>5.4.1/41</td>
<td>Architecture</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>-Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-136</td>
<td>All certificates issued to support PIV Card authentication shall be
issued under the id-CommonHW policy and the id-CommonAuth policy as
defined in the X.509 Certificate Policy for the U.S. Federal PKI Common
Policy Framework [COMMON].</td>
<td>5.4.2/41</td>
<td>PKI Certificate</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>-Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-137</td>
<td>CAs and registration authorities may be operated by departments and
agencies, or outsourced to PKI service providers.</td>
<td>5.4.2/41</td>
<td>PKI Certificate</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>-Card</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-138</td>
<td>[COMMON] requires FIPS 140-2 Level 2 validation for the subscriber
cryptomodule (i.e., the PIV Card).</td>
<td>5.4.2/41</td>
<td>PKI Certificate</td>
<td>PIV Card</td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-139</td>
<td>In addition, this standard requires the cardholder to authenticate
to the PIV Card each time it performs a private key computation with the
digital signature key.</td>
<td>5.4.2/42</td>
<td>PKI Certificate</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td><p>Front-End</p>
<p>Card Issuance and Management Subsystem</p></td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>- Pin Reader</p>
<p>-Desktop</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-140</td>
<td>[COMMON] specifies the use of RSA along with the key sizes and hash
functions.</td>
<td>5.4.2/42</td>
<td>PKI Certificate</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td><p>Front-End</p>
<p>Card Issuance and Management Subsystem</p></td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>- Pin Reader</p>
<p>-Desktop</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-141</td>
<td>This standard allows additional cryptographic algorithms and key
sizes as specified in the [SP 800-78]. Future enhancements to [COMMON]
are expected to permit use of additional algorithms. For conformance to
this standard, PIV Card management systems are limited to algorithms and
key sizes recognized by this standard and the current version of
[COMMON].</td>
<td>5.4.2/42</td>
<td>PKI Certificate</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td><p>Front-End</p>
<p>Card Issuance and Management Subsystem</p></td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>- Pin Reader</p>
<p>-Desktop</p>
<p>-PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-142</td>
<td><p>The required contents of X.509 certificates associated with PIV
private keys are based on [PROF]. The relationship is described
below:</p>
<p>+ Authority Information Access (AIA) extensions shall include
pointers to the appropriate OCSP status responders, using the id-ad-ocsp
access method as specified in Section 8 of [PROF], in addition to the
Lightweight Directory Access Protocol (LDAP) Uniform Resource
Identifiers (URI) required by [PROF].</p>
<p>+ If private key computations can be performed with the PIV
authentication key without user intervention (beyond that required for
cryptomodule activation), the corresponding certificate must specify the
policy id-CommonAuth instead of id-CommonHW in the certificate policies
extension.</p>
<p>+ Certificates containing the public key associated with an
asymmetric Card Authentication Key must specify the policy id-CommonAuth
instead of id-CommonHW in the certificate policies extension and must
assert id-PIV-cardAuth in the extended key usage extension.</p>
<p>+ Certificates containing the public key associated with a digital
signature private key shall conform to Worksheet 5: End Entity Signature
Certificate Profile in [PROF].</p>
<p>+ Certificates containing the public key associated with a PIV
authentication private key shall conform to Worksheet 5: End Entity
Signature Certificate Profile in [PROF], but shall not assert the
nonRepudiation bit in the keyUsage extension and must include the PIV
Card’s FASC-N in the subject alternative name field.</p>
<p>+ Certificates containing the public key associated with a key
management private key shall conform to Worksheet 6: Key Management
Certificate Profile in [PROF].</p>
<p>+ Requirements for algorithms and key sizes for each type of PIV
asymmetric key are given in [SP800-78].</p></td>
<td>5.4.2/42</td>
<td>PKI Certificate</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td><p>Front-End</p>
<p>Card Issuance and Management Subsystem</p></td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>- PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-143</td>
<td>CAs that issue certificates corresponding to PIV private keys shall
issue CRLs every 18 hours, at a minimum. The contents of X.509 CRLs
shall conform to Worksheet 4: CRL Profile in [PROF].</td>
<td>5.4.3/43</td>
<td>X.509 CRL Contents</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td><p>Front-End</p>
<p>Card Issuance and Management Subsystem</p></td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>- PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-144</td>
<td>Departments and agencies whose PKIs have cross-certified with the
Federal Bridge CA (FBCA) at Medium-HW, or High Assurance Level may
continue to assert department or agency-specific policy Object
Identifiers (OID). Certificates issued on or after January 1, 2008 shall
assert the id-CommonHW or id-CommonAuth policy OIDs. (Departments and
agencies may continue to assert department or agency-specific policy
OIDs in addition to the id-CommonHW and id-CommonAuth policy OIDs in
certificates issued after January 1, 2008.)</td>
<td>5.4.4/43</td>
<td>Migration from Legacy PKIs</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>- PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-145</td>
<td>The expiration date of the authentication certificate shall not be
after the expiration date of the PIV Card. If the card is revoked, the
authentication certificate shall be revoked. However, an authentication
certificate (and its associated key pair) may be revoked without
revoking the PIV Card and may then be replaced. The presence of a valid,
unexpired, and unrevoked PIV authentication certificate on a card is
proof that the card was issued and is not revoked.</td>
<td>5.4.5/43</td>
<td><p>PKI Repository and OCSP Responder(s)</p>
<p>PIV Card</p></td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>Card</td>
<td><p>Component</p>
<p>- PKI</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-146</td>
<td>CAs that issue PIV authentication certificates shall maintain a LDAP
directory server that holds the CRLs for the certificates it issues, as
well as any CA certificates needed to build a path to the Federal Bridge
CA.</td>
<td>5.4.5/43</td>
<td>PKI Repository and OCSP Responder(s)</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>- PKI (LDAP Server)</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-147</td>
<td>Certificates shall contain the crlDistributionPoints or
authorityInfoAccess extensions needed to locate CRLs and the
authoritative OCSP responder.</td>
<td>5.4.5/43</td>
<td>PKI Repository and OCSP Responder(s)</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>- PKI</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-148</td>
<td>In addition, every CA that issues PIV authentication certificates
shall operate an OCSP server that provides certificate status for every
authentication certificate the CA issues.</td>
<td>5.4.5/43</td>
<td>PKI Repository and OCSP Responder(s)</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>- PKI</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-149</td>
<td>This standard requires distribution of CA certificates and CRLs
using LDAP and Hypertext Transport Protocol (HTTP). Specific
requirements are found in Table II—Mandatory Repository Service
Lightweight Directory Access Protocol (LDAP) Access Requirements of the
Shared Service Provider Repository Service Requirements [SSP REP].</td>
<td>5.4.5.1/43</td>
<td>Certificate and CRL Distribution</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>- PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-150</td>
<td>PIV Authentication certificates contain the FASC-N in the subject
alternative name extension; hence, these certificates shall not be
distributed publicly via LDAP or HTTP.</td>
<td>5.4.5.1/43</td>
<td>Certificate and CRL Distribution</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>- PKI</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-151</td>
<td>When user certificates are distributed, the requirements in Table
I—End-Entity Certificate Repository Service Requirements of [SSP REP]
shall be satisfied.</td>
<td>5.4.5.1/43</td>
<td>Certificate and CRL Distribution</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Card Issuance and Management Subsystem</td>
<td>PKI</td>
<td><p>Component</p>
<p>- PKI</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-152</td>
<td>OCSP [RFC2560] status responders shall be implemented as a
supplementary certificate status mechanism.</td>
<td>5.4.5.2/44</td>
<td>OCSP Status Responders</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-153</td>
<td>The OCSP status responders must be updated at least as frequently as
CRLs are issued.</td>
<td>5.4.5.2/44</td>
<td>OCSP Status Responders</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PKI</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-154</td>
<td>The definitive OCSP responder for each certificate shall be
specified in the AIA extension as described in [PROF].</td>
<td>5.4.5.2/44</td>
<td>OCSP Status Responders</td>
<td>PKI Directory &amp; Certificate Status Responder</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>- PKI</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-155</td>
<td>The PIV Privacy Requirements stated in Section 2.4 apply equally to
PIV-II implementations.</td>
<td>5.5/44</td>
<td>PIV Privacy Requirements</td>
<td>PIV System</td>
<td>Card Issuance and Management Subsystem</td>
<td>Process</td>
<td><p>Component</p>
<p>-PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-156</td>
<td>Visual authentication of a PIV cardholder shall be used only to
support access control to physical facilities and resources.</td>
<td>6.2.1/46</td>
<td>Authentication Using PIV Visual Credentials (VIS)</td>
<td><p>PIV Card</p>
<p>Biometric Reader</p></td>
<td>Front-End</td>
<td>Process</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-Pin Reader</p>
<p>-Host System</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-157</td>
<td><p>The PIV Card has several mandatory topographical features on the
front and back that support visual identification and authentication, as
follows:</p>
<p>+ Photograph</p>
<p>+ Name</p>
<p>+ Employee affiliation employment identifier</p>
<p>+ Expiration date</p>
<p>+ Agency card serial number (back of card)</p>
<p>+ Issuer identification (back of card).</p></td>
<td>6.2.1/46</td>
<td>Authentication Using PIV Visual Credentials (VIS)</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Process</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>2-158</td>
<td><p>When a cardholder attempts to pass through an access control
point for a Federally controlled facility, a human guard shall perform
visual identity verification of the cardholder, and determine whether
the identified individual should be allowed through the control point.
The series of steps that shall be applied in the visual authentication
process are as follows:</p>
<p>1. The human guard at the access control entry point determines
whether the PIV Card appears to be genuine and has not been altered in
any way.</p>
<p>2. The guard compares the cardholder’s facial features with the
picture on the card to ensure that they match.</p>
<p>3. The guard checks the expiration date on the card to ensure that
the card has not expired.</p>
<p>4. The guard compares the cardholder’s physical characteristic
descriptions to those of the cardholder. (Optional)</p>
<p>5. The guard collects the cardholder’s signature and compares it with
the signature on the card. (Optional)</p>
<p>6. One or more of the other data elements on the card (e.g., name,
employee affiliation employment identifier, agency card serial number,
issuer identification, agency name) are used to determine whether the
cardholder should be granted access.</p></td>
<td>6.2.1/46</td>
<td>Authentication Using PIV Visual Credentials (VIS)</td>
<td>PIV Card</td>
<td>Front-End</td>
<td>Process</td>
<td><p>Component</p>
<p>-Card</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>2-159</td>
<td><p>The CHUID shall be used for PIV cardholder authentication using
the following sequence:</p>
<p>1. The CHUID is read electronically from the PIV Card.</p>
<p>2. The digital signature on the CHUID is checked to ensure the CHUID
was signed by a trusted source and is unaltered. (Optional)</p>
<p>3. The expiration date is checked to ensure that the card has not
expired.</p>
<p>4. One or more of the CHUID data elements (e.g., FASC-N, Agency Code,
Data Universal Numbering System [DUNS]) are used as input to the
authorization check to determine whether the cardholder should be
granted access.</p></td>
<td>6.2.2/48</td>
<td>Authentication Using the PIV CHUID</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Host System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-160</td>
<td><p>The following sequence shall be followed for unattended
authentication of the PIV biometric:</p>
<p>1. The CHUID is read from the card.</p>
<p>2. The Expiration Date in the CHUID is checked to ensure the card has
not expired.</p>
<p>3. The cardholder is prompted to submit a PIN, activating the PIV
Card.</p>
<p>4. The PIV biometric is read from the card.</p>
<p>5. The signature on the biometric is verified to ensure the biometric
is intact and comes from a trusted source. (Optional)</p>
<p>6. The cardholder is prompted to submit a live biometric sample.</p>
<p>7. If the biometric sample matches the biometric read from the card,
the cardholder is authenticated to be the owner of the card.</p>
<p>8. The FASC-N in the CHUID is compared with the FASC-N in the Signed
Attributes field of the external digital signature on the biometric.</p>
<p>9. One or more of the CHUID data elements (e.g., FASC-N, Agency Code,
DUNS) are used as input to the authorization check to determine whether
the cardholder should be granted access.</p></td>
<td>6.2.3.1/48</td>
<td>Unattended Authentication Using PIV Biometric (BIO)</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-PIN Reader</p>
<p>-Host System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-161</td>
<td><p>The following sequence shall be followed for attended
authentication of the PIV biometric:</p>
<p>1. The CHUID is read from the card.</p>
<p>2. The Expiration Date in the CHUID is checked to ensure that the
card has not expired.</p>
<p>3. The cardholder is prompted to submit a PIN. The PIN entry is done
in the view of an attendant.</p>
<p>4. The submitted PIN is used to activate the card. The PIV biometric
is read from the card.</p>
<p>5. The signature on the biometric is verified to ensure the biometric
is intact and comes from a trusted source. (Optional)</p>
<p>6. The cardholder is prompted to submit a live biometric sample. The
biometric sample is submitted in the view of an attendant.</p>
<p>7. If the biometric sample matches the biometric read from the card,
the cardholder is authenticated to be the owner of the card.</p>
<p>8. The FASC-N in the CHUID is compared with the FASC-N in the Signed
Attributes field of the external digital signature on the biometric.</p>
<p>9. One or more of the CHUID data elements (e.g., FASC-N, Agency Code,
DUNS) are used as input to the authorization check to determine whether
the cardholder should be granted access.</p>
<p>This authentication mechanism is similar to the unattended biometric
credential check; the only difference is that an attendant (e.g.
security guard) supervises the use of the PIV Card and the submission of
the PIN and the biometric by the cardholder.</p></td>
<td>6.2.3.1/48</td>
<td>Attended Authentication Using PIV Biometric (BIO)</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-PIN Reader</p>
<p>-Host System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-162</td>
<td><p>The PIV Card carries a mandatory asymmetric authentication
private key and corresponding certificate, as described in Section 4.
The following steps shall be used to perform authentication using the
PIV asymmetric authentication key: 1. The cardholder is prompted to
submit a PIN.</p>
<p>2. The submitted PIN is used to activate the card.</p>
<p>3. The reader issues a challenge string to the card and requests an
asymmetric operation in response.</p>
<p>4. The card responds to the previously issued challenge by signing it
using the PIV authentication private key and attaching the associated
certificate.</p>
<p>5. The response signature is verified and standards-compliant PKI
path validation is conducted. The related digital certificate is checked
to ensure that it is from a trusted source. The revocation status of the
certificate is checked to ensure current validity.</p>
<p>6. The response is validated as the expected response to the issued
challenge.</p>
<p>7. The Subject Distinguished Name (DN) and FASC-N from the
authentication certificate are extracted and passed as input to the
authorization function.</p></td>
<td>6.2.3.1/49</td>
<td>Attended Authentication Using PIV Biometric (BIO)</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-PIN Reader</p>
<p>-Host System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-163m</td>
<td>The PIV Card can be used to authenticate the cardholder in a
physical access control environment.</td>
<td>6.3.1/50</td>
<td>Physical Access</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-PIN Reader</p>
<p>-Host System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-164</td>
<td>It is implicit that an authentication mechanism <em>(Physical
access)</em> that is suitable for a higher assurance level can also be
applied to meet the requirements for a lower assurance level.</td>
<td>6.3.1/50</td>
<td>Physical Access</td>
<td>PIV System</td>
<td>Front-End</td>
<td>PIV System</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-165m</td>
<td>Each authentication mechanism described in the table can be further
strengthened through the use of a back-end certificate status
verification infrastructure, if the access control point has
connectivity to the department or agency’s network infrastructure.</td>
<td>6.3.1/50</td>
<td>Physical Access</td>
<td>PIV System</td>
<td>Front-End</td>
<td>PIV System</td>
<td><p>Component</p>
<p>- PIV System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-166</td>
<td>The PIV Card may be used to authenticate the cardholder in support
of decisions concerning access to logical information resources.</td>
<td>6.3.2/51</td>
<td>Logical Access</td>
<td><p>PIV Card</p>
<p>PKI Directory &amp; Certificate Status Responder</p></td>
<td>Front-End</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Biometric Reader</p>
<p>-PIN Reader</p>
<p>-Host System</p>
<p>-PKI</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-167</td>
<td>It is implicit that an authentication mechanism <em>(Logical
access)</em> that is suitable for a higher assurance level can also be
applied to meet the requirements for a lower assurance level.</td>
<td>6.3.2/51</td>
<td>Logical Access</td>
<td>PIV System</td>
<td>Front-End</td>
<td>PIV System</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>2-168</td>
<td>Funding permitting, NIST will establish detailed criteria that PIV
Card issues must meet for accreditation. Additionally, NIST will (again,
funding permitting) establish a government-wide program to accredit
official issuers of PIV Cards against these accreditation criteria.
Until such time as these are completed, agencies must self-certify their
own issuers of PIV Cards.</td>
<td>B.1/64</td>
<td>Accreditation of PIV Service Providers</td>
<td>PIV System</td>
<td>Front-End</td>
<td>PIV System</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="odd">
<td>2-169</td>
<td>In order to accomplish the accreditation of PIV service providers as
described above, and to be compliant with the provisions of OMB Circular
A-130, App. III, the IT system(s) used by PIV service providers must
also be certified in accordance with NIST SP 800-37, Guide for the
Security Certification and Accreditation of Federal Information
Systems.</td>
<td>B.2/64</td>
<td>C&amp;A of PIV service Providers</td>
<td>PIV System</td>
<td>Front-End</td>
<td>PIV System</td>
<td><p>Component</p>
<p>- PIV System</p></td>
<td>G</td>
<td></td>
</tr>
<tr class="even">
<td>3-1</td>
<td>The contact interface of the PIV Card shall not require a
Programming Voltage to operate correctly.</td>
<td>Interop. Reqs. 2.1.1.1</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-2</td>
<td>The contact interface of the PIV Card shall support the Class A
operating class as defined in ISO/IEC 7816-3:1997 and ISO/IEC
7816-3:1997/Amd 1:2002</td>
<td>Interop. Reqs. 2.1.1.2</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-3</td>
<td>At a minimum, the contact interface of the PIV Card shall support
either the T=0 or T=1 transmission protocol as defined in ISO/IEC
7816-3:1997. The card may support both protocols</td>
<td>Interop. Reqs. 2.1.1.3</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-4</td>
<td>PIV Cards shall not require the use of any RFU bits in the Global or
Specific Interface Bytes to operate correctly.</td>
<td>Interop. Reqs. 2.1.1.4</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-5</td>
<td>The contactless interface of the reader shall support both the Type
A and Type B communication signal interfaces as defined in ISO/IEC
14443-2:2001</td>
<td>Interop. Reqs. 2.2.1.1</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-6</td>
<td>The contactless interface of the reader shall support both Type A
and Type B initialization and anti-collision methods as defined in
ISO/IEC 14443-3:2001</td>
<td>Interop. Reqs. 2.2.1.2</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-7</td>
<td>The contactless interface of the reader shall support both Type A
and Type B transmission protocols as defined in ISO/IEC
14443-4:2001</td>
<td>Interop. Reqs. 2.2.1.3</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-8</td>
<td>PIV Readers shall not generate a Programming Voltage.</td>
<td>Interop. Reqs. 2.2.2.1</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-9</td>
<td>PIV readers shall support the Class A operating class as defined in
ISO/IEC 7816-3:1997 and ISO/IEC 7816-3:1997/Amd 1:2002.</td>
<td>Interop. Reqs. 2.2.2.2</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-10</td>
<td>The contact interface of the reader shall support both the T=0 and
T=1 transmission protocols as defined in ISO/IEC 7816-3:1997</td>
<td>Interop. Reqs. 2.2.2.3</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-11</td>
<td>PIV Readers shall support implicit protocol and parameter selections
as defined in ISO/IEC 7816-3:1997</td>
<td>Interop. Reqs. 2.2.2.4</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-12</td>
<td><p>The reader-to-host interface for physical access control readers
shall conform with one of the following standards:</p>
<ul>
<li><p>Ethernet as defined in IEEE 802.3-2005, Standard for Information
Technology-Telecommunications and Information Exchange Between
Systems</p></li>
<li><p>RS-232 as defined in TIA-232, Interface Between Data Terminal
Equipment and Data Circuit-Terminating Equipment Employing Serial Binary
Data Interchange</p></li>
<li><p>RS-485 as defined in TIA-485, Electrical Characteristics of
Generators and Receivers For Use in Balanced Digital Multipoint
Systems</p></li>
<li><p>Wiegand™ as defined in sections 3 and 4 of the SIA Access Control
Standard Protocol for the 26-BIT Wiegand™ Reader Interface</p></li>
</ul></td>
<td>Interop. Reqs. 2.2.3.1 through 2.2.3.4</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Physical Access Control</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-13</td>
<td>Physical access control readers shall read the Agency Code, System
Code and Credential Code elements of the FASC-N along with the
Expiration Date (YYYYMMDD) from the CHUID as defined by appendix A of
NIST Special Publication 800-73. The reader shall output these four
elements as concatenated individual binary numbers Parity bits shall be
added to the beginning and end of the string providing a total length of
75 bits. The first bit transmitted is the first parity bit, P1, it is
even parity calculated over the first 37 code bits. The last bit
transmitted is the second parity bit, P2, it is odd parity calculated
over the last 36 code bits.</td>
<td>Interop. Reqs. 2.2.3.5</td>
<td>Card / Reader Interoperability Requirements</td>
<td>PIV Reader</td>
<td>Physical Access Control</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-14</td>
<td>Retrieval time for 4 KB of data through the contactless interface of
the card shall not exceed 3.0 seconds.</td>
<td>Interop. Reqs. 3.1.1.1</td>
<td>Electronic Authentication Performance Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-15</td>
<td>Retrieval time for 22 KB of data through the contact interface of
the card shall not exceed 2.0 seconds</td>
<td>Interop. Reqs. 3.1.2.1</td>
<td>Electronic Authentication Performance Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-16</td>
<td>The reader buffer size shall be no less than 256 bytes</td>
<td>Interop. Reqs. 3.2.1</td>
<td>Electronic Authentication Performance Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-17</td>
<td>The contactless interface of the reader shall support bit rates of
fc/128 (~106 kbits/s), fc/64 (~212 kbits/s), fc/32 (~424 kbits/s) and
fc/16 (~847 kbits/s) as defined in ISO/IEC 14443-3:2001/Amd.1:2005</td>
<td>Interop. Reqs. 3.2.2.1</td>
<td>Electronic Authentication Performance Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-18</td>
<td>Retrieval time for 4 KB of data through the contactless interface of
the reader shall not exceed 3.0 seconds.</td>
<td>Interop. Reqs. 3.2.2.2</td>
<td>Electronic Authentication Performance Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-19</td>
<td>The PIV reader contact interface shall support the Protocol and
Parameters Selection (PPS) protocol as defined in ISO/IEC
7816-3:1997</td>
<td>Interop. Reqs. 3.2.3.1</td>
<td>Electronic Authentication Performance Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-20</td>
<td>Retrieval time for 22 KB of data through the contact interface of
the reader shall not exceed 2.0 seconds</td>
<td>Interop. Reqs. 3.2.3.2</td>
<td>Electronic Authentication Performance Requirements</td>
<td>PIV Reader</td>
<td>Card Issuance and Management</td>
<td>Reader</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="even">
<td>3-21</td>
<td>Buffers shall not be readable through the contactless interface when
the card is stored in an electromagnetically opaque sleeve at any
distance</td>
<td>Interop. Reqs. 4.1.1.1</td>
<td>Security Related Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
<tr class="odd">
<td>3-22</td>
<td>Buffers shall not be readable through the contactless interface more
than 10 cm from the reader</td>
<td>Interop. Reqs. 4.1.1.2</td>
<td>Security Related Requirements</td>
<td>PIV Card</td>
<td>Card Issuance and Management</td>
<td>Card</td>
<td><p>Component</p>
<p>-Card</p>
<p>-Reader</p></td>
<td>S</td>
<td></td>
</tr>
</tbody>
</table>