PKI/Smart Card

**Business Case**

**December, 2001**

**[Executive Summary]{.underline}**

According to the Gartner Group, large corporations spend \$200 billion
annually on processing paper, \$6 billion on printing and \$120 billion
for routing, faxing and filing. Implementation of the recently passed
Government Paperwork Elimination Act (GPEA) will significantly reduce
these extraordinary costs. GPEA is pushing Federal agencies into making
eCommerce a reality. To support this new environment, agencies are being
required to increase overall network security and provide information
assurance. Electronic authentication issues are leading many agencies to
consider Smart Cards coupled with PKI as a possible solution to the
security challenges presented by eCommerce.

This business case analyses the cost of implementing PKI and smart cards
housed with PKI credentials in the context of its investment worthiness.
Several bureau specific applications are used in the analysis. From a
financial perspective, the findings favor PKI and smart cards stored
with PKI credentials. For PKI alone, first year ROI's range from 719% to
82% with payback occurring in the first year.

PKI INVESTMENT ANALYSIS

+-----------------+-----------------+-----------------+-----------------+
| Bureau          | Cost Savings    | ROI             | Payback Period  |
|                 |                 |                 |                 |
|                 | Year 1          | Year 1          | Year 1          |
+-----------------+-----------------+-----------------+-----------------+
| Customs         | \$877,780       | 718%            | .05 year        |
+-----------------+-----------------+-----------------+-----------------+
| BEP             | \$80,250        | 47%             | .26 year        |
+-----------------+-----------------+-----------------+-----------------+
| BPD             | \$244,100       | 95%             | .16 year        |
+-----------------+-----------------+-----------------+-----------------+
| Mint            | \$153,520       | 159%            | .18 year        |
+-----------------+-----------------+-----------------+-----------------+

Smart Cards/PKI demonstrated similar returns. Since smart cards are
multi-functional, the smart card/PKI financial analysis examined
multiple applications. The findings are illustrated in the following
table. First year savings are \$2.4 million with a 119% ROI. In
subsequent years, savings are \$3.8 million with a 669% ROI.

SMART CARDS/PKI FINANCIAL ANALYSIS

  ---------------- --------------------- --------------------------------
                   First Year            Subsequent Years

  Investment       \$2,022,277           \$575,566

  Savings          \$2,405,807           \$3,852,518

  ROI              119%                  669%

  Payback          .84/year              .15/year
  ---------------- --------------------- --------------------------------

In light of these findings, the Treasury Smart Card Manager's Forum is
requesting \$1.2 million to conduct several smart card pilots. PKI
credentials will be stored on the smart card. The goal of this group is
to standardize smart card technology across the Department, identify
best practices for Treasury applications and develop procedures and
policies. These pilots will benchmark smart card technology against core
Treasury applications, e.g., physical access with identification,
logical access and inventory management.

# **1. Background**

A public-key infrastructure (PKI) will permit Treasury to use public key
cryptography to enable security services that provide authentication,
non-disclosure, and non-repudiation. Digital certificates enable
business to share electronic correspondence in a manner that is
trustworthy and secure. A Treasury PKI will lead to better services at a
lower cost through the ability to process more sensitive data in shared
networks, the automation of sensitive functions previously kept
off-line, and the use of the Internet for business purposes. A PKI
transparently manages keys and certificates enabling an organization to
create and use a trustworthy networking environment. A trusted network
permits organizations to take advantage of the following benefits:

1.  Confidential communication -- ensures only intended recipients are
    able to read files. Files cannot be intercepted.

2.  Authentication -- validates the creation of a file by the sender.
    Recipients need to know the sender created the file.

3.  Non-repudiation -- prevents the sender from denying involvement in
    the creation of a file.

4.  Integrity -- guarantees the file was not altered during
    transmission.

As an infrastructure, PKI comprises:

1.  Certificate Authorities (CA),

2.  Registration Authorities (RA),

3.  PKI enabled applications, policies and procedures,

4.  Certificate management services, and directories that provide
    security features such as message integrity, key recovery, data
    privacy, signature verification and user authentication.

> Each public key is made public in the form of a digital certificate
> where a trusted party, a CA, cryptographically binds the public key to
> one's identity by digitally signing the certificate, thus ensuring any
> attempts to alter the data will be detected.

A CA manages the following:

1.  The certificate life cycle

2.  Key revocation when a private key may have been lost, stolen or made
    public

3.  Notice as to which key pairs have been revoked.

Registration Authorities (RA) register subscribers into a particular
CA's domain. Directories are established that contain the public
encryption keys and certificates that are used in verifying digital
certificates, credentials, and encryption.

# **2. How Will PKI be used by the Treasury Department**

All Treasury employees will likely need a PKI to support daily
activities. The rest of the Federal Government and the commercial sector
will use PKI services as well. PKI plays a critical role in networked
environments where transactions occur over unsecured channels.
Confidentiality and integrity (including digital signature) can be
provided by cryptography, and those cryptographic mechanisms need the
support of a PKI. PKI will be a critical component in electronic
commerce. It will be the enabling technology for GPEA (Government
Paperwork Elimination Act.)

Some potential uses of PKI include:

-   Identification and authentication for purposes of gaining remote
    access to computers and other resources (instead of passwords)

-   Securing financial transactions

-   Single network sign-on

-   Identification Cards and Physical Access Control Systems

-   Secure messaging with confidentiality and integrity of data
    transmitted

-   Secure client-server transactions via the Secure Sockets Layer (SSL)
    protocol

-   Software (code) signing to ensure the authenticity and integrity of
    software obtained

Treasury Department programs that have identified a need for PKI
services include:

1.  HR Connect, the Treasury-wide human resource system. HR Connect will
    use PKI for user authentication to the Treasury network for remote
    access.

2.  Treasury's Procurement offices will use PKI to authenticate
    themselves to GSA's network for the purpose of downloading vendor
    quotations.

3.  The Bureau of Public Debt (BPD) is using PKI with its online sales
    of State & local government securities. PKI is used for
    authentication and encryption.

4.  TIGTA is using PKI for remote access to the Treasury network for all
    of its 1,000 employees.

5.  US Customs Service intends to use PKI to authenticate electronic
    transmissions from its importing community.

6.  Office of Comptroller of the Currency is using PKI with the banking
    community for online transactions.

7.  Financial Management Service (FMS) will be using PKI with financial
    institutions for online transactions.

8.  Bureau of Engraving and Printing has purchased 2,500 PKI licenses to
    enable a secure internal workflow environment using jet forms, which
    is PKI enabled.

9.  The US Mint also intends to use PKI to secure its internal workflow
    environment.

10. Departmental Offices will use PKI to transmit information to the
    Federal Reserve.

11. Departmental Offices will use PKI for single sign-on.

12. PKI is required for a proposed Treasury enterprise Travel service.

# **3. Treasury Enterprise PKI Activities** 

In December 2000, Treasury awarded an enterprise PKI license to Entrust.
Entrust is one of the leading PKI providers. Entrust's selection was
based on the following:

1.  Its product is FIPS 140-1 certified

2.  The Entrust product configuration permits Treasury to maintain its
    root CA

3.  Several of the Treasury bureaus had purchased Entrust PKI licenses

4.  Entrust has a managed CA and directory service

Under the terms of the award, Treasury pays \$42.00 for each PKI
license. This is a one-time cost. It also pays an annual per license
maintenance/service fee of \$6.30.

In late March 2001, Treasury's Office of the CIO conducted an
enterprise-wide PKI pilot. The pilot application was secure email using
authentication and encryption. Treasury used Entrust's managed CA and
directory for the pilot. The pilot was successful and Treasury intends
to deploy an enterprise PKI infrastructure. .

# **4. PKI Investment Analysis**

There are several methods to calculate the financial impact of an
investment, e.g., cost avoidance, return on investment (ROI) and payback
period. Cost savings are reductions in costs compared to those resources
actually budgeted. Realized cost savings are available for reallocation
to other activities. Alternatively, cost avoidance is reduction in costs
that were not budgeted therefore; the computed savings are not available
for reallocation. ROI is the return on invested capital and/or the
return on the incremental investment. Payback period is the time period
required to fully recover investment expenditures.

A PKI financial impact was performed using Treasury bureau
representative applications. Cost savings, ROI and payback period were
calculated by analyzing baseline costs against the PKI investment.
Baseline costs are the cost of conducting the same application without
PKI. These calculations are illustrated in Appendix 1.

1.  PKI will permit US Customs to save \$1 million annually by
    eliminating telecommunication costs it pays to receive electronic
    transmission from its trading community. Specifically, Customs pays
    the cost of electronic transmissions of Customs import/export
    declarations, and other commercial information it collects from its
    trading community. PKI will permit Customs to use the Internet for
    transport rather than 1800 dial-up numbers. Customs has about 1,800
    trading partners. **It will save \$953,380 annually** by using PKI.
    In years 2 and beyond the ROI is 2,045%. (See Figure 4.)

2.  Several bureaus (BEP, Mint) intend to use PKI to enable their
    internal workflow. PKI will provide the necessary security for BEP
    and the Mint to replace paper with their automated workflow systems.
    PKI will be used to authenticate the user, encrypt the data and to
    provide user non-repudiation. Without PKI, a dual system would be
    required to store the electronic signature in paper form. **In this
    case, PKI eliminates the cost of maintaining a duplicate system,
    essentially a 100% cost savings. (See Figures 7 & 8.)**

3.  BPD is using PKI for the online sale of securities to state and
    local governments. Absent PKI, **BPD could be forced to resort to a
    manual environment which could increase its costs as much as 86%.**
    The average cost of conducting business in a paper environment
    averages about \$50 per document.[^1] Greater efficiency is achieved
    via electronic transmissions. There are less input errors,
    significantly reduced processing and handling time and storage
    costs. Coupling PKI with electronic transmissions and the Internet
    reduces the per unit cost of processing a document to about \$7.00,
    an 86% reduction. (See Figure 6.)

4.  FMS intends to use PKI to transact business with financial
    institutions. Its savings will be similar to BPD's.

**5. Findings**

The following chart summarizes the PKI investment analysis on individual
bureau using specific application:

PKI INVESTMENT ANALYSIS

+-----------------+-----------------+-----------------+-----------------+
| Bureau          | Cost Savings    | ROI             | Payback Period  |
|                 |                 |                 |                 |
|                 | Year 1          | Year 1          | Year 1          |
+-----------------+-----------------+-----------------+-----------------+
| Customs         | \$877,780       | 718%            | .05 year        |
+-----------------+-----------------+-----------------+-----------------+
| BEP             | \$80,250        | 47%             | .26 year        |
+-----------------+-----------------+-----------------+-----------------+
| BPD             | \$244,100       | 95%             | .16 year        |
+-----------------+-----------------+-----------------+-----------------+
| Mint            | \$153,520       | 159%            | .18 year        |
+-----------------+-----------------+-----------------+-----------------+

5.  **PKI & Smart Cards**

PKI credentials can be implemented as a software or hardware token
(smart card). A hardware token, such as a smart card, is less likely to
be tampered with than software and thus provides additional security.
Additionally, smart cards are also multi-functional and can be used for
physical as well as logical access. Users can use a smart card for:

-   Identification

-   Physical access

-   Network login and access to secure applications, systems and
    processes

-   Financial transactions

-   Purchase items

-   Store user information

With these added features there are also additional hardware and
software costs.

[5.1. Background]{.underline}

Smart cards are credit-card-sized devices that carry an embedded
microprocessor and memory that can store and process information. When
inserted into a card reader, the smart card transfers data to and from
applications. It is more secure than a magnetic stripe card and can be
programmed to cease functioning if an incorrect password is entered more
times than the present limit. Smart cards have a wide range of
applications including electronic purse, logical and physical access
control, telecommunications, and transportation. Approximately, 700,000
smart cards have been issued within the Federal Government. Smart cards
can be integrated in both physical and logical access control systems. A
physical access control system is an automated system that controls an
individual's ability to access a physical location, such as a building,
parking lot, office or other designated physical space. A logical access
control system is an automated system that controls an individual's
ability to access one or more computer system resources, such as a
workstation, network, application, or database.

PKI/Smart cards offer an enhanced level of security because
public/private keys can be generated, stored, and used to make digital
signatures or encrypt data all on the card. This provides a much higher
level of security than non-PKI enabled smart cards that store keys on a
floppy disk or hard drive and are, therefore, more susceptible to
tampering, removal or duplication. Additionally, the portability of the
public/private key pair and digital certificates enables users to take
advantage of the benefits of PKI at any location where they are an
authorized user.

Treasury's PKI policy requires the use of smart cards for Assurance
Levels 3 and 4. Assurance level 3 will generally be the standard for
Treasury employees.

[5.2. Treasury Smart Card Activities]{.underline}

The now defunct Treasury Office of Business Innovations (OBI) began
exploring the use of smart cards in 1998. OBI conducted multiple
interviews across the bureaus and gathered data and information
pertaining to smart cards. The team also performed research of the best
smart card practices across the government and in the private sector.
During exploration, it was noted that several bureaus were already using
some form of smart card technology. There were also bureaus that
articulated high interest, but did not have the necessary funding to
pursue their interests. An early product and outcome of the
investigative efforts of OBI was the stand-up of a Treasury-wide Smart
Card Managers' Forum. This group is now chaired by Secret Service. The
goal of this group is to promote standardization of smart technologies
and applications across the bureaus. To achieve this goal, the group
proposes to conduct pilots using smart cards with various applications.
The US Secret Service, ATF and FLETC have expressed a willingness to
participate in the pilots.

Three core smart card pilot applications have been identified:

-   Physical access with identification using PKI and biometrics

-   Logical access

-   Inventory management.

[5.3. Smart Card Funding]{.underline}

The Treasury Smart Card Managers Forum is requesting \$1.4 million to
undertake several smart card pilots by three bureaus -- Secret Service,
ATF and FLETC. The proposed pilots and costs are detailed in Appendix
II.

[5.4. Smart Card Investment Analysis]{.underline}

Smart card technology can be used for logical and physical access. The
following table illustrates the per unit cost of deploying a smart card
with PKI for 6,000 users.

Cost of a Smart Card with PKI Implementation

+-----------------+------------+------------+-------------+----------+
| Item            | Cost       | Quantity   | Total       | Year2 &  |
|                 |            |            |             | Su       |
|                 |            |            | Year 1      | bsequent |
|                 |            |            |             | Years    |
+-----------------+------------+------------+-------------+----------+
| Smart Card      | \$20       | 6,000      | \$120,000   |          |
+-----------------+------------+------------+-------------+----------+
| Reader          | \$50       | 6,000      | \$300,000   |          |
+-----------------+------------+------------+-------------+----------+
| Client Software | \$100      | 6,000      | \$600,000   | \$90,000 |
+-----------------+------------+------------+-------------+----------+
| PKI             | \$42       | 6,000      | \$252,000   | \        |
|                 |            |            |             | $155,400 |
+-----------------+------------+------------+-------------+----------+
| Building Access | \$200      | 1,000      | \$200,000   |          |
| Reader          |            |            |             |          |
+-----------------+------------+------------+-------------+----------+
| System          | \$5        |            | \$550,277   | \$330    |
| Integration     | 50,277[^2] |            |             | ,166[^3] |
+-----------------+------------+------------+-------------+----------+
| Total Cost      |            |            | \$2,022,277 | \        |
|                 |            |            |             | $575,566 |
+-----------------+------------+------------+-------------+----------+

. Smart cards are multi-dimensional. One card is capable of supporting
multiple applications. The following table compares the cost of
performing various applications in a paper/manual format and an
electronic format using smart cards w/ PKI. The following assumptions
have been made in computing savings:

-   Total user population of 6,000

-   40 percent of total users request password resetting 3 times
    annually

-   1,200 banking transactions/year

-   30 percent of users file 6 vouchers/month

-   3,000 equipment/miscellaneous passes issued yearly

-   6,000 help desk requests annually

[Comparison of Cost of Typical Application in Manual versus Electronic
Mode]{.underline} [^4]

  -------------- -------------- -------------- ---------- ---------- -------------
  Application    Manual         Smart Cards    Savings    Quantity   Savings
                 Cost/unit                                           

  Single Sign-on \$23 average   No annual      \$23       7,200      \$165,600
  for multiple   cost to reset  recurring                            
  applications   passwords      costs                                
  [^5][^6]                                                           

  Average        \$1.50         \$0.18         \$1.32     1,200      \$1,584
  banking                                                            
  transaction                                                        

  Producing &    \$10           \$.10          \$9.90     3,000      \$29,700
  processing                                                         
  passes                                                             

  Help desk      \$18/ request  \$4            \$14       6,000      \$84,000
  requests[^7]                                                       

  Travel         \$36/voucher   \$4            \$32       129,600    \$4,147,200
  vouchers                                                           

  Total Savings                                                      \$4,428,084
  -------------- -------------- -------------- ---------- ---------- -------------

[5.5 Smart Cards/PKI Financial Analysis]{.underline}

Actual savings realized beginning in year 1 and subsequent years clearly
make a case for conducting multiple Treasury smart card pilots using
specific bureau applications. (Please see Appendix 2 for pilot details.)

  ---------------- --------------------- --------------------------------
                   First Year            Subsequent Years

  Investment       \$2,022,277           \$575,566

  Savings          \$2,405,807           \$3,852,518

  ROI              119%                  669%

  Payback          .84/year              .15/year
  ---------------- --------------------- --------------------------------

[6.0 Recommendations]{.underline}

-   The Treasury Smart Card Manager's Forum conduct the pilots outlined
    in Appendix 2.

-   Pilot evaluations are formally published and made available
    Treasury-wide.

-   The Treasury Smart Card Manager's Forum develop and publish Treasury
    smart card recommended guidelines and procedures.

-   The Treasury Smart Card Manager's Forum be recognized as a Treasury
    CIO Council working group.

**APPENDIX 1**

**Financial Calculations**

## [PKI Infrastructure Costs]{.underline}

Treasury PKI infrastructure costs are summarized in the following chart.
Please note these are enterprise-wide costs. These costs assume that
WorldCom/Digex will manage the Treasury operational CA. These costs are
independent of the number of users

Figure 1

  --------------------------- ------------------- -----------------------
  Item                        Annual Recurring    Non-Recurring Capital
                              Costs               Costs

  Treasury Root CA                                \$138,000

  Treasury Operational CA     \$600,000           \$171,000

  Annual Audit                \$60,000            

  PKI/X.500 Directory Costs   \$234,000           \$381,000

  C&A/Testing                                     \$151,000

  Integration Support                             \$100,000

  Connectivity/Firewalls                          \$ 90,000

  Total                       \$894,000           \$1,031,000
  --------------------------- ------------------- -----------------------

## [License Costs]{.underline}

PKI licenses are issued per seat. There is a one-time cost of \$42.00
per license and an annual maintenance fee of \$6.30 per license.

## [Infrastructure Cost]{.underline} 

## 

Annual recurring costs are \$894,000 irrespective of the number of
users. Conservatively, assuming 45,000 users, less than 50% of the
enterprise population, the annual per seat charge is \$19.60. The per
seat charge declines appreciably as the number of users increase. For
example, at 150,000 users the annual per seat cost is \$5.96.

## [Annual Bureau PKI Costs]{.underline}

Since Treasury is offering PKI as an enterprise service, Treasury
bureaus can choose to participate in the Treasury operational CA or
alternatively stand-up their own. Bureaus intend to use existing staff
to register employees for PKI. The license provides computer based
training.

Assuming a bureau with 1,000 PKI licenses participates in the Treasury
operational CA; its annual costs are:

Figure 2

  ----------------- ----------------- ----------------- -----------------
  Item              Quantity          Charge            Annual Cost

  Per license CA    1,000             \$19.60           \$19,600
  Fee                                                   

  Per License Fee   1,000             6.30              6,300

  Shared CA Cost                                        \$15,000

  Additional FTE    N/A                                 
  [^8]                                                  

  Total                                                 \$40,900
  ----------------- ----------------- ----------------- -----------------

.

Alternatively, if a bureau opts to establish its own CA, its annual
costs will be an additional \$55,000. Please note that the annual
license maintenance fee and CA service fee are dependent on number of
bureau licenses. It will also need to expend approximately \$170,000 in
capital start-up costs.

The financial impact of an investment is determined by comparing the
total cost of the alternative to the baseline (status quo). PKI is the
alternative being assessed. It is compared to the non-PKI environment
(baseline/status quo).

[Customs -- Use of the Internet for Secure Transport]{.underline}

Customs intends to use the Treasury operational CA. Therefore, Customs
will not incur capital expenditures related to establishing a PKI
infrastructure. **Customs PKI costs are**:

Figure 3

+-------------+-------------+-------------+-------------+-------------+
| Item        | Quantity    | Annual      | One-Time    | Total Cost  |
|             |             | Costs       |             |             |
+-------------+-------------+-------------+-------------+-------------+
| License     | 1,800       |             | \$75,600    | \$75,600    |
|             |             |             |             |             |
| \$42.00     |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| License     | 1,800       | \$11,340    |             | \$11,340    |
| Maint.Fee   |             |             |             |             |
|             |             |             |             |             |
| \$6.30      |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| CA Service  | 1,800       | \$35,280    |             | \$35,280    |
| Fee         |             |             |             |             |
|             |             |             |             |             |
| \$19.60     |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| Grand Total |             | \$46,620    | \$75,600    | [           |
|             |             |             |             | \$122,220]{ |
| Year 1      |             |             |             | .underline} |
+-------------+-------------+-------------+-------------+-------------+
| Subsequent  |             | \$46,620    |             | [\$46,620]{ |
| Years       |             |             |             | .underline} |
+-------------+-------------+-------------+-------------+-------------+

[Economic Impact Customs PKI Investment]{.underline}

Figure 4

+--------------+----------------+---------+----------+----------------+
| Baseline     | \$1,000,000    | Cost    | ROI      | Payback Period |
| Costs        |                | Savings |          |                |
+--------------+----------------+---------+----------+----------------+
| Year 1 PKI   | \$ 122,220     | \$      | 88%      | .12 year       |
| Costs        |                | 877,780 |          |                |
+--------------+----------------+---------+----------+----------------+
| Subsequent   | \$ 46,620      | \$      | 95%      | .05 year       |
| Years        |                | 953,380 |          |                |
|              |                |         |          |                |
| PKI Costs    |                |         |          |                |
+--------------+----------------+---------+----------+----------------+

[BEP/Mint/BPD Costs]{.underline}

BEP and the Mint will use PKI with certain specific applications to
transition to an automated workflow environment. \$40.00 is assumed as
the per unit cost of document processing in a manual workflow
environment.

BPD has established its own CA and will incur higher costs. BEP and the
Mint intend to use the Treasury CA. Their respective PKI costs are
detailed in the following table:

Figure 5

+-------------+-------------+-------------+-------------+-------------+
| Bureau      | Quantity    | Annual      | One-Time    | Total Cost  |
|             |             | Costs       |             |             |
+-------------+-------------+-------------+-------------+-------------+
| BEP \*      | 2,500       | \$ 64,750   | \$105,000   | \$169,750   |
+-------------+-------------+-------------+-------------+-------------+
| Mint        | 1,200       | \$ 46,080   | \$ 50,400   | \$ 96,480   |
+-------------+-------------+-------------+-------------+-------------+
| BPD\*\*     | 1,000       | \$ 80,900   | \$175,000   | \$255,900   |
+-------------+-------------+-------------+-------------+-------------+
| Grand Total |             | \$394,900   | \$455,000   | [           |
|             |             |             |             | \$849,900]{ |
| Year 1      |             |             |             | .underline} |
+-------------+-------------+-------------+-------------+-------------+
| Subsequent  |             | \$394,900   |             | [           |
| Years       |             |             |             | \$394,900]{ |
|             |             |             |             | .underline} |
+-------------+-------------+-------------+-------------+-------------+

\*Annual Costs = \$6.30/license maintenance fee

\$19.60/CA per user service fee

\*\* Annual Costs also include \$55,000 for operation of its CA

Economic Impact -- BPD Online Sales of Securities to State & Local
Governments

BPD's baseline costs represent the cost of processing the sale of these
securities in a manual environment. Given a \$50/document processing
costs, assuming 10,000 annual transactions, the baseline cost is
\$500,000.

Figure 6 BPD ANALYSIS

+--------------+----------------+---------+----------+----------------+
| Baseline     | \$500,000      | Cost    | ROI      | Payback Period |
| Costs \*     |                | Savings |          |                |
+--------------+----------------+---------+----------+----------------+
| Year 1 PKI   | \$255,900      | \$      | 49%      | .49 year       |
| Costs        |                | 244,100 |          |                |
+--------------+----------------+---------+----------+----------------+
| Subsequent   | \$ 80,900      | \$      | 84%      | .16 year       |
| Years        |                | 419,100 |          |                |
|              |                |         |          |                |
| PKI Costs    |                |         |          |                |
+--------------+----------------+---------+----------+----------------+

Economic Impact \-- BEP/Mint Workflow Automation

The BEP and Mint costs represent the overhead it incurs in the manual
processing and distribution of paper documents. Given a \$40/document
manual processing cost and assuming the internal processing and
distribution of only 5,000 documents/year; baseline costs are \$250,000.

Figure 7 BEP ANALYSIS

+--------------+----------------+---------+----------+----------------+
| Baseline     | \$250,000      | Cost    | ROI      | Payback Period |
| Costs \*     |                | Savings |          |                |
+--------------+----------------+---------+----------+----------------+
| Year 1 PKI   | \$169,750      | \$      | 32%      | .68 year       |
| Costs        |                | 80,250  |          |                |
+--------------+----------------+---------+----------+----------------+
| Subsequent   | \$ 64,750      | \$      | 74%      | .26 year       |
| Years        |                | 185,250 |          |                |
|              |                |         |          |                |
| PKI Costs    |                |         |          |                |
+--------------+----------------+---------+----------+----------------+

Figure 8 Mint Analysis

+--------------+----------------+---------+----------+----------------+
| Baseline     | \$250,000      | Cost    | ROI      | Payback Period |
| Costs \*     |                | Savings |          |                |
+--------------+----------------+---------+----------+----------------+
| Year 1 PKI   | \$ 96,480      | \$      | 61%      | .39 year       |
| Costs        |                | 153,520 |          |                |
+--------------+----------------+---------+----------+----------------+
| Subsequent   | \$ 46,080      | \$      | 82%      | .18 year       |
| Years        |                | 203,920 |          |                |
|              |                |         |          |                |
| PKI Costs    |                |         |          |                |
+--------------+----------------+---------+----------+----------------+

[^1]: The cost of processing a paper document is documented in GSA's
    "CIO/PKI Smart Card Project Approach for Business Case Analysis of
    Using PKI on Smart Cards for Government wide Applications" and an
    Entrust document on PKI (www.entrust.com/resourcecenter).

[^2]: Assumes 5 GS 14, Step 5 @ \$84,658 plus 30% for benefits

[^3]: Assumes 3 GS 13, Step 5 @ \$84,658 plus 30% for benefits

[^4]: See [www.entrust.com](http://www.entrust.com/)

[^5]: ^\*^

[^6]: Streamline logon procedures \-- Smart cards can safely allow a
    user to logon to multiple applications without having to rekey
    passwords. Streamlining logon procedures may help cut down on help
    desk calls about lost or forgotten passwords. Estimates vary, but
    its reasonable to assume that 30% of help desk calls is password
    related. A PKI-based smart card logon could reduce calls by 50% and
    thus improve employee productivity

[^7]: The cost of using Internet self-service.

[^8]: Assumes bureaus will use existing HR or security staff to register
    employees for PKI credentials.