# Presentation: 688893

## The Government-wide Implementation of Homeland Security Presidential Directive 12 (HSPD-12)   David Temoshok Director, Identity Policy and Management GSA Office of Governmentwide

**Federal IT Summit**
**October 9, 2007**

## President’s Domestic Agenda

**President’s Management Agenda**:
- Strategic Management of Human Capital
- Competitive Sourcing
- Improved Financial performance
_**Expanded Electronic Government**_
- Budget and Performance Integration
**E-Government Act of 2002**
**OMB Office of E-Government and Technology**

**Notes:**
This slide has photo of President Bush Speaking. 

## President’s E-Gov Agenda

**Government to Govt.**

**Internal Effectiveness and Efficiency****     ****Lead**

- 1.  e-Vital (business case)
- 2.  Grants.gov
- 3.  Disaster Assistance
-      and Crisis Response
- 4.  Geospatial Information
-      One Stop
- 5.  Wireless Networks

- 1.  e-Training
- 2.  Recruitment One Stop
- 3.  Enterprise HR Integration
- 4. e-Travel
- 5. e-Clearance
- 6. e-Payroll
- 7. Integrated Acquisition
- 8. e-Records Management

***President’s E-Gov Agenda***

- OPM
- OPM
- OPM
- GSA
- OPM
- OPM
- GSA
- NARA

**Lead**
- SSA
- HHS
- FEMA
- DOI
- FEMA

**Lead**
- GSA
- Treasury
- DoED
- DOI
- Labor

**Government to Business**

- 1.  Federal Asset Sales
- 2.  Online Rulemaking
-      Management
- 3.  Simplified and Unified
-      Tax and Wage Reporting
- 4.  Consolidated Health
-      Informatics** **
- Business Gateway
- Int’l Trade Process Streamlining

**Lead **
- GSA
- EPA
- Treasury
- HHS
- SBA
- DOC

**Cross-cutting Infrastructure:**	**E-Authentication GSA**

**Government to Citizen**

- 1.  USA Service
- 2.  EZ Tax Filing
- 3.  Online Access for Loans**        **
- 4.  Recreation One Stop
- 5.  Eligibility Assistance
-      Online

**Notes:**
This slide shows which agencies are the leads for different parts fo the President’s E-Gov Agenda. They are:
Government to Citizen
1.  USA Service-GSA	        
2.  EZ Tax Filing 	-Treasury	        
3.  Online Access for Loans -DoEd      
4.  Recreation One Stop-DOI
Eligibility Assistance Online- Labor

Government to Business:
1.  Federal Asset Sales-GSA	
2.  Online Rulemaking-EPA	
     Management 
3.  Simplified and Unified-Treasury	    
     Tax and Wage Reporting
4.  Consolidated Health-HHS
     Informatics 
5. Business Gateway-SBA
6. Int’l Trade Process Streamlining-DOC

The rest as follows are cross cutting infrastructure-E Authentication GSA
Government to Business
1.  e-Vital (business case)  -SSA
2.  Grants.gov-HHS
3.  Disaster Assistance
     and Crisis Response--FEMA
4.  Geospatial Information
     One Stop-DOI
5.  Wireless Networks-FEMA

Internal Effectiveness and Efficiency:
1.  e-Training_OPM                     
2.  Recruitment One Stop-OPM
3.  Enterprise HR Integration-OPM
4. e-Travel-GSA
5. e-Clearance-OPM
6. e-Payroll-OPM
7. Integrated Acquisition-GSA
8. e-Records Management-NARA

## The HSPD-12 Mandate

**          ****Home Security Presidential Directive 12 (HSPD-12):**
- 	“*Policy for a Common Identification Standard for Federal Employees and Contractors”*
*	**	**	**	**-- *Signed by President: **August 27, 2004**

**HSPD-12 has Four Control Objectives:**
- Issue Identification based on sound criteria to verify an individual’s identity.
- Strongly resistant to fraud, tampering, counterfeiting, and terrorist exploitation.
- Personal Identity can be rapidly authenticated electronically.
- Issued by providers who’s reliability has been established by an official accreditation process.

## Key Milestones

**October 27, 2005**

**Notes:**
There are checkmark graphics here to indicate that the first 4 milestones have been met. The final one is not due until October 27, 2008.

## Four Authentication Assurance Levelsto meet multiple risk levels: M-04-04 

*** ***

**Multi-Factor Token**

**Very **

**High**

**High**

**Medium**

**Low**

**Employee **

**Screening **

**for a High **

**Risk Job**

**Obtaining **

**Govt. **

**Benefits**

**Applying **

**for a Loan **

**Online**

**Access to **

**Protected **

**Website**

**PIN/User ID**

**-**

**Knowledge**

**Strong Password**

**-**

**Based**

**PKI/ Digital Signature**

**HSPD-12 PIV Card**

- Increased $ Cost

- Increased Need for Identity Assurance

***Four Authentication Assurance Levels******to meet multiple risk levels******: ******M-04-04****** ***

**Biometrics**

**Notes:**
This matrix shows that as there is an increased need for Identity Assurance, there is an Increased Cost associated. For example, 
LOW COST- Access to protected website requires PIN/User ID
MEDIUM COST-Applying for a loan online requires a strong password that is knowledge based
HIGH COST-Obtaining Government benefits requires Biometric and pki/Digital Signature
VERY HIGH COST- Employee screening for a high risk job requires Multi-Factor Token

## Government-wide Implementation Strategy 

- OMB provides policy and implementation guidance.
- NIST provides HSPD-12 process and technical requirements (FIPS 201 and associated Special Publications).
- GSA (OGP and FAS) provides government-wide implementation and acquisition assistance, coordinates agency implementation through the Federal Identity Credentialing Committee, develops and tests interface specifications for interoperability, and serves as “Executive Agent for Acquisition” for approval of products and services for the implementation of HSPD-12.
- Interoperability of HSPD-12 systems across government is required.  Agency implementation is controlled through Approved Product List, acquisition controls, and Standard Interface Specifications.
- GSA is designated to provide shared services and infrastructure for government-wide implementation (MSO).
- Extremely aggressive milestones are needed to maintain focus and momentum.

## Multiple PIV Authentication Technologies

- To provide multiple authentication assurance levels, FIPS 201 requires multiple authentication technologies:
- Authentication using PIV Visual Credentials – Facial Image
- Authentication using the Cardholder Unique Identifier (CHUID) – contact or contact-less
- Authentication using PIN
- Authentication using Biometric (match on/off card) – fingerprint template
- Authentication using PIV asymmetric Cryptography (PKI) – authentication digital certificate

***Something I have – PIV Card***
***Something I know - PIN***
***Something I am - Biometric***

## GSA’s Role – Executive Agent for Acquisition

- Establish FIPS 201 Evaluation Program to ensure that commercial products comply with all normative requirements of FIPS 201.
- Establish Approved Products List to publicly post all approved products/services requiring FIPS 201 compliance.
- Establish Integration Services Qualification Program for vendors to be qualified to provide integrated, bundled solutions and contractor managed solutions.
- Establish Special Item Number (SIN) 132-62 on GSA MAS IT 70 for FIPS 201 compliant products and qualified services.
- Provide full-range of qualified products and services to meet Agency implementation needs, including integration services.
- Test agency-specific implementations for compliance.

## Status of HSPD-12 Interface Specifications

- Interface Specifications are needed for interoperability in order to successfully exchange data between HSPD-12 systems and systems components
- OGP established the inter-agency HSPD-12 Architecture Working Group in FY 2006 to develop Interface Specifications for government-wide use.
- 10 Interface Specification Documents have been developed and issued in final
- All Interface Specifications are posted at _[http://www.smart.gov/awg/](http://www.smart.gov/awg/)_
- GSA MSO is developing and currently testing Reference Implementation for the Agency – SIP (Systems Infrastructure Provider) Interface Specification.
- The MSO Reference Implementation will be the standard for all MSO agencies to interface to EDS.
- Two new Interface Specifications are currently under development for MSO and government-wide use
- SIP – OPM (Office of Personnel Management) for all fingerprint data transmissions to OPM and FBI
- Back-end authentication for physical and logical access control (numerous use cases and Interface Specifications needed)

## Key Architecture Design Considerations

- Different authentication assurance levels are needed for different types of transactions.
- Architecture must support multiple authentication technologies – PIN, biometric template, CHUID, authentication keys.
- Architecture must support multiple protocols.
- Federal Government will not mandate a single proprietary solution, therefore, Architecture must support multiple COTS products.
- All architecture components must interoperate with ALL other components (see _[www.idmanagement.gov](http://www.idmanagement.gov/)_) – requires product testing.
- Interface specifications are necessary for inter-system data exchange.
- Controls must protect privacy of personal information.** **

## Why Shared Services for E-Authentication, Federal Bridge CA and HSPD-12 Implementation? 

- Efficiencies – Eliminate need for redundant infrastructure.
- Enhance Interoperability – Much easier to ensure interoperability across a limited number of systems (GSA & DOI bring 75+ customer agencies to common, shared solution).
- Accelerate implementation timeframes.
- Reduce cost/implementation for HSPD-12 system interfaces.
- Aggregate Federal acquisitions to maximize potential for volume buys.
- Organize Federal marketplace for all of the above.

## Status of GSA FIPS 201 Evaluation Program

- OGP administers the FIPS-201 Evaluation Program to determine conformance to FIPS-201 normative requirements.
- Certified laboratories perform all FIPS 201 compliance evaluations
- OGP approves all evaluations and posts to Approved Product List
- Approved Product List posted at _[http://fips201ep.cio.gov/](http://fips201ep.cio.gov/)_
- GSA/NIST identified 22 categories of products/services which must comply with specific normative requirements contained in FIPS 201
- e.g., PIV smart cards, smart card readers, fingerprint scanners, fingerprint capture stations, facial image capture stations, card printing stations, etc.
- Current product and services approvals:
- 300+ products on FIPS 201 Approved Product List
- Current certified labs:
- Atlan Laboratories, InfoGard Laboratories
- Several more lab certifications in progress

## Accessing the FIPS 201 Approved Products List

***Accessing the FIPS 201 Approved Products List***

## Where are we today?  

**12+ agencies committed to their own infrastructure:**
- DHS, DoD, NASA, SSA, EPA, FTC, Dept. of State, VA, HHS, ED, DOL, NSF,
**100+ Agencies want to share infrastructure**
- All small agencies
- DOC, HUD, USDA, DOJ, DOI, GSA, DOE, DOT, Treasury, OPM, Federal Reserve, USPS, NARA, FCC committed
**Shared Service Providers**
- DoD/DMDC – for branches of military
- Dept. of State -- 8 agencies serviced by State Dept.
- GSA for government-wide services – 70+ agencies
**GSA ****Roll-out**
- Shared Service pricing released 6/8/07 -- $49/seat for enrollment, $36/year for maintenance
- GSA implemented enrollment station roll-out for national deployment starting in Washington DC in August 2007.
- Goal is to deploy 225 shared enrollment stations nationwide and enroll all MSO customers (700,000 +) by October 2008.

## GSA HSPD-12 Shared Services Interfaces

***Scope of shared services are HSPD-12 system components inside the red border.  These are core HSPD-12 services to meet PIV 1 & 2 compliance.  ***

***1***

***2***

***2***

***3***

**Notes:**
This slide shows a complex shared services interface Scope of shared services  The following are core HSPD-12 services to meet PIV 1 & 2 compliance within the scope of shared services:
 Enrollment Service Provider
Systems Infrastructure Provider
Prodution Service Provider and
Finalization Service Provider. 

## HSPD-12 Federal Shared Enrollment Service

***HSPD-12 Federal Shared Enrollment Service***

- Enrollment
- Broker

** ****225+ geographically distributed & shared Enrollment Stations **

**Card Mgmt System**
**ID Mgmt System**

**GSA Shared Service**
**SIP**

**FBI**

*Station 1*

*Station 2*

*Station 3*

*Station 4*

*Station 5*

*Station 6*

*Station 7*

*Station 8*

*Station “n”*

*Add. Needs**Stations*

***The Shared Service Enrollment  Stations transmit enrollment data to the SIP for consolidated FTS fingerprint transactions to OPM directly from the SIP. ***

**OPM**

- MSO
- Enrollment
- & Biometrics Data

**Notes:**
This slide shows more than 8 stations that are all feeding information into MSO Enrollment and Biometric Data. This then goes into GSA shared Service (SIP) which includes Card Management System and ID Management System. They feed into OPM and FBI. The Shared Service Enrollment  Stations transmit enrollment data to the SIP for consolidated FTS fingerprint transactions to OPM directly from the SIP. 

There are 225 geographically distributed and shared enrollmnet Stations. 

## Conclusion

-  This is the **THE START** ... surface is only scratched
-  There is much work ...
- Roll-out hundreds of enrollment stations nationwide
- Issue to 2 all users in next 15 months
- Test and Qualify systems
- Build common applications for access control and e-Government
- Physical security
- Logical access
- E-commerce
- Emergency Response
-  Stabilize operations ...
- Commitment to continue issuance
- Protect and promote interoperability
- Testing, monitoring, auditing and configuration control
- Make life-cycle easier
- Government procurement rules provide discipline
-  Extend to other communities

## For More Information

- Visit our Websites:
- _[http://www.idmanagement.gov](http://www.idmanagement.gov/)_
- _[http://www.FedIDCard.gov](http://www.cio.gov/ficc)__ _
- _[http://www.cio.gov/ficc](http://www.cio.gov/ficc)_
- _[http://www.csrc.nist.gov/piv-project](http://www.csrc.nist.gov/piv-project)_
- Or contact:
- 	David Temoshok
- Director, Identity Policy and Management
- 202-208-7655
- _[david.temoshok@gsa.gov](mailto:david.temoshok@gsa.gov)__ _