Notice2022-01246
Announcing Issuance of Federal Information Processing Standard (FIPS) 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
January 24, 2022
Effective
January 24, 2022
Issuing agencies
Commerce DepartmentNational Institute of Standards and Technology
Abstract
This notice announces the Secretary of Commerce's approval of Federal Information Processing Standard (FIPS) Publication 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors. FIPS 201-3 includes clarifications to existing text, additional text in cases where there were ambiguities, adaptation to changes in the environment since the publication of FIPS 201-2, and specific changes requested by Federal agencies and implementers.
Full Text
<html>
<head>
<title>Federal Register, Volume 87 Issue 15 (Monday, January 24, 2022)</title>
</head>
<body><pre>
[Federal Register Volume 87, Number 15 (Monday, January 24, 2022)]
[Notices]
[Pages 3502-3504]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2022-01246]
-----------------------------------------------------------------------
DEPARTMENT OF COMMERCE
National Institute of Standards and Technology
[Docket No. 211115-0232]
Announcing Issuance of Federal Information Processing Standard
(FIPS) 201-3, Personal Identity Verification (PIV) of Federal Employees
and Contractors
AGENCY: National Institute of Standards and Technology (NIST),
Commerce.
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: This notice announces the Secretary of Commerce's approval of
Federal Information Processing Standard (FIPS) Publication 201-3,
Personal Identity Verification (PIV) of Federal Employees and
Contractors. FIPS 201-3 includes clarifications to existing text,
additional text in cases where there were ambiguities, adaptation to
changes in the environment since the publication of FIPS 201-2, and
specific changes requested by Federal agencies and implementers.
DATES: FIPS 201-3 is effective on January 24, 2022.
ADDRESSES: FIPS 201-3 is available electronically from the NIST website
at: <a href="https://csrc.nist.gov/publications/fips">https://csrc.nist.gov/publications/fips</a>. Comments that were
received on the proposed changes will also be published electronically
at <a href="https://csrc.nist.gov/projects/piv">https://csrc.nist.gov/projects/piv</a> and at <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
FOR FURTHER INFORMATION CONTACT: Hildegard Ferraiolo, (301) 975-6972,
National Institute of Standards and Technology, 100 Bureau Drive, Mail
Stop 8930, Gaithersburg, MD 20899-8930, email:
<a href="/cdn-cgi/l/email-protection#2d45444149484a4c5f49034b485f5f4c444241426d43445e59034a425b"><span class="__cf_email__" data-cfemail="e98180858d8c8e889b8dc78f8c9b9b8880868586a987809a9dc78e869f">[email protected]</span></a>, or Andrew Regenscheid, (301) 975-5155,
<a href="/cdn-cgi/l/email-protection#05646b617760722b776062606b76666d606c61456b6c76712b626a73"><span class="__cf_email__" data-cfemail="c9a8a7adbbacbee7bbacaeaca7baaaa1aca0ad89a7a0babde7aea6bf">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: FIPS 201 establishes a standard for a
Personal Identity Verification (PIV) system (Standard) that meets the
control and security objectives of Homeland Security Presidential
Directive-12 (HSPD-12). It is based on secure and reliable forms of
identity credentials issued by the Federal Government to its employees
and contractors. These credentials are used by mechanisms that
authenticate individuals who require access to federally controlled
facilities, information systems, and applications. This Standard
addresses requirements for initial identity proofing, infrastructure to
support interoperability of identity credentials, and accreditation of
organizations issuing PIV credentials.
FIPS 201 was issued on 2005 (70 FR 17975) in response to HSPD-12.
Subsequent revisions included FIPS 201-1, published in 2006 and FIPS
201-2 (version in effect), published in 2013 (78 FR 54626). In
consideration of technological advancements over the last five years
and specific requests for changes from United States Government (USG)
stakeholders, NIST determined that a third revision of FIPS 201 was
warranted. NIST received numerous change requests, some of which, after
analysis and coordination with the Office of Management and Budget
(OMB) and USG stakeholders, were incorporated in a proposed draft of
FIPS 201-3. Other change requests incorporated in the draft resulted
from the 2019 Business Requirements Meeting held at NIST. The meeting
focused on business requirements of Federal departments and agencies.
On November 3, 2020, a notice was published in the Federal Register (85
FR 69599), soliciting public comments on the draft FIPS 201-3. During
the public comment period, a virtual public workshop was hosted by NIST
on December 9, 2020.
The scope of changes reflected in FIPS 201-3 include the following:
<bullet> Alignment with current NIST technical guidelines on
identity management, OMB policy guidelines, and changes in
commercially-available technologies and services.
<bullet> Accommodation of additional types of authenticators
through an expanded definition of Derived PIV credentials.
<bullet> Focus on the use of federation to facilitate
interoperability and interagency trust.
<bullet> Addition of supervised remote identity proofing processes.
<bullet> Removal of previously deprecated Cardholder Unique
Identifier (CHUID) authentication mechanism and deprecation of the
symmetric card authentication key and visual authentication mechanisms
(VIS).
<bullet> Support for secure messaging authentication mechanism (SM-
AUTH).
Comments and questions regarding the draft were submitted by USG
organizations, private sector organizations, and private individuals.
NIST made several changes to the draft FIPS 201-3 based on the public
comments received.
Many commenters asked for clarification of the text of the Standard
and/or recommended editorial and/or formatting changes. Other
commenters suggested modifying the requirements and asked questions
concerning the implementation of the Standard. All of the suggestions,
questions, and recommendations within the scope of this FIPS were
carefully reviewed, and changes were made to the Standard, where
appropriate. Some commenters submitted questions or raised issues that
were related but outside the scope of this FIPS. Comments that were
outside the scope of this FIPS, but that were within the scope of one
of the related Special Publications, were deferred for later
consideration in the context of the revisions to these Special
Publications. The disposition of each comment that was received has
been provided along with the comments at <a href="https://csrc.nist.gov">https://csrc.nist.gov</a>.
The following is a summary and analysis of the comments received
during the public comment period, and NIST's responses to them:
1. Comment: Some commenters inquired about the effective date of
the Standard. Commenters also inquired about the implementation
schedule associated with the changes introduced in the Standard, once
the Standard is in effect.
[[Page 3503]]
Response: FIPS 201-3 will be effective immediately upon final
publication, superseding FIPS 201-2. The effective date of new and
updated features depends upon the release of revised NIST Special
Publications or the release of new NIST Special Publications that will
be developed following the publication of this Standard. The
implementation schedule may be reflected in NIST's Special Publications
or may be provided separately by OMB, as appropriate.
2. Comment: Multiple commenters asked for clarification of the
terms PIV account and enrollment records.
Response: New terminology was introduced to define PIV identity
account rather than PIV account. The PIV identity account is the
cardholder's identity account for PIV credentials including derived PIV
credentials. It includes stored or linked contents of enrollment
records.
3. Comment: There were multiple commenters who asked for guidance
on biometrics and their use in PIV lifecycle processes. The comments
related to the type of the biometrics on cards and how long the
biometrics were valid.
Response: FIPS 201-3 expands the use of optional biometric
modalities (e.g., iris) for issuance and maintenance. The Standard also
defines the use of automated facial comparison algorithm as a biometric
modality. The Standard maintains the 12-year maximum lifetime for
biometrics since studies show that the biometric can be matched for
that length of time.
4. Comment: Multiple commenters had concerns about the requirements
for validating identity source documents and the requirements for REAL-
ID driver's licenses.
Response: NIST emphasized that there are existing requirements to
validate identity source documents to be genuine, authentic and
unexpired. REAL-ID compliance requirements are clarified by referring
to DHS's enforcement guidance.
5. Comment: Commenters had concerns about the supervised remote
identity proofing processes introduced in the draft FIPS 201-3. Some
commenters sought greater allowances for remote proofing such as
unstaffed stations. Clarification was sought on the intended use of the
process, requirements for staff at remote sites and the protections
applied to remote stations.
Response: The Standard emphasizes the need for a staff to maintain
the same level of assurance as in-person processes and to perform
sensitive protection and maintenance activities at remote station.
6. Comment: Several commenters requested detailed instructions on
reporting card termination.
Response: The Standard was updated to reflect termination in the
card management system and in enrollment records.
7. Comment: Several commenters requested changes on the management
of derived PIV credentials.
Response: The Standard clarifies processes and terms regarding the
issuance or binding of derived PIV credentials to PIV identity
accounts. The updates to the Standard include requirements and guidance
on re-issuance and post-issuance management of Public Key
Infrastructure (PKI) and non-PKI derived PIV credentials.
8. Comment: Some commenters asked that FIPS 201-3 include periodic
privacy impact assessments on all PIV related systems.
Response: The Standard was updated to require periodic review of
Privacy Impact Assessment.
9. Comment: Several commenters raised concerns related to the
requirement for the PIV Card to enforce a blacklist of disallowed PINs.
They did not feel the technology was available to enable cards to
maintain the blacklist and to provide automated enforcement of selected
PINs.
Response: The Standard removed the requirement due to the
complexity of enforcing a blacklist by the PIV Card. Instead, the
Standard specifies that the card holder be guided to select a strong
PIN that is not easily guessable or commonly used.
10. Comment: Some commenters asked to maintain use of the magnetic
stripe and not deprecate it in this version of the Standard.
Responses: NIST confirmed the deprecation of the magnetic stripe in
this version of the Standard with potential removal in a future
revision. Use of the magnetic stripe is still allowed during the
deprecation phase but it should begin to be phased out.
11. Comment: Some commenters had concerns on the removal of Legacy
PKI. Some commenters asked NIST to clarify how a cross-certified PKI
will operate as agencies transition away from Legacy PKI
implementations. Others asked that Legacy PKI use to remain in the
Standard.
Response: The Standard was revised to allow departments and
agencies that operate their own PKIs to issue digital signature and key
management certificates according to agency-specified certificate
policies as an alternative to the Federal PKI Common Policy Framework
policies referenced by FIPS 201-3. To facilitate greater
interoperability and consistency of issuance practices across agencies,
the next revision of FIPS 201 will require the use of the specified
FPKI policies.
12. Comment: Several commenters asked to either reconsider removal
of the CHUID authentication mechanism or clarify the effective date.
Response: The CHUID authentication mechanism was deprecated in the
prior revision of the Standard and is designated for removal in this
revision. NIST concluded that removal of CHUID authentication is
necessary at this time and will become effective when this version of
the Standard is approved. OMB will provide additional implementation
guidance as necessary.
13. Comment: A few commenters asked that SYM-CAK not be deprecated
because it is still supported in some implementations.
Response: Even though SYM-CAK has been deprecated in this version,
its use is not prohibited. However, support will be removed in the next
revision of the Standard.
14. Comment: Commenters indicated that the Physical Assurance Level
(PAL) concept for facility access was not consistent with assurance
levels in NIST SP 800-63B.
Response: The Authenticator Assurance Levels (AAL) described in
NIST SP 800-63B are specific to network-based authentication, not
authentication for facility access. As a result, the final version of
the Standard has removed the concept of PAL and disassociated assurance
levels from NIST SP 800-63-B for facility access. Instead,
authentication mechanisms are described independently from SP 800-63B
for facility access.
15. Comment: Multiple commenters expressed concern that the
description of assurance levels for logical access at local
workstations was not consistent with the AALs defined in NIST SP 800-
63B.
Response: The AALs described in NIST SP 800-63B are specified for
network-based authentication, not local authentication to workstations.
As such, the final version of the Standard describes assurance levels
for logical access to local workstations independently from the SP 800-
63B-defined AALs.
16. Comment: Several commenters asked for a more detailed
description of the operation of Federated IdPs.
Response: IdP terminology was updated to better align with the rest
of the document. Secure operation of IdPs will be covered by updates to
SP 800-79.
17. Comment: A commenter asked that the use of stable identifiers
be
[[Page 3504]]
included in FIPS 201-3 to support interoperability among federal
agencies.
Response: The new Special Publication for Federation, SP 800-217,
will describe processes for linking PIV identity accounts to relying
party services in interoperable and extensible manners.
18. Comment: A commenter asked that there be a discussion about the
direct use and the federated use of PIV credentials.
Response: The Standard explains both the direct and the federated
use of PIV credentials. Of the two approaches, the Standard recommends
the use of federation protocol as the primary means to accept and
process PIV credentials from other agencies.
FIPS 201-3 is available electronically from the NIST website at:
<a href="https://csrc.nist.gov/publications/fips">https://csrc.nist.gov/publications/fips</a>.
Authority: 15 U.S.C. 278g-3; HSPD-12
Alicia Chambers,
NIST Executive Secretariat.
[FR Doc. 2022-01246 Filed 1-21-22; 8:45 am]
BILLING CODE 3510-13-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on January 24, 2022.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.