Acceptance of PIV-I Credentials
LOW MODERATE HIGHRequirements NIST SOURCE
Accept and verify federated or PKI credentials that meet [policy].
Discussion (NIST Supplemental Guidance)
Acceptance of PIV-I credentials can be implemented by PIV, PIV-I, and other commercial or external identity providers. The acceptance and verification of PIV-I-compliant credentials apply to both logical and physical access control systems. The acceptance and verification of PIV-I credentials address nonfederal issuers of identity cards that desire to interoperate with United States Government PIV systems and that can be trusted by Federal Government-relying parties. The X.509 certificate policy for the Federal Bridge Certification Authority (FBCA) addresses PIV-I requirements. The PIV-I card is commensurate with the PIV credentials as defined in cited references. PIV-I credentials are the credentials issued by a PIV-I provider whose PIV-I certificate policy maps to the Federal Bridge PIV-I Certificate Policy. A PIV-I provider is cross-certified with the FBCA (directly or through another PKI bridge) with policies that have been mapped and approved as meeting the requirements of the PIV-I policies defined in the FBCA certificate policy.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for IA-8(5) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- a policy for using federated or PKI credentials is defined;
- federated or PKI credentials that meet <IA-08(05)_ODP policy> are accepted;
- federated or PKI credentials that meet <IA-08(05)_ODP policy> are verified.
Examine
[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing user identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; PIV-I verification records; evidence of PIV-I credentials; PIV-I credential authorizations; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with account management responsibilities].
Test
[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities; mechanisms that accept and verify PIV-I credentials].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for IA-8(5). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Identification and authentication policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Mechanisms supporting and/or implementing identification and authentication capabilities
- mechanisms that accept and verify PIV-I credentials
Other Records
- procedures addressing user identification and authentication
- system audit records
- PIV-I verification records
- evidence of PIV-I credentials
- PIV-I credential authorizations
- other relevant documents or records