NIST SP 800-116 Rev. 1: Guidelines for the Use of PIV Credentials in Facility Access

Overview

The guideline gives technical direction for using the PIV Card, required by HSPD-12 for physical access to federal facilities, in government-wide interoperable PACS. FIPS 201 defines authentication mechanisms at four assurance levels (LITTLE or NO, SOME, HIGH, VERY HIGH), and this document recommends a risk-based strategy for choosing among them. It is aimed at officials implementing HSPD-12 compliant PACS, contractors and physical security vendors, and it covers PIV Cards only, not non-PIV credentials.

The central recommendation is to choose mechanisms by the protective areas around assets rather than by facility: Controlled areas need at least 1 authentication factor, Limited areas 2 and Exclusion areas 3. These areas correspond generally to LOW, MODERATE and HIGH impact assets. There is no simple one-to-one mapping between Facility Security Level (FSL) and mechanism; an FSL I campus may need nested perimeters because of localised high-value assets. PKI-CAK, BIO, BIO-A and PKI-AUTH rely on mandatory card features, while SYM-CAK and OCC-AUTH are optional, so access points should not rely solely on optional features.

Revision 1 aligns with FIPS 201-2 by making credential validation required. The CHUID authentication mechanism is deprecated for security reasons, although the CHUID data element stays mandatory as a source of expiry date and unique identifier. VIS + CHUID was dropped because it gives LITTLE or NO confidence. Online validation is recommended where current status is needed; where it is impractical a caching status proxy can be used and its cache must be refreshed at least every 24 hours. A revoked certificate must always block access.

Section 3 surveys threats such as identifier collisions, revoked cards, visual counterfeiting, skimming, sniffing, social engineering, electronic cloning and counterfeiting. Section 5 works through single-tenant, federal multi-tenant, mixed multi-tenant and FSL I-II, III and IV-V campus examples, and Section 6 covers PIV identifiers, PACS registration, role-based access control, disaster response, temporary badges, lost cards and PACS and ICAM infrastructure.

Key points

1. Minimum authentication factors: Controlled 1, Limited 2, Exclusion 3.
2. Controlled, Limited and Exclusion areas correspond generally to LOW, MODERATE and HIGH impact assets.
3. Authentication mechanisms exist at four assurance levels: LITTLE or NO, SOME, HIGH, VERY HIGH.
4. Access points should not rely solely on optional card features such as SYM-CAK or OCC-AUTH.
5. Credential validation is now required, and the CHUID authentication mechanism is deprecated.
6. VIS + CHUID is excluded because it provides LITTLE or NO confidence.
7. The caching status proxy must refresh at least once every 24 hours; a revoked certificate must always prevent access.
8. FSL I or II facilities may decline PACS; FSL III and above should implement it.
9. The single-tenant example has two perimeters: the lobby and the entrance to a room with high-value assets such as a server room.

Using it in design

• Map data-centre layers (site perimeter, building lobby, data hall, cage or cabinet) to Controlled, Limited and Exclusion areas and set 1, 2 or 3 factors at each transition.
• Include reader hardware for three-factor authentication (card, biometric, PIN) at doors to high-value areas such as server rooms.
• Reflect the caching proxy and its 24-hour refresh rule in network and power redundancy design for when online validation is interrupted.
• For multi-tenant colocation, decide early which security level applies to the outer perimeter and to tenant-specific inner perimeters.
• Put the limitations of legacy PACS components (reader interface, wiring, software upgrades) on the retrofit checklist.
• Plan disaster response, temporary badge and lost card processes together with the PACS registration infrastructure.

Who should read it

Officials implementing HSPD-12 compliant physical access control systems, contractors and physical security integrators.

Document contents

1. 1. Introduction
2. 2. Characteristics of PIV Implementations
3. 3. Threat Environment
4. 4. PIV Authentication Mechanisms in PACS Applications
5. 4.1 PIV Authentication Mechanisms
6. 4.2 Authentication Factors
7. 4.3 Selection of PIV Authentication Factors
8. 4.4 Credential Validation
9. 5. PACS Use Cases
10. 6. Deployment Consideration
11. Appendix A. An Overview of PIV Authentication Mechanisms
12. Appendix B. Combinations of PIV Authentication Mechanisms in PACS
13. Appendix C. Improving Authentication Transaction Times
14. Appendix E. Limitations of Legacy Physical Access Control Systems
15. Appendix I. Revision History

Related standards

• FIPS 201-3
• NIST SP 800-73
• EN 50600-2-5

Read the document

Publication details

Authors

Hildegard Ferraiolo; Ketan Mehta; Nabil Ghadiali; Jason Mohler; Vincent Johnson; Steven Brady

Publisher

National Institute of Standards and Technology

Year

2018

Document number

NIST SP 800-116 Rev. 1

Document language

English

Source type

Expert / community

Access

Open licence — downloadable

DOI

10.6028/NIST.SP.800-116r1

Licence

U.S. public domain — U.S. Government work; free to reuse

Licence evidence

www.copyright.gov

Citation