+SA-04(10) [M] Use of Approved PIV Products

SA-04(10) [M] Use of Approved PIV Products

Control

Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.

Discussion

Products on the FIPS 201-approved products list meet NIST requirements for Personal Identity Verification (PIV) of Federal Employees and Contractors. PIV cards are used for multi-factor authentication in systems and organizations.

Assessment Objective

only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed.

Assessment Method

Examine

Supply chain risk management plan system and services acquisition policy procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process solicitation documentation acquisition documentation acquisition contracts for the system, system component, or system service service level agreements FIPS 201 approved products list system security plan other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility for determining system security requirements organizational personnel with the responsibility for ensuring that only FIPS 201- approved products are implemented organizational personnel with information security responsibilities

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by SA-04(10) [M] Use of Approved PIV Products – Assessment Procedure
is blocked by Information Assurance Enabled Products