Putting PIV Cards to Practical Use

Putting PIV Cards to Practical Use

Putting PIV Cards to Practical UseThe government recognizes the need to increase security for cyber and physical assets so counter measures to reduce, mitigate and eliminate external and internal terrorist threats have been, and remain, paramount.

In 2004, the White House issued the Homeland Security Presidential Directive 12 (HSPD-12), which set the entire government on a path toward establishing protocols for security access of federal workers and contractors. The first step was the creation of the Personal Identity Verification smart card (PIV card), which resulted from the NIST FIPS-201 specification, published in 2005. The next step is to actually use the PIV card for everyday access.

Due to wide variations in how federal departments conduct business and what their risk profile is to the United States, there is no onesize- fits-all security policy. In response to this complexity, the Federal CIO Council established the Identity, Credential and Access Management Subcommittee in 2008 to guide departments in how to use the PIV card for all access appropriate to their mission. This group published the Federal Identity Credential and Access Management (FICAM) Roadmap and Implementation Guidance document (FICAM Roadmap), now in its final version. The Office of Management and Budget (OMB) issued Memorandum M-11-11 in early 2011, which stated that all federal agencies must align with the FICAM Roadmap. Today, virtually every government employee and contractor requiring access for six months or longer is required to carry and use a PIV card.

To obtain this card, each individual must undergo a stringent background check. Any incidents or affiliations that occur after a card is issued may trigger revocation of authority and access privileges.

Program Implementation

In order for this system to fully and correctly function, the cards must be used with physical readers; otherwise an individual could flash a counterfeit PIV card at a guard and gain easy access to a government facility. It also is crucial that each PIV card work across every PACS across the entire government, including all agencies and locations.

While FICAM provided a roadmap for government agencies to plan and execute identity, credential and access management programs that address these needs, it did not provide the concrete details of how the programming should be implemented. As a result, numerous concerns and issues have arisen in the issuance and utilization of PIV cards.

Currently, agencies have the individual responsibility to issue PIV cards to employees and contractors. Often, if an employee or contractor needs access to a different agency, a new card is issued. This increases costs, though, as each PIV card ranges between $200 to $300.

The OMB M-11-11 instructs all agencies to embrace the PIV credentials federated by other agencies; however, to achieve success, all PACS systems across all government agencies must be interoperable and PIV-enabled.

Card Authentication

All PIV cards must be authenticated by government agencies for visitor or contractor management before they are used, which is a software function. The smart card contact reader must read the card, authenticate it against the issuing certificate authority and be enrolled in the system for actual use. Each time the card is used, it must be validated in near real time to ensure the user’s privileges have not been revoked. This “cashing status proxy” continuous validation is extremely important and referenced specifically in the FICAM initiative.

This affects employees, vendors, visitors and partners with different access credentials who may be present at various times on government property. Complicating matters further, these privileges are constantly changing: new employees are hired, employees gain or lose certifications and vendors are added or released.

Beyond the authentication and validation of the PIV, there is also the important issue of authorized access to a given door or building. Each time an individual presents their PIV card, the data on that card and in the authorization database must be accurate and up-to-date – otherwise a person may gain access to an unauthorized area. This goes well beyond unauthorized access compliance issues and presents critical safety concerns.

Overcoming Challenges with Technology

Challenges presented by PIV standard compliances have delayed the full adoption of this protocol by many government agencies. However, existing technology can alleviate the challenges by sustaining valid identities 24/7 and creating a virtual firewall.

Using an enterprise-based, Physical Identity and Access Management (PIAM) solution, government agencies may prevent prohibited, internal access to unauthorized employees, contractors and other individuals enrolled in the system. In alignment with FICAM guidelines, this software can be implemented across multiple facilities and buildings across a campus or even the globe. And, since this software enables existing physical access control systems to fully recognize and validate PIV cards, there is no need to rip and replace existing PACS infrastructure. This is something that visitor management systems cannot do.

New regulations and the advent of PIV cards have created many challenges; the good news is that technology can help solve the challenges existing today.

Solution Benefits

A robust and technologically-advanced, software solution will provide a policy-based approach to managing and enrolling PIV cardholders into diverse PACS. This enables flexible enrollments with validation and processing of individuals needing temporary or longterm access to a given facility. In addition, this technology guards against fraud and fosters real-time audit and compliance, without changing the user’s existing physical security infrastructure.

PIAM software also includes automatic enrollment of newly-issued, PIV credentials, including biometric/biographical data capture from the PIV card in all PACS across every government agency. This software will further enable interoperability between PACS systems and logical authoritative identity systems across all agencies, including LDAP/IdM/HR systems or other third-party PIV database applications. It will establish a single reference point for all cardholders, whether PIV or non-PIV, across agencies and across diverse PACS and Logical Access Systems (LACS). A single, centralized, rules-based process for access privilege provisioning and ongoing access management is available while the lifecycle of PIV cards, including PIV card activation, status inquiry, lost or stolen cards, provisioning and revocation, and card expiration policies can be managed in the physical access control system. Finally, the solution will encompass web-based visitor enrollment and management for PIV and non-PIV cardholders.

Ultimately, implementing this type of software solution will help government agencies:

  • Preserve existing investments in technology;
  • Simplify complex procedures; and
  • Reduce future costs, including security improvements, installations, deployments and maintenance.

If this sounds like a tall order, it is. The software is extremely technologically advanced, but the deployment of the software, however, is not. For government agencies, it is the end of many headaches, and the beginning of more convenient and compliant identity and access management.

This article originally appeared in the November 2013 issue of Security Today.


  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Survey: Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

  • Mobile Applications Are Empowering Security Personnel

    From real-time surveillance and access control management to remote monitoring and communications, a new generation of mobile applications is empowering security personnel to protect people and places. Mobile applications for physical security systems are emerging as indispensable tools to enhance safety. They also offer many features that are reshaping how modern security professionals approach their work. Read Now

Featured Cybersecurity


New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities 3