User menu

An American flag linked to Whitehouse.gov An Official Web Site of the United States Government

FIPS 201/FICAM Testing Program

Get Listed on the FIPS 201 Approved Products List

Do you have a product you would like listed on the GSA FICAM
Testing Program's FIPS 201 Approved Products List? Get started
here by contacting a Testing Lab.

Product Testing Tools

In need of testing a new PIV card for data model conformance?
Download the SP 800-85B tool available on this page. It is used to
determine data model conformance to the FIPS 201 specifications.

Testing Program Documents

View the FICAM Testing Program Documents, such as the Testing and Approval
Procedures GSA has established for interoperability and performance metrics to
further determine product suitability.

View the Approved Products List

This list provides federal agencies with the products and services
related to ICAM implementation that have been approved based
on testing done by the FICAM Testing Program.

Your official resource for product testing and approved products.

 

Announcement - ICAM Test Cards are now available!

How do you test a Physical Access Control System (PACS) using PIV and PIV-I credentials prior to deploying the PACS into the field?

The FICAM Testing Program now offers a unique and new alternative - ICAM Test Cards.  These sets of cards provide a convenient and systematic approach to unit testing, acceptance testing, and C&A of PIV and PIV-I enabled Enterprise PACS (E-PACS) solutions. ICAM Test Cards and the corresponding ICAM PKI is designed for self-testing products and services against the Functional Requirements and Test Cases [FRTC] required for listing on the GSA FIPS 201 APL. Proactively self-testing will reveal whether your E-PACS solution can withstand known attacks and common PKI errors, allowing you to fix vulnerabilities before submitting to the FICAM Testing Program, and most importantly to agencies, before deploying. More information and technical details about the ICAM Test Cards can be found here in the ICAM Test Card User Guide.

The 1st generation of ICAM Test Cards, which is a set of vulnerability assessment cards, is now available. A 2nd generation of ICAM Test Cards and PKI is being developed now. They will focus on valid configurations of PIV, PIV-I and CAC, as well as valid PKI and cryptographic methods, greatly enhancing the probability that your solution will handle known variations from issuers. This 2nd generation is coming soon

The following methods are available to acquire 1st generation ICAM Test Card sets:

Purchase from private vendors:

1. CertiPath ICAM ProofCards
https://www.certipath.com/trusted-pacs/proofcards/shop-proofcards
Contact Name: Tim Rohrbach
Email: tim.rohrbach@certipath.com
Phone Number: (703) 793-7876

2. HID Audit Cards
Email: pivclassauditcards@hidglobal.com

Note that HID Audit Cards are focused on showing that known attacks, such as counterfeit, manipulated, copied, cloned, lost, stolen or shared cards, are mitigated by the system. They do not address checking for common PKI errors or other errors or omissions looked for by the FIPS 201 / FICAM Testing Program.  Accordingly, HID Audit cards should not be considered the same as ICAM Test Cards. Click here to view a brochure that describes HID's PIV Audit Cards.


FICAM Testing Program's Test Card Loan Program:

Contact Name: Chi Hickey
Email: chi.hickey@gsa.gov
Phone Number: (202) 501-1881

The Loan Program process is provided here: Loan Process

Back to Top