PIV Card Body Approval Procedures

1 Introduction

1.1 Overview

The FIPS 201 Evaluation Program (EP) is a federal compliance program administered by the Office of Government-wide Policy (OGP), within the General Services Administration (GSA) agency. The FIPS 201 Evaluation Program (EP) evaluates products and services against the requirements outlined in FIPS 201 and its supporting documents. In addition to test requirements developed to test conformance to the National Institute of Standards and Technology (NIST) specifications, GSA has established interoperability and performance metrics to further determine product suitability. To qualify as an Evaluation Lab (Lab) for the GSA FIPS 201 EP, the laboratory shall have received NIST National Voluntary Laboratory Accreditation Program (NVLAP) accreditation (refer to NIST HB 150-17e2022, Annex D), to perform FIPS 201 conformance testing on products submitted by the suppliers/ vendors. A set of approval procedures have been developed which outline the evaluation criteria, approval mechanisms, and validation test reports to be employed and provided by the Evaluation Laboratory during their evaluation of a Supplier’s product against the requirements for that category.

A Vendor/Supplier desiring to submit a PIV Card body (hereafter referred to as the Product) for evaluation must follow these Approval Procedures, which provide the necessary category-specific details to have a Supplier’s Product evaluated by the EP and placed on the Approved Products List (APL).

1.2 Category Description

The PIV Card is a smart card with contact and contactless interfaces that meet the interface, data format, graphical, and physical requirements outlined in FIPS 201 and SP 800-73.

1.3 Purpose

The purpose of this document is to provide the following information:

1. Provide a list of the artifacts, forms and/or documentation that must be submitted bythe Evaluation Lab (Lab) to the FIPS 201 EP as part of the application package submission.
2. Document the requirements that apply to the PIV Card body evaluation.
3. Specify the evaluation criteria along with their approval mechanisms that the Evaluation Labs will use to verify compliance of the Product against the requirements that apply to this category.

2 Application Package Contents

The Application Package Contents include the artifacts, documentation, and the product itself that need to be submitted by the Evaluation Lab to perform validation. The Application Package Contents for this category include the following:

• The Product itself.
  • (a) The vendor should deliver the product to the Lab (address found at https://www.idmanagement.gov/vendors/) using a secure delivery method requiring receipt acknowledgement (e.g., FedEx, UPS, hand delivery)
  • (b) The Lab should deliver the Product to the FIPS 201 EP at 1893 Metro Center Dr., Ste 228, Reston, VA 20190 using secure delivery methods requiring receipt acknowledgement (e.g., FedEx, UPS, hand delivery).
• Completed and signed “PIV Card APL Evaluation Program Application Form” (link: https://www.idmanagement.gov/fips201/, under PIV Card Body Application Package Requirements)
• Completed and signed “FIPS 201 Evaluation Program Lab Services Agreement_v3.0.0” (link: https://www.idmanagement.gov/fips201/, under PIV Card Body Application Package Requirements)
• Completed and signed “FIPS 201 Evaluation Program Attestations to Federal Acquisition Regulations related to the Trade Agreement Act” (link: https://www.idmanagement.gov/fips201/, under PIV Card Body Application Package Requirements)
• Completed and signed “FIPS 201 Evaluation Program Attestation Form for PIV Card Body Approval_v1.0” (link: https://www.idmanagement.gov/fips201/, under PIV Card Body Application Package Requirements)
• A Vendor/ Lab Test Data Report, which provides test results showing that the Product complies with the requirements indicated in Section 3.1, Table 1 of this document and as indicated against the tests conducted in the FIPS 201 Evaluation Program Attestation Form for PIV Card Body Approval_v1.0. The Lab is required to develop test methods for conformance testing as required by the FIPS 201 EP and validate that the test methods developed comply with the requirements set forth by the International Organization Standardization (ISO) 17025 for Testing and Calibration laboratories to verify the effectiveness of the testing method to produce valid results. In this regard, the Supplier/ Lab is expected to develop and document the test procedures used to determine how the Product was tested to conclude that it met all requirements to be compliant. In addition, the following will be provided as part of the Supplier/Vendor Documentation Review and Certification:
  • All necessary Supplier/Vendor documentation providing proof that the Product complies with the category-specific requirements (as outlined in Section 3.1, Table 1) and complies with the evaluation criteria in Section 3.2.1 for the category which has Supplier documentation review as its approval mechanism. Examples of specific documentation include: user guides, technical specifications, white papers, sample cards, etc.
  • Official Certification documentation from the appropriate entity (e.g., NIST) indicating the Product’s conformance to the tested requirements of FIPS 201. Specific reference to the exact type of certification necessary can be found in the Certification section found in Section 3.2.3 of this document.

3 Evaluation Procedure for PIV Card Body Testing

3.1 Requirements

To approve the Product as conformant to the requirements of FIPS 201, it, at a minimum, must comply with all the requirements listed below. The approval mechanism column describes the Lab’s technique to evaluate compliance with that particular requirement.

Table 1 - Applicable Requirements

3.2 Evaluation Criteria

This section provides details on the process employed by the Lab for evaluating the Product against the requirements indicated above.

3.2.1 Supplier/ Vendor Documentation Review (PIV-C.1 to PIV-C.7)

The Lab will review the documentation submitted by the Supplier/ Vendor to ascertain the following and provide documentation to support their review:

• The card’s physical characteristics comply with the following:
  • ISO 7810
  • ISO 10373
  • ISO 7816
  • ISO 14443
  • ICC Interfaces

The card durability and performance tests conform to the ANSI 322 test methods.

3.2.2 Vendor/Lab Test Data Report (PIV-C.8 to PIV-C.23)

As a result of the testing to ensure compliance with the respective standards, the following must be included as part of the Vendor/Lab Test Data report:

• A report generated to ensure that the test performed to evaluate the card characteristics durability and performance comply with the test methods in ANSI 322. These tests shall include card flexure, static stress, plasticizer exposure, impact resistance, card structural integrity, surface abrasion, temperature and humidity-induced dye migration, ultraviolet light exposure, and laundry test. Cards SHALL NOT malfunction or delaminate after hand cleaning with a mild soap and water mixture (FIPS 201-3).
• A sampling of a minimum of four (4) out of five (5) cards, or 80% in case a sampling size of greater than five (5) cards is used, should successfully fulfill the requirement being tested for to ensure that the product passes the particular test.

3.2.3 Certification (PIV-C.25 to PIV-C.26)

The Lab will perform the necessary activities to ensure the authenticity and validity of the certification status for the Product being tested and provide the following:

• A validation certificate from the NIST Personal Identity Verification Program (NPIVP) detailing that the Product being tested is listed in the PIV Card Application Validation list as conformant as defined in SP 800-73: https://csrc.nist.gov/Projects/nist-personal-identity-verification-program/Validation-Lists/piv-card-application-validation-list.
• A validation certificate from The NIST Cryptographic Module Validation Program (CMVP) which validates cryptographic modules to the Federal Information Processing Standard (FIPS) 140-3, Security Requirements for Cryptographic Modules: https://csrc.nist.gov/projects/cryptographic-module-validation-program.