First PIV deadline for agencies just days away
Connecting state and local government leaders
Most agencies appear to be on track to meet the Oct. 27 deadline for organizing and accrediting the groups that will issue new governmentwide ID cards mandated by the White House.
Most agencies are on track to meet the Oct. 27 deadline for organizing and accrediting the groups that will issue new governmentwide ID cards mandated by the White House, according to William 'Curt' Barker of the National Institute of Standards and Technology.
"We don't have a lot of visibility into the agencies, but anecdotal evidence seems to be that most of them are getting there," said Barker, NIST program manager for personal ID validation.
Establishing a program for issuing PIV cards is only the first step for agencies under Homeland Security Presidential Directive 12. The clock immediately begins running toward an October 2006 deadline for actually issuing the new interoperable ID cards.
"I think that most agencies will probably be there," Barker said. "The agencies that will have the most difficulties will be the most important ones, because they will be the largest and most diverse agencies."
Those agencies are likely to include the Defense Department and NASA, which already have established smart-card programs.
Barker spoke yesterday at the Federal Information Assurance Conference at the University of Maryland.
President Bush issued HSPD-12 in August 2004, mandating a standardized, interoperable ID card based on a smart card that will work across and between agencies. This will be the first time agencies have been required to comply with standards that will allow cards to be accepted for physical and logical access at any government facility or IT system.
While Barker was optimistic about agency compliance, a recent survey by Hewlett Packard Co. of 100 federal executives found that about half did not know about the upcoming deadline and more than half said their agency will not meet the requirement.
The directive contained an aggressive time line for implementation, requiring NIST to establish standards for the card within six months.
"That is usually a two-year job, at best," Barker said.
Agencies then had eight months to comply with the standards, a goal that Barker described as "difficult to impossible. So we divided the standard into two parts."
The first part, with an Oct. 27 deadline, is for setting up the organization within each agency that is authorized to issue the cards. Interoperable cards must be issued beginning one year later, according to the Office of Management and Budget, although there is likely to be some flexibility for large agencies. Barker said challenges are likely to be more organizational than technical.
NEXT STORY: OMB preparing to open shop for IT security LOB