NIST sets rules for PIV cards
Connecting state and local government leaders
NIST recommends three security levels for personal identity cars in buildings: controlled, limited and exclusion. Each successive level requires an additional authentication factor.
The National Institute of Standards and Technology has set ground rules for how to use Personal Identity Verification cards so employees can use them to enter government buildings.
"It is intended to be a practical, short-term recommendation," said William MacGregor, speaking at the Smart Cards in Government Conference held in Washington last fall. MacGregor is one of the co-authors of NIST’s Special Publication 800-116, "A Recommendation for the Use of PIV Credentials in Physical Access Control Systems.”
Most government buildings already have physical access systems in place.
Most entry cards that employees use don't have authentication protections. And many cards are specific to the vendor that supplied the security system, so a government employee can't use his or her access card when visiting another agency. By using the government-issued smart cards, as mandated by Homeland Security Presidential Directive 12, agencies will move closer to adopting a governmentwide physical access framework.
Borrowing a physical security layout designed by the Army, the publication recommends three security levels for buildings: controlled, limited and exclusion. Each successive level requires an additional authentication factor.
Controlled access is basic building access and requires one form of authentication, namely the Cardholder Unique Identifier number that comes with a card.
A limited-access area "might be considered an area where discretionary access of some kind is being applied," MacGregor said. It requires two factors of authentication, such as an entry card and biometric identifier. The government has 32 factors to choose from in this category.
For the most sensitive areas, exclusion access would require a third form of authentication, such as an attended biometric or a Federal Information Processing Standards 201-compliant authentication key.
Agencies can use as many as 71 combinations of factors to secure government buildings at all the levels. "The mechanisms can be combined in many ways, and the cases and rules for combining them are all in the document," MacGregor said.