NIST proposes changes to rules for smart ID card
- By Jason Miller
- Sep 19, 2005
Agencies will have to add an extra data field to their smart cards if a proposed revision to the first phase of Homeland Security Presidential Directive 12 is approved.
The National Institute of Standards and Technology earlier this month issued a request for comments on two changes to the Federal Information Processing Standard 201 Personal Identity Verification I (PIV 1).
One change would alter the way interim-approved employees are tracked in systems versus employees who have been fully vetted. A NIST official said there will be an indicator stored in one of the fields on the card that will show whether the person is interim or fully cleared.
Agency officials said while this seems like a minor change, it could cost a small to midsize agency more than $500,000. The majority of the cost, sources said, would be to reprogram the field once the employee is fully cleared.
The other change would give agencies a bit of a reprieve in how many security checks personnel must undergo before receiving credentials.
NIST is proposing letting agencies issue interim credentials to employees after they submit to an FBI fingerprint check and have been vetted against various terrorist and criminal watch lists.
Agencies have until Oct. 27 to comply with PIV I'including the proposed changes'which outlines how agencies should implement standards for issuing and registering employee and contractor identity cards. In July, NIST issued guidelines to help agencies verify that organizations issuing new governmentwide identification cards are meeting the new standards.
Agencies have until Oct. 26, 2006, to start implementing PIV II, which requires issuing credentials using the new standards and having interoperable systems. PIV II must be completed by Oct. 27, 2007, the Office of Management and Budget said in a recent memo.
Previously, in PIV I, NIST required all agency personnel to go through the full set of five National Agency Checks before receiving a credential, the NIST official said.
The proposed changes to PIV I were first outlined in the OMB memo. NIST will accept comments until Oct. 2.