VA awards contract for PIV card management
- By William Jackson
- May 21, 2008
The Veterans Affairs Department has awarded Verizon Business the first contract under the GSA schedule for managing new smart government ID cards.
The $6.1 million contract calls for Verizon to handle certificates for up to 500,000 cards to VA employees and contractors over the initial one-year term and two optional years.
'We have already been issuing cards,' said Tom Greco, director of Verizon's ID management solutions. 'The VA was a little ahead of the game,' and began issuing cards before standards were completed. Under the new contract, VA expects to ramp up issuance of cards compliant with the presidential mandate to a rate of thousands a day.
Homeland Security Presidential Directive 12 required agencies to use the Personal Identity Verification cards for both physical and logical access. The directive called for the cards to be based on in-person authentication of the holder's identity and to be issued by a trusted authority, to be resistant to fraud and be authenticated electronically. The National Institute of Standards and Technology established specifications for a card that include a chip holding biometric data and digital certificates. Technical standards for the card were defined in Federal Information Processing Standard (FIPS) 201.
Verizon began issuing strong authentication smart ID cards for VA before FIPS 201 was finalized, and began issuing PIV-compliant cards late last year, Greco said. When its original contract was completed VA awarded a new contract from the GSA schedule, choosing Verizon for the follow-on.
The department has issued about 5,000 of the PIV cards to date. 'It's a challenge,' to issue to the entire employee and contractor population of the largest civilian agency with facilities around the country, Greco said.
VA is using a hub-and-spoke model for the process, with the spokes being enrollment and issuing sites around the country supported by systems integrators. Verizon provides the hub at a secure data center plus a hot backup site with 24-hour support. Verizon provides lifecycle management for the cards and the digital certificates and hosts a card management system that manages the data going onto the cards. The department has separate contracts to provide the smart card stock, and LS3 Inc. of Columbia, Md., is the integrator for the card issuing system.
The department now is operating about 12 enrollment and issuing sites, issuing 40 to 50 cards a day. It expects to have 35 sites running by the end of the year issuing 700 to 900 cards a day, and eventually to stand up 250 sites.
VA expects to issue the full 500,000 cards called for in the contract, which will be a rolling total including card replacement and employees entering and leaving the department.
William Jackson is a Maryland-based freelance writer.