Agencies aren't making full use of smart PIV cards
Connecting state and local government leaders
Although most government employees and contractors have cards, agencies seldom use them for network access and still don't trust cards issued by other agencies, the Government Accountability Office says in a recent report.
Seven years after the presidential directive ordering creation of a common, interoperable smart ID card for government employees and contractors, agencies are failing to make full use of the PIV card, according to the Government Accountability Office.
The GAO report on implementation of Personal ID Verification cards said the progress in eight agencies studied was mixed. Substantial progress has been made in issuing the cards and fair progress in using them for physical access to government facilities. But the report identified limited progress in using them for access to government networks and minimal progress in cross-agency acceptance.
At issue is not whether PIV cards are being used for identification but whether agencies are making full use of the electronic capabilities included in the cards’ chips. The chips contain biometric and other identifying data and cryptographic keys, with the ability to process and exchange data with other devices.
Related stories:
PIV Cards are in the hands of most federal employees and contractors
Will feds trust nonfederal ID card for contractors and agency partners?
Problems cited in the report for the lack of widespread use of these capabilities are not technical but administrative: Logistics, agency priorities and, of course, budgets.
“According to agency officials, a lack of funding has. . .slowed the use of PIV credentials for both physical and logical access,” the report states.
Logistical difficulties in issuing cards to remote field personnel and a lack of programs for tracking and revoking cards that have been issued will continue to make full use of card capabilities a challenge, GAO concluded.
Departments and agencies included in the GAO report were the Agriculture, Commerce, Homeland Security, Housing and Urban Development, Interior, and Labor departments, as well as NASA and the Nuclear Regulatory Commission.
Homeland Security Presidential Directive 12 was issued in 2004 requiring creation and use of a common, interoperable ID card for both physical and logical access control. The National Institute of Standards and Technology issued Federal Information Processing Standard 201, with technical and issuing requirements for PIV cards, in February 2005.
The Office of Management and Budget, which oversees implementation of HSPD-12, required initial use for FIPS 201-compliant credentials for persons with 15 years government seniority or less by October 2007 and all other employees and contractors one year later.
Compliance has been spotty, however. DHS reported that as of December 2010, agencies reported that about 5 million of 5.7 million employees and contractors had completed the required background investigations and 4.5 million had received PIV credentials.
“With the majority of the federal workforce now in possession of the credentials, agencies are in a position to aggressively step up their efforts to use the electronic capabilities of the credentials,” DHS said in a February memorandum laying out requirements for implementing PIV cards.
The memorandum, issued by OMB, required all agencies to have an implementation plan in place by March 31. Under these plans, all new systems in development would have to be enabled to use PIV credentials, and existing systems would have to be enabled by October 2011. Agencies also must be able to process and verify PIV cards issued by other agencies.
One of the roadblocks to implementing use of the cards is that even though most employees and contractors have one, the cards are not yet universal and systems still must also accommodate non-cardholders. And although conformance and performance testing programs for access control products have been established and evaluated products are available on General Services Administration schedule contracts, not all systems and applications are PIV-enabled. As a result, there is little incentive to fully use the cards.
GAO found that at NASA, where 83 percent of agency’s Windows desktops are equipped with PIV card readers, only 10 percent were using the cards. “According to NASA officials, users reported in a survey that they did not see the benefits of using the PIV card to access the agency network because they still had to maintain their network password to access other software applications or to access the network from another device.”
With limited use of the credentials within agencies, enabling use of them across agencies has been a low priority. Only one of the agencies reviewed by GAO, NASA, had plans to establish a system for universally reading and electronically validating PIV cards issued by all other federal agencies. The space agency is developing a formal credential registration process that would let it enroll the credentials of employees from other agencies who need access to NASA facilities and information systems. NASA officials estimated the project would be completed by the end of September.
Departments and agencies must do a better job of tracking, managing and revoking PIV cards, especially those issued to contractors, if they are to be trusted by other agencies, GAO said.
“The minimal progress in achieving interoperability among agencies is due in part to insufficient assurance that agencies can trust the credentials issued by other agencies. Without greater agency management commitment to achieving the objectives of HSPD-12, agencies are likely to continue to make mixed progress in using the full capabilities of the credentials.”