SA-4(10): Use of Approved PIV Products

CSF v1.1 References:

PF v1.0 References:

Threats Addressed:

Baselines:

  • Low
  • Moderate
  • High
  • OT Low (SP 800-82r3)
  • OT Moderate (SP 800-82r3)
  • OT High (SP 800-82r3)

Previous Version:

Control Statement

Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.

Supplemental Guidance

Products on the FIPS 201-approved products list meet NIST requirements for Personal Identity Verification (PIV) of Federal Employees and Contractors. PIV cards are used for multi-factor authentication in systems and organizations.

OT Discussion

The use of approved PIV products is only required for organizations that follow OMB Memorandum M-19-17 (e.g., federal agencies and contractors). Example compensating controls include employing external products on the FIPS 201-approved products list for PIV capabilities in conjunction with OT products.