PIV-I White Paper - FINAL - 022111 - Smart Card Alliance

9 Appendix A: Standards EffortsOrganizationNorth American SecurityProducts Association(NASPO)National Institute ofStandards andTechnology (NIST)American Association ofMotor VehicleAdministrators (AAMVA)American Bar AssociationFederated IdentityManagement Legal TaskForceInternational Organizationfor Standardization (ISO)DescriptionNASPO is a non-profit organization that certifies that government andbusiness organizations providing identity documents, financial instruments,and other value documents are operating under a uniform set of acceptedstandards and practices.NASPO certification is an audit process that verifies compliance with the newANSI/NASPO Security Assurance Standard. The process begins with anassessment of vulnerability followed by the identification of any risks.For example, the process for an organization producing and issuing IDdocuments includes process certification of the entire supply chain (such aspaper mill procedures to ensure a secure paper stock), printer and printingprocesses, and issuing procedures. All certification steps are designed toenhance trust in the final ID document.http://www.naspo.info/The NIST Information Technology Laboratory (ITL) accelerates thedevelopment and deployment of information and communication systemsthat are reliable, usable, interoperable, and secure; advances measurementscience through innovations in mathematics, statistics, and computerscience; and conducts research to develop the measurements and standardsinfrastructure for emerging information technologies and applications throughstandards development.Federal Information Processing Standards (FIPS) 201 is the standard thatsupports both PIV credential standards for Federal agencies and PIV-Icredential standards for states, local and private sector businesses.FIPS 201 standard: http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdfPIV-I guidance:http://www.idmanagement.gov/documents/PIV_IO_NonFed_Issuers_May2009.pdfAAMVA published the 2009 DL/ID Card Design Standard (CDS).The CDS provides for the design of driver licenses (DL) and identification(ID) cards. The intent is to improve the security of the DL/ID cards and thelevel of interoperability among cards issued by all North Americanjurisdictions. The standard includes machine-readable technologies as wellas a test tool issuing entities can use to verify compliance with the CDSstandard.The AAMVA Courtesy Verification Program (CVP) provides an effective wayfor AAMVA members to determine whether DL/ID cards using machinereadabletechnologies conform to the applicable AAMVA standards andspecificationsThis task force focuses on identifying and analyzing the legal issues thatarise in connection with the development, implementation, and use offederated identity management systems; evaluating appropriate legal modelsto address issues proactively; and developing model terms and contracts thatcan be used by parties and more.The task force work is found at:www.abanet.org/dch/committee.cfm?com=CL320041The ISO JTC1 creates common criteria for international use and recognitionof driver’s licenses without impeding individual national and regionalSmart Card Alliance © 201124