The Seamless Framework For Personal Identity Verification

Key Takeaways

• PIV is defined by FIPS 201-3, published January 24, 2022, the current version of the federal identity credentialing standard.
• PIV cards carry mandatory X.509 certificates for PIV Authentication and Card Authentication, validated through agency PKI chained to the Federal PKI.
• NIST SP 800-73-5 (card interfaces) and SP 800-78-5 (cryptographic algorithms and key sizes) were finalized in July 2024 to align with FIPS 201-3; SP 800-79-2 (2015) still governs card issuer authorization, with a Revision 3 draft still open.
• PIV-I extends interoperability to non-federal affiliates, while CAC is the Department of Defense’s PIV-conformant credential, issued through DEERS/RAPIDS rather than a civilian agency PIV Card Issuer.
• An expired or misconfigured PIV certificate can break facility access, VPN, smart card logon, and signed email at the same time, since one credential backs all of them.

Published: April 2022. Updated: August 2026. Reviewed by Encryption Consulting’s PKI team.

What Is Personal Identity Verification (PIV) and What Does FIPS 201-3 Require?

Personal Identity Verification (PIV) is a U.S. federal government framework, defined by NIST FIPS 201-3, for identity-proofing federal employees and contractors and issuing them a smart card credential that supports multi-factor authentication (MFA). PIV is not a product or a vendor technology. It is a mandatory standard: every executive branch agency issuing an identity credential to an employee or contractor who needs long-term physical or system access must follow it.

FIPS 201-3 requires agencies to cover the full identity lifecycle, not just the card itself:

1. Identity proofing: in-person or, under FIPS 201-3, supervised remote identity proofing before a credential is ever issued.
2. Credential issuance: production of the physical PIV card and loading of its embedded certificates and biometric data by an authorized PIV Card Issuer (PCI).
3. Usage: authentication for physical access control systems (PACS), smart card logon, S/MIME email signing and encryption, and, where issued, derived PIV credentials for mobile devices.
4. Maintenance and termination: revocation, reissuance, and expiration handling as employment or contractor status changes.

PIV traces back to Homeland Security Presidential Directive 12 (HSPD-12), signed August 27, 2004, which ordered a common, interoperable identification standard for federal employees and contractors. NIST answered with the original FIPS 201 in 2005, and the standard has been revised twice since to keep pace with cryptography, mobile access, and identity-proofing practices.

What Is FIPS 201’s History and Current Version Status?

FIPS 201 has gone through three major revisions since 2005. Each revision responded to a specific gap: mobile access, non-federal interoperability, or deprecated cryptography.

Version	Status	What Changed
FIPS 201 (original)	Superseded	Published February 2005 in response to HSPD-12, establishing the original PIV framework and companion standards (SP 800-73, SP 800-76, SP 800-78).
FIPS 201-1	Superseded	2006 revision, clarifying implementation guidance for the original standard.
FIPS 201-2	Superseded	2013 revision, adding derived PIV credentials for mobile devices and introducing PIV-I for non-federal issuers.
FIPS 201-3	Current, published January 24, 2022	Removed the Cardholder Unique Identifier (CHUID) as an authentication mechanism, deprecated symmetric card authentication keys, added supervised remote identity proofing, expanded derived PIV credentials, and added federation support for interagency trust.

FIPS 201-3 does not stand alone. Its companion NIST Special Publications carry the technical detail:

• NIST SP 800-73-5 (Parts 1 to 3) defines the PIV card’s data model, card edge interface, and application programming interface. Finalized in July 2024, it removed deprecated authentication mechanisms, capped PIN and activation retry attempts at 10, and made the PIV Middleware specification optional.
• NIST SP 800-78-5 sets the cryptographic algorithms and key sizes the PIV card and relying systems must support. Also finalized in July 2024, it deprecated 3TDEA (Triple DES), retired obsolete testing components, and requires a minimum 128-bit security strength for authentication starting in 2031.
• NIST SP 800-79-2, published in 2015, remains the current governing guideline for authorizing PIV Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI). A draft Revision 3 has circulated for public comment since 2023 but had not been finalized as of this update.

What Technologies and Systems Does PIV Affect?

PIV is not confined to the badge in an employee’s wallet. It touches every system that trusts that badge’s certificates.

• PIV cards. Contact and contactless smart cards conforming to SP 800-73-5, carrying at minimum a Card Holder Unique Identifier, a Card Capability Container, and two mandatory X.509 certificates.
• X.509 certificates. Every PIV card carries a PIV Authentication certificate and a Card Authentication certificate. Cardholders with a government email account at issuance also receive Digital Signature and Key Management certificates. All four are issued through agency PKI hierarchies that chain to the Federal Common Policy Framework.
• Card readers and middleware. Physical access control systems (PACS) at federal facilities and workstation card readers used for smart card logon both depend on middleware that must track SP 800-73-5 and SP 800-78-5 updates to keep working.
• Derived PIV credentials. Software or hardware-backed credentials issued to a mobile device in place of a physical card, expanded under FIPS 201-3 for remote and hybrid work.
• Federal PKI infrastructure. Agency issuing certificate authorities, the Federal Bridge Certification Authority, and the Federal Common Policy Framework that ties agency PKI hierarchies together for cross-agency trust.
• Related credentials. PIV-I for non-federal affiliates and CAC, the Department of Defense’s PIV-conformant card, both discussed in the comparison table below.

What Happens When PIV Deployments Are Non-Compliant or Poorly Managed?

Because one PIV credential backs multiple systems, a single certificate or issuance failure has an outsized blast radius.

• Simultaneous access failures. An expired or revoked PIV Authentication certificate can lock a cardholder out of facility badge access, VPN, smart card logon, and signed email at once, since all four rely on the same credential.
• Audit and FISMA findings. Agencies are assessed against FIPS 201-3 and, for Zero Trust posture, against OMB M-22-09, the January 2022 memorandum requiring phishing-resistant MFA (PIV being the reference implementation). Expired PCI/DPCI authorizations under SP 800-79 or unremediated legacy authentication mechanisms surface as inspector general or FISMA audit findings.
• Residual weak authentication paths. Systems still trusting CHUID-only authentication or symmetric card authentication keys, both deprecated under FIPS 201-3, keep a weaker verification path alive even after the card itself has been reissued to the current standard.
• Reissuance backlogs. When certificate authorities or card middleware have not been updated for SP 800-73-5 and SP 800-78-5, agencies see reissuance queues grow, which delays onboarding and access restoration for new and returning staff.

How Do You Verify PIV Card and Certificate Validity?

Verifying a PIV card is really three separate checks working together, matching the mechanisms FIPS 201-3 defines: card validation, credential validation, and cardholder validation.

1. Inspect the card. Confirm tamper-proofing and tamper-resistant physical characteristics conform to SP 800-73-5’s physical topology requirements.
2. Validate the certificate path. Confirm the PIV Authentication certificate chains to the Federal Common Policy Framework or the Federal Bridge, and check revocation status through OCSP or a current CRL, not a cached result.
3. Check the algorithm and key size. Compare the certificate’s algorithm and key length against SP 800-78-5 minimums, and flag anything still relying on deprecated 3TDEA.
4. Confirm cardholder match. Verify the PIN, and where required, match a live biometric sample against the biometric data embedded on the card.
5. Confirm issuer authorization. Verify the issuing PIV Card Issuer (PCI) or Derived PIV Credential Issuer (DPCI) authorization is current under SP 800-79-2.
6. Run periodic inventory. Reconcile issued PIV and derived PIV credentials against active employment and contractor records on a recurring schedule, not only at audit time.

PIV Deployment and Compliance Checklist

1. Confirm your identity-proofing and enrollment workflow matches FIPS 201-3, including supervised remote identity proofing options if used.
2. Verify your PIV Card Issuer (PCI) and Derived PIV Credential Issuer (DPCI) authorization is current under SP 800-79-2.
3. Confirm card production and card interfaces conform to SP 800-73-5, Parts 1 through 3.
4. Confirm issued certificates and key sizes meet SP 800-78-5 minimums, and remove reliance on deprecated 3TDEA or CHUID-only authentication.
5. Chain every PIV Authentication and Card Authentication certificate to the Federal Common Policy Framework, and confirm OCSP and CRL responders are reachable from relying-party systems.
6. Enable derived PIV credentials for mobile access where hardware-backed device credentials are needed, under the expanded FIPS 201-3 provisions.
7. Map every PACS, VPN, smart card logon, and S/MIME relying system to certificate expiration monitoring so a renewal cycle never causes an unplanned access outage.
8. Document PIV-I or CAC handling separately if your organization interacts with non-federal affiliates or DoD-issued credentials.
9. Align MFA enforcement with OMB M-22-09’s phishing-resistant authentication requirements.
10. Schedule a recurring compliance review, at least annually, against the current FIPS 201 revision and its companion SP 800-73, SP 800-78, and SP 800-79 publications.

Update Log

Date	Change
April 2022	Original publication, covering FIPS 201-2 and general PIV card structure.
August 2026	Full refresh: updated to FIPS 201-3 (published January 24, 2022), added SP 800-73-5 and SP 800-78-5 finalization details (July 2024), added SP 800-79-2 issuer authorization status, added PIV vs. PIV-I vs. CAC comparison table, added detection, remediation, and impact sections, and corrected the deprecated CIV terminology to PIV-I and CAC, the two credentials actually in active use.

PIV vs. PIV-I vs. CAC: How Do the Three Credentials Compare?

PIV is the federal civilian baseline. Two related credentials extend or adapt that baseline for audiences PIV itself does not cover.

Credential	Issuing Authority	Primary Use Case	Interoperability
PIV	Federal agency PIV Card Issuer (PCI), authorized under SP 800-79-2	Federal employees and contractors needing long-term access to federal facilities or information systems	Full parity across federal agencies through the Federal Common Policy Framework
PIV-I	Non-federal issuers cross-certified with the Federal Bridge Certification Authority	State and local government, first responders, and other non-federal affiliates who must interoperate with federal relying parties	Technically compatible with PIV infrastructure and trusted by federal relying parties, without the same federal background investigation PIV requires
CAC	Department of Defense, issued through DEERS/RAPIDS	DoD service members, civilian employees, and eligible contractors	FIPS 201/PIV-conformant, but issued and managed entirely within DoD’s own systems rather than by a civilian agency PCI

Limitations

• PIV governs U.S. federal identity credentialing only. It is not a general commercial identity-verification (KYC) framework, and vendor marketing that describes consumer identity checks as “PIV-based” is using the term loosely.
• PIV-I adoption remains narrower than PIV itself. Most non-federal organizations that need to interoperate with federal systems use SAML or OIDC federation rather than issuing PIV-I cards.
• FIPS 201-3 does not mandate a specific PKI or hardware token vendor, so conformance testing against the GSA FIPS 201 Evaluation Program Approved Products List is still required before deployment.
• Legacy relying-party systems built against FIPS 201-2 assumptions, including CHUID-only authentication, need remediation before they can be considered aligned with FIPS 201-3.

What Would Encryption Consulting Recommend?

A PIV card is only as trustworthy as the certificate lifecycle behind it. The card itself rarely fails; the certificates, the issuing CA chain, and the revocation infrastructure behind it are what actually break under audit pressure. Three things consistently separate agencies and contractors that pass their reviews from those that don’t.

First, automate certificate lifecycle management instead of tracking PIV Authentication, Card Authentication, Digital Signature, and Key Management certificates in a spreadsheet. CertSecure Manager discovers, monitors, and renews certificates across your issuing CA hierarchy, so an expiring PIV certificate never becomes a locked-out badge reader or a failed VPN login.

Second, if you are standing up or modernizing the PKI hierarchy behind agency-issued or PIV-I credentials, PKI-as-a-Service and our PKI Services, including CP/CPS development aligned to Federal Bridge cross-certification requirements, give you a Federal PKI-ready foundation without building and operating the CA infrastructure in-house.

Third, treat FIPS 201-3, SP 800-79 issuer authorization, and OMB M-22-09 as one compliance program, not three. Our Compliance Advisory practice maps federal identity requirements to your actual deployment so audit prep stops being a fire drill.

Encryption Consulting is ISO/IEC 27001:2022 and SOC 2 certified, and holds a Texas minority-owned business certification, credentials that matter directly when you’re procuring PKI services for a federal or federally adjacent identity program.

Conclusion

Personal Identity Verification is a well-defined federal standard, not a general identity-verification concept, and the version in force today is FIPS 201-3, backed by SP 800-73-5, SP 800-78-5, and SP 800-79-2. Getting PIV right is less about the smart card and more about the certificate lifecycle, the PKI hierarchy, and the issuer authorization behind it. Agencies and contractors that verify certificate validity on a schedule, keep issuer authorizations current, and remediate deprecated authentication mechanisms avoid the access failures and audit findings that catch everyone else off guard.

Frequently Asked Questions

What is the difference between a PIV card and a CAC? Both are FIPS 201-conformant smart cards built on the same PIV data model and certificate structure. The difference is who issues and manages them: civilian federal agencies issue PIV cards through an authorized PIV Card Issuer under SP 800-79-2, while the Department of Defense issues CACs to service members, civilian employees, and eligible contractors through its own DEERS/RAPIDS system.

Do I need a background investigation to get a PIV card? Yes. PIV issuance requires identity proofing and a background investigation appropriate to the position’s risk level before a credential is produced. This is one of the main things that separates PIV from PIV-I, which does not require the same federal background investigation.

What is a derived PIV credential? A derived PIV credential is a software or hardware-backed credential issued to a mobile device in place of a physical PIV card, so a cardholder can authenticate from a phone or tablet without a card reader. FIPS 201-3 expanded support for derived credentials to better fit remote and hybrid federal work.

Is FIPS 201-2 still valid, or must agencies use FIPS 201-3? FIPS 201-3, published January 24, 2022, is the current standard, and agencies are expected to align new issuance and system design to it. FIPS 201-2 is superseded; systems still relying on FIPS 201-2 authentication mechanisms it deprecated, such as CHUID-only authentication, should be remediated.

Can a commercial organization use PIV? A commercial organization cannot issue PIV cards; PIV issuance is restricted to authorized federal PIV Card Issuers. A commercial organization that needs to interoperate with federal systems, such as a contractor or a state or local government partner, uses PIV-I instead, issued by a non-federal issuer cross-certified with the Federal Bridge.

References

• NIST FIPS 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors
• NIST FIPS 201 project page
• NIST SP 800-73-5, Interfaces for Personal Identity Verification
• NIST SP 800-78, Cryptographic Algorithms and Key Sizes for Personal Identity Verification
• NIST SP 800-79-2, Guidelines for the Authorization of PIV Card Issuers and Derived PIV Credential Issuers
• OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles