From d303f7c5882ceb79db06190ffb220ce630b11938 Mon Sep 17 00:00:00 2001 From: "Nelson R." <125207848+TheInfinityBeyonder@users.noreply.github.com> Date: Tue, 10 Sep 2024 16:59:59 -0400 Subject: [PATCH 1/3] Update pacs101.md --- _university/pacs101.md | 231 +++++++++++++++++++++++------------------ 1 file changed, 130 insertions(+), 101 deletions(-) diff --git a/_university/pacs101.md b/_university/pacs101.md index 0eab623c..afec4bca 100644 --- a/_university/pacs101.md +++ b/_university/pacs101.md @@ -32,17 +32,17 @@ subnav: ## Introduction -The **Physical Access Control System (PACS) 101** will help you understand concepts related to _Federal Identity, Credential, and Access Management_-compliant PACSs. At a high level, a PACS is a collection of technologies that control physical access at one or more federal agency sites by electronically authenticating employees, contractors, and visitors. +The **Physical Access Control System (PACS) 101** will help you understand Federal Identity, Credential, and Access Management-compliant PACSs concepts. At a high level, a PACS is a collection of technologies that control physical access at one or more federal agency sites by electronically authenticating employees, contractors, and visitors. {% include alert-no-icon.html content="The contents of these 101 guides are meant to be informative and do not serve as the basis for determining PACS compliance. Agency-specific guidance should supersede the recommendations within these guides, where appropriate." %} ## Acknowledgment -We want to thank the Secure Technology Alliance, especially the members of the Access Control Council, for contributions to the original PACS Guides which is now the PACS 101 page and permission to reuse content from their presentations and the *How to Plan, Procure and Deploy a pacs-Enabled Physical Access Control System* webinar training. +We want to thank the Secure Technology Alliance, especially the members of the Access Control Council, for contributions to the original PACS Guides which is now the PACS 101 page, and permission to reuse content from their presentations and the How to Plan, Procure, and Deploy a PIV-Enabled Physical Access Control System webinar training. Links to the training are below in the training section. ## PACS Explained -A Physical Access Control System (PACS) grants access to employees and contractors who work at or visit a site by electronically authenticating their PIV credentials. Although PACSs are information technology (IT) systems, they must be designed, deployed, and operated in cooperation with Physical Security teams to successfully meet agency mission needs. +A Physical Access Control System (PACS) grants access to employees, contractors, and visitors who work at or visit a site by electronically authenticating their PIV credentials. Although PACSs are information technology (IT) systems, they must be designed, deployed, and operated in cooperation with Physical Security teams to meet agency mission needs. ## Components @@ -50,21 +50,21 @@ The following table defines common PACS components: | **Component** | **Description** | |----------------|----------| -| **Access point** | Entrance point or physical barrier where an employee or contractor interacts with the PACS. Example access points include turnstiles, gates, and locking doors. | +| **Access point** | Entrance point or physical barrier where an employee or contractor interacts with the PACS. For example access points include turnstiles, gates, and locking doors. | | **PIV credential** | Federal employees and contractors use [Personal Identity Verification (PIV) credentials]({{site.baseurl}}/fips201ep/#personal-identity-verification-credentials){:target="_blank"}{:rel="noopener noreferrer"} to *physically access* federal facilities and *logically access* federal information systems. | -| **Credential reader and keypad** | The reader provides power to and reads data from a PIV credential. The reader also sends this data to a control panel to authenticate the PIV credential and request access authorization. Employees and contractors may need to enter a PIN into the keypad and add a biometric, depending on the facility's security classification and risk levels. | -| **Biometric reader** | Captures biometric data (for example, fingerprint or iris scan) and verifies it against the PIV credential's biometric data. | -| **Control panel** | Receives the credential data sent by the reader and verifies its presence in the credential holder data repository. It then makes an access decision and transmits authorization data to the access control server and access point. | +| **Credential reader and keypad** | The reader provides power to and reads data from a PIV credential. It also sends this data to a control panel to authenticate the PIV credential and request access authorization. Depending on the facility's security classification and risk levels, employees and contractors may need to enter a PIN into the keypad and add a biometric. | +| **Biometric reader** | It captures biometric data (such as the fingerprint, facial image, or iris scan) and verifies it against the PIV credential’s biometric data. | +| **Control panel** | It receives the credential data the reader sends and verifies its presence in the credential holder data repository. It then makes an access decision and transmits authorization data to the access control server and access point. | | **Access control server** | Grants authorization to the employee or contractor requesting access (for example, presenting a PIV credential to a reader). It also registers and enrolls employees and contractors, enrolls and validates credentials, and logs system events. | -| **Credential
holder data repository** | Contains employee and contractor data and physical access privileges. Control panels use this authoritative data to validate credential data. | -| **Auxiliary Systems** | Agencies may integrate the PACS with additional facility monitoring systems such as surveillance systems, fire alarm systems, and evacuation systems. | +| **Credential
holder data repository** | It contains employee and contractor data and physical access privileges. Control panels use this authoritative data to validate credential data. | +| **Auxiliary Systems** | Agencies may integrate the PACS with additional facility monitoring systems, such as surveillance, fire alarm, and evacuation systems.| -{% include alert-no-icon.html content="All agency-purchased PACS components must be FIPS 201-compliant and selected from GSA's Approved Products List (APL) for PACS Products. The products in this list have undergone vulnerability and interoperability testing through the FIPS 201 Evaluation Program. As an IT system, a PACS must still complete Certification and Accreditation and obtain an Authority to Operate from your agency before connecting to the network." %} +{% include alert-no-icon.html content="All agency-purchased PACS components must be FIPS 201-compliant and selected from [GSA's Approved Products List (APL) for PACS Products](https://www.idmanagement.gov/acquisition-professionals/#products){:target=\"_blank\"}{:rel=\"noopener noreferrer\"}. The products in this list have undergone vulnerability and interoperability testing through the FIPS 201 Evaluation Program. As an IT system, a PACS must still complete Assessment and Authorization (A & A) and obtain an Authority to Operate from your agency before connecting to the network." %} ## Compliant PACS Characteristics In May 2019, the Office of Management and Budget (OMB) released memorandum [M-19-17](https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf){:target="_blank"}{:rel="noopener noreferrer"}{:class="usa-link usa-link--external"}, _Enabling Mission Delivery through Improved Identity, Credential, and Access -Management_. Related to PACS, M-19-17 rescinded memorandum [M-11-11](https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf){:target="_blank"}{:rel="noopener noreferrer"}{:class="usa-link usa-link--external"}, _Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors_. The updated guidance adds further specificity to require the use of PIV credentials for physical access to federal facilities, implemented per _[The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard](https://www.cisa.gov/sites/default/files/publications/The%20Risk%20Management%20Process%20-%202021%20Edition_2.pdf){:target="_blank"}{:rel="noopener noreferrer"}{:class="usa-link usa-link--external"}_ and NIST [SP 800-116, Revision 1](https://csrc.nist.gov/publications/detail/sp/800-116/rev-1/final){:target="_blank"}{:rel="noopener noreferrer"}{:class="usa-link usa-link--external"}, _ Guidelines for the Use of PIV Credentials in Facility Access_. +Management_. Related to PACS, M-19-17 rescinded memorandum [M-11-11](https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf){:target="_blank"}{:rel="noopener noreferrer"}{:class="usa-link usa-link--external"}, _Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors_. The updated guidance adds further specificity to require the use of PIV credentials for physical access to federal facilities, implemented per _[The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard](https://www.cisa.gov/sites/default/files/publications/The Risk Management Process - 2021 Edition_2.pdf){:target="_blank"}{:rel="noopener noreferrer"}{:class="usa-link usa-link--external"}_ and NIST [SP 800-116, Revision 1](https://csrc.nist.gov/publications/detail/sp/800-116/rev-1/final){:target="_blank"}{:rel="noopener noreferrer"}{:class="usa-link usa-link--external"}, Guidelines for the Use of PIV Credentials in Facility Access. Characteristics of NIST SP 800-116, Revision 1, compliant systems include, but are not limited to: - Use high-assurance credentials for electronic authentication of employees and contractors. @@ -73,7 +73,7 @@ Characteristics of NIST SP 800-116, Revision 1, compliant systems include, but a - Interoperate with PIV credentials issued by other agencies. - Use components listed on the GSA FIPS 201 Approved Products List (APL). -The FIPS 201 Evaluation Program in collaboration with the [PACS Modernization Working Group]({{site.baseurl}}/ficam/#identity-credential-and-access-management-subcommittee){:target="_blank"}{:rel="noopener noreferrer"} created an operational self-assessment tool. The tool helps PACS implementers determine if facility access systems that use PIV credentials are configured according to FICAM and NIST guidelines. +The FIPS 201 Evaluation Program, in collaboration with the PACS Modernization Working Group, created an operational self-assessment tool. The tool helps PACS implementers determine whether facility access systems that use PIV credentials are configured according to FICAM and NIST guidelines. - [PACS Assessment Toolkit Version 1.0]({{site.baseurl}}/docs/fips201ep-pacs-self-tool.pdf){:target="_blank"}{:rel="noopener noreferrer"} @@ -81,12 +81,12 @@ The FIPS 201 Evaluation Program in collaboration with the [PACS Modernization Wo There are two PACS deployment models. -1. Standalone PACS - a local system that controls physical access to a facility or specific areas within it. +1. Standalone PACS - a local system that controls physical access to a facility or specific areas within the facility. 2. Enterprise PACS (E-PACS) - extends the concept of a standalone PACS to act as a unified, enterprise-wide system that controls physical access at most (or all) sites that belong to an agency. ## Standalone PACS -A standalone PACS is a local system that controls physical access to a facility or specific areas within it—for example, a Sensitive Compartmented Information Facility (SCIF). Standalone PACSs are facility-centric, and consequently, these systems typically do not connect to enterprise networks. While this deployment model tends to be the most common and uncomplicated method of managing access to controlled areas, it has several challenges. +A standalone PACS is a local system that controls physical access to a facility or specific areas within it—for example, a Sensitive Compartmented Information Facility (SCIF). Standalone PACSs are facility-centric; consequently, these systems typically do not connect to enterprise networks. While this deployment model tends to be the most common and uncomplicated method of managing access to controlled areas, it has several challenges. ### Standalone PACS' Operational Challenges @@ -98,14 +98,16 @@ Agencies that use standalone PACSs have encountered operational challenges: * Agencies experience reduced situational awareness (for example, logs cannot be correlated across the enterprise). * Agencies with many standalone PACSs see increased human error, such as data entry errors. -{% include alert-no-icon-success.html content="Can agencies centrally control physical access for most, or all, of their sites? Yes. The answer is to implement an Enterprise Physical Access Control System." %} + +{% include alert-no-icon-success.html content="Can agencies centrally control physical access for most or all of their sites? Yes. The answer is to implement an Enterprise Physical Access Control System." %} ## Enterprise PACS -An Enterprise PACS (E-PACS) extends the concept of a standalone PACS to act as a unified, enterprise-wide system that controls physical access at most (or all) sites that belong to an agency. E-PACSs address the operational challenges of standalone PACSs and improve system management, scalability, monitoring, and performance. +An Enterprise PACS (E-PACS) extends the concept of a standalone PACS to act as a unified, enterprise-wide system that controls physical access at most (or all) agency-owned sites. E-PACSs address the operational challenges of standalone PACSs and improve system management, scalability, monitoring, and performance. E-PACSs rely on the same components as standalone PACSs. However, an essential architectural distinction is that an E-PACS connects to an agency's enterprise network, whereas a PACS typically does not. + {% include alert-no-icon.html content="Some agencies need standalone PACSs for their unique sites and missions, but most agencies could benefit from transitioning to an E-PACS." %} ### Would an Enterprise PACS Work for Our Agency? @@ -120,20 +122,25 @@ Here are some key E-PACS advantages to consider: * Reduced costs for system management, such as patching, server system administration, and software updates. * Reduced costs for reporting, such as Federal Information Security Modernization Act [FISMA] reporting. * Reduced costs for: - * Server hardware - * System security assessment and accreditation + * Server Hardware + * System Security Assessment and Authorization (A & A) ## Aligning Facility Security Level and Authentication Federal agencies rely on Physical Access Control Systems (PACSs) and Personal Identity Verification (PIV) credentials to confirm that an employee, contractor, or visitor _is_ or _is not_ authorized to access a site and its critical assets, such as systems, information, and people. -To protect your agency's critical assets, you must assess each site's risk level (called *Facility Security Level*) and decide what level of PIV credential authentication is required (called *authentication mechanism*). +To protect your agency's critical assets, you must assess each site's risk level (called *Facility Security Level*) and decide what PIV credential authentication is required (called *authentication mechanism*). -Additional guidance regarding aligning FSL to PACS authentication factors can be found in the [Security Control Overlay for Electronic Physical Access Control Systems (ePACS)]({{site.baseurl}}/docs/pacs-800-53-overlay.pdf){:target="_blank"}{:rel="noopener noreferrer"} . This overlay provides additional guidance on configuring and securing PACS systems in accordance with relevant guidance and in support of the NIST Risk Management Framework (RMF). +The Security Control Overlay for Electronic Physical Access Control Systems (ePACS) provides additional guidance on aligning FSL to PACS authentication factors. This overlay provides additional guidance on configuring and securing PACS systems in accordance with relevant guidance and in support of the NIST Risk Management Framework (RMF). ## Assess Facility Security Level -{% include alert-no-icon.html content="These federal standards provide guidance for assessing FSL, including how to categorize site risks:
- The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard
- NIST SP 800-116, Revision 1, Guidelines for the Use of PIV Credentials in Facility Access. " %} +{% include alert-no-icon.html content=" +These federal standards provide guidance for assessing FSL, including how to categorize site risks: + +- [The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard](https://www.cisa.gov/sites/default/files/publications/The%20Risk%20Management%20Process%20-%202021%20Edition_2.pdf){:target=\"_blank\"}{:rel=\"noopener noreferrer\"}{:class=\"usa-link usa-link--external\"} +- [NIST SP 800-116, Revision 1, Guidelines for the Use of PIV Credentials in Facility Access](https://csrc.nist.gov/publications/detail/sp/800-116/rev-1/final){:target=\"_blank\"}{:rel=\"noopener noreferrer\"}{:class=\"usa-link usa-link--external\"}" %} + ![]({{site.baseurl}}/assets/img/check-box.png){:style="float:center"}   **Inventory critical assets for each agency site** - When you inventory critical assets, also document any challenges to secure them.

Examples of critical assets include: @@ -168,17 +175,17 @@ Additional guidance regarding aligning FSL to PACS authentication factors can be |Impact Level | Description | |:---------|:------------| | *Low*| The loss of confidentiality, integrity, or availability could have a **limited** adverse effect on organizational operations, organizational assets, or individuals.| -| *Moderate* | The loss of confidentiality, integrity, or availability could have a **serious** adverse effect on organizational operations, organizational assets, or individuals.| +| *Moderate* | The loss of confidentiality, integrity, or availability could seriously affect organizational operations, assets, or individuals.| |*High* | The loss of confidentiality, integrity, or availability could have a **severe or catastrophic** adverse effect on organizational operations, organizational assets, or individuals. | ![]({{site.baseurl}}/assets/img/check-box.png){:style="float:center"}  **Create a site map of categorized assets** - This map will help you determine each security area's minimum security level. -{% include alert-no-icon.html content="As an alternative to assessing a site's risk, you can select a pre-determined FSL as described in The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard." %} +{% include alert-no-icon.html content="As an alternative to assessing a site's risk, you can select a pre-determined FSL as described in The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard" %} ## Categorize Security Areas -{% include alert-no-icon.html content="Agencies may use different terms for their security areas; however, each agency should establish its criteria for authentication mechanisms, according to NIST SP 800-116, Revision 1, Guidelines for the Use of PIV Credentials in Facility Access." %} +{% include alert-no-icon.html content="Agencies may use different terms for their security areas; however, each agency should establish its criteria for authentication mechanisms, according to NIST SP 800-116, Revision 1, Guidelines for the Use of PIV Credentials in Facility Access" %} ![]({{site.baseurl}}/assets/img/check-box.png){:style="float:center"}  **Categorize security areas** - Once you've inventoried and mapped assets by risk and impact level, it's time to categorize security areas. @@ -187,55 +194,56 @@ Additional guidance regarding aligning FSL to PACS authentication factors can be |Category | Description| |:---------|:------------| | *Exclusion*| An area where uncontrolled movement would permit direct access to a security asset, such as a Sensitive Compartmented Information Facility (SCIF).| -| *Limited* | An area near a secure asset. Uncontrolled movement within a limited area may permit access to an asset. Escorts and other restrictions can prevent access.| -|*Controlled* | An area near or surrounding a Limited or Exclusion area, such as a facility lobby. A Controlled area provides administrative control, safety, or a buffer zone for embedded Limited or Exclusion areas. Movement of authorized personnel within this area usually is not controlled because this area doesn't provide immediate access to secure assets. | +| *Limited* | An area near a secure asset. Uncontrolled movement within a limited area may permit access to an asset. Escorts and other restrictions can prevent access.| +|*Controlled* | An area near or surrounding a Limited or Exclusion area, such as a facility lobby. A Controlled area provides administrative control and safety or a buffer zone for embedded Limited or Exclusion areas. The movement of authorized personnel within this area usually is not controlled because it doesn’t provide immediate access to secure assets. | -- Assign the same risk level as the highest risk asset within the area. +- Assign the same risk level as the highest-risk asset within the area. - Example: If three (3) assets exist within a security area: one Low-risk, one Moderate-risk, and one High-risk, you must categorize the security area as **High-risk**. Alternatively, the area may be split into three (3) security areas that each have a different risk level. ## Determine Authentication Factors -{% include alert-no-icon.html content="NIST SP 800-116, Revision 1, Guidelines for the Use of PIV Credentials in Facility Access recommends the following method to determine authentication factors for Exclusion, Limited and Controlled security areas." %} +{% include alert-no-icon.html content="NIST SP 800-116, Revision 1, Guidelines for the Use of PIV Credentials in Facility Access, recommends the following method to determine authentication factors for Exclusion, Limited, and Controlled security areas." %} ![]({{site.baseurl}}/assets/img/check-box.png){:style="float:center"}  **Determine authentication factors required for security area categories** - Once you have categorized all security area categories, you will select the minimum number of authentication factors (1, 2, or 3) needed to access and safeguard the facility: | Category| Minimum Number of Factors | Description| |:---------|:--------------------------:|:------------| -|*Exclusion*| 3| Exclusion areas require all three authentication factors: Something you have, such as a PIV credential; something you know, such as the PIV credential PIN; and something you have on or in your body, such as a fingerprint or iris scan.| -|*Limited* | 2 | Limited areas require 2 of the 3 authentication factors, such as a PIV credential and PIN or a PIV credential and fingerprint or iris scan.| -|*Controlled* | 1 | Controlled areas require only one authentication factor, such as a PIV credential.| +|*Exclusion*| 3| Exclusion areas require three authentication factors: Something you have, such as a PIV credential; something you know, such as the PIV credential PIN; and something you have on or in your body, such as a fingerprint, face, or iris scan.| +|*Limited* | 2 | Limited areas require 2 authentication factors, such as the PKI-AUTH from the PIV credential and PIN.| +|*Controlled* | 1 | Controlled areas require only one authentication factor, such as the PKI-CAK from the PIV credential.| ## Select Authentication Mechanisms -{% include alert-no-icon.html content="FIPS 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors, defines authentication mechanisms at four assurance levels (Little or No, Some, High, and Very High)." %} +{% include alert-no-icon.html content="[FIPS 201-3](https://csrc.nist.gov/publications/detail/fips/201/3/final){:target=\"_blank\"}{:rel=\"noopener noreferrer\"}{:class=\"usa-link usa-link--external\"}, Personal Identity Verification (PIV) of Federal Employees and Contractors, defines authentication mechanisms at four assurance levels (Little or No, Some, High, and Very High)." %} -![]({{site.baseurl}}/assets/img/check-box.png){:style="float:center"}  **Select authentication mechanism for each security area** +![]({{site.baseurl}}/assets/img/check-box.png){:style="float:center"}  **Select authentication mechanisms for each security area** - Based on the security area categories and required authentication factors for each security area, choose the PIV credential authentication mechanism(s) that enforce these factors at each access point. -- FIPS 201-2 specifies these authentication mechanisms for PIV credentials: +- FIPS 201-3 specifies these authentication mechanisms for PIV credentials: - PKI authentication using the PIV Authentication Certificate [(PKI-AUTH)]({{site.baseurl}}/university/pacs/#pki-auth){:rel="noopener noreferrer"} - PKI authentication using the Card Authentication Certificate [(PKI-CAK)]({{site.baseurl}}/university/pacs/#pki-cak){:rel="noopener noreferrer"} - - Authentication using the Symmetric Card Authentication Key [(SYM-CAK)]({{site.baseurl}}/university/pacs/#sym-cak){:rel="noopener noreferrer"} + - PIV authentication using the Secure Message key [(SM-AUTH)]({{site.baseurl}}/university/pacs/#sm-auth){:rel="noopener noreferrer"} - Unattended authentication using off-card biometric comparisons [(BIO)]({{site.baseurl}}/university/pacs/#bio){:rel="noopener noreferrer"} - Attended authentication using off-card biometric comparisons [(BIO-A)]({{site.baseurl}}/university/pacs/#bioa){:rel="noopener noreferrer"} - Either attended or unattended authentication using off-card biometric comparisons [(BIO(-A))]({{site.baseurl}}/university/pacs/#bio-a){:rel="noopener noreferrer"} - - Authentication using on-card biometric comparisons [(OCC-AUTH)]({{site.baseurl}}/university/pacs/#occ-auth){:rel="noopener noreferrer"} + - Authentication using on-card fingerprint biometric comparisons [(OCC-AUTH)]({{site.baseurl}}/university/pacs/#occ-auth){:rel="noopener noreferrer"} -The table below gives the possible authentication mechanisms for the three (3) security area categories defined by NIST SP 800-116, Revision 1: +The table below gives the possible authentication mechanisms for the three (3) security area categories: | Category | Minimum
Number of
Factors | Acceptable Factors | Authentication
Mechanism:
Contact Interface | Authentication Mechanism:
Contactless Interface | | :-------- | :------: | :----- | :----- | :----- | -| *Exclusion* | 3 | Something you have **AND**
Something you know **AND**
Something you have on or in your body | PKI-AUTH + BIO | N/A | -| *Limited* | 2 |Something you have *AND*
Something you know, **OR**
Something you have *AND*
Something you have on or in your body, **OR**
Something you know *AND*
Something you have on or in your body | PKI-AUTH (with PIN or OCC) or
OCC-AUTH | OCC-AUTH | -| *Controlled* | 1 | Something you have **OR**
Something you have on or in your body | PKI-CAK | PKI-CAK
SYM-CAK | +| *Exclusion* | 3 | Something you have **AND**
Something you know **AND**
Something you have on or in your body | PKI-AUTH + PIN + BIO or OCC-AUTH + PKI-AUTH + Non OCC-AUTH Bio | VCI + PIN + BIO | +| *Limited* | 2 |Something you have *AND*
Something you know, **OR**
Something you have *AND*
Something you have on or in your body, **OR**
Something you know *AND*
Something you have on or in your body | PKI-AUTH + PIN or OCC-AUTH as the PIV Card activator with PKI-AUTH. | VCI + PIN | +| *Controlled* | 1 | Something you have **OR**
Something you have on or in your body | PKI-CAK SM-AUTH | PKI-CAK SM-AUTH | -**Note:** Some authentication mechanisms defined by NIST SP 800-116, Revision 1 might not be available on all user-population cards (for example, on-card biometric comparison or PKI-CAK). +**Note:** Some authentication mechanisms defined by NIST SP 800-116, Revision 1 might not be available on all user-population cards (for example, on-card biometric comparison, off-card biometric comparison). +Certificates must be validated when using PKI-CAK and PKI-AUTH as authentication mechanisms. Verify the certificate against a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) server response. Also, verify that the certificate chains to the Federal Common Policy root certification authority (CA). {% include alert-no-icon.html content="When using PKI-CAK and PKI-AUTH as authentication mechanisms, certificates must be validated. Verify the certificate against a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) server response. Also, verify that the certificate chains to the Federal Common Policy root certification authority (CA)." %} -Visit the [PKI 101]({{site.baseurl}}/university/pki/) to learn more about certificate trust. +Visit [PKI 101]({{site.baseurl}}/university/pki/) to learn more about certificate trust. -{% include alert-no-icon.html content="A good starting point that will help you understand Physical Access Control System procurements is GSA’s PACS Customer Ordering Guide. " %} +{% include alert-no-icon.html content="GSA’s [PACS Customer Ordering Guide](https://buy.gsa.gov/docviewer?id=2038&docTitle=Physical Access Control Systems Ordering Guide&category=Security Protection, Security Systems&docType=Buyers Guide) is a good starting point for understanding Physical Access Control System procurements." %} This page provides a sample PACS Procurement Checklist. You can reuse or tailor this checklist according to your agency’s practices. The checklist highlights common procurement activities as they relate to the following roles: - Information Technology or Physical Security Engineers (ENG) @@ -244,7 +252,7 @@ This page provides a sample PACS Procurement Checklist. You can reuse or tailor - Chief Information Officers (CIO) - Chief Security Officers (CSO) -Agency staff are encouraged to participate in steps where their roles are listed in bold underlined font. +Agency staff are encouraged to participate in steps that list their roles in **bold**, underlined font. ## PACS Procurement Best Practices @@ -311,8 +319,8 @@ Agency staff are encouraged to participate in steps where their roles are listed @@ -362,14 +370,14 @@ Agency staff are encouraged to participate in steps where their roles are listed - 6. Conduct a Facility Security Level (FSL) assessment of project-related agency sites and determine Personal Identity Verification (PIV) authentication mechanisms for each site. + 6. Conduct a Facility Security Level (FSL) assessment of project-related agency sites and determine each site's Personal Identity Verification (PIV) authentication mechanisms. ENG PM PO @@ -381,7 +389,7 @@ Agency staff are encouraged to participate in steps where their roles are listed @@ -530,10 +538,10 @@ Agency staff are encouraged to participate in steps where their roles are listed