Personal Identity Verification (PIV)

The Personal Identity Verification (PIV) card is the federal government's standard smart card credential for physical and logical access, established under Homeland Security Presidential Directive 12 (HSPD-12). Federal civilian agencies issue PIV cards to their employees and eligible contractor personnel to enable strong identity authentication for facility access and IT system login.

What is Personal Identity Verification (PIV)?

PIV is defined in NIST Special Publication 800-73 and FIPS 201, which establish the technical and security requirements for the credential. Like the DoD's Common Access Card (CAC), a PIV card contains embedded PKI certificates that support two-factor authentication. When a PIV holder inserts the card and enters their PIN, the system cryptographically verifies their identity using the certificate on the card. PIV issuance requires a background investigation appropriate to the sensitivity of access being granted. Contractors working at civilian federal agencies -- including DHS, HHS, GSA, VA, and others -- need PIV cards to access government facilities and IT systems requiring HSPD-12 compliant authentication. PIV-enabled systems satisfy OMB Memorandum M-11-11's mandate that agencies use PIV for all systems that previously relied on username and password authentication, directly supporting FISMA Moderate and higher security control requirements.

Why PIV matters for government contractors

Contractor personnel working on-site at civilian agencies or accessing agency IT systems requiring PIV authentication must obtain PIV credentials as a condition of performance. Delays in PIV enrollment can hold up contract start activities. Contractors must also ensure PIV-enabling technology (card readers, middleware, certificate validation infrastructure) is in place for their workforce. For IT contractors building agency systems, PIV integration is often a mandatory security control that must be implemented to achieve an Authorization to Operate.

Example

A consulting firm wins a contract to support IT operations at the Department of Health and Human Services. The contracting officer requires that all contractor personnel working in HHS facilities hold valid PIV credentials. The firm coordinates with the HHS security office for PIV enrollment of its personnel, factoring the 4-6 week enrollment timeline into its mobilization plan.

Frequently Asked Questions

Is PIV required for all federal contract work?

PIV is required for contractor personnel who need access to federal facilities or IT systems covered by HSPD-12. Work performed entirely off-site on contractor-owned systems using approved remote access methods may not require PIV, depending on agency policy.

How does PIV differ from CAC?

PIV is issued by civilian federal agencies under HSPD-12. CAC is issued by DoD. Both use similar PKI-based authentication but are administered by different systems. Some interoperability exists between the two credentials under federal cross-credentialing agreements.

What background investigation is required for PIV?

The minimum investigation for PIV issuance is a National Agency Check with Local Agency Check and Credit Check (NACLC) or equivalent, though some agencies require higher levels for sensitive access.

Can contractors keep their PIV card after a contract ends?

No. PIV cards are federal government property and must be returned when an individual's eligibility ends. Agencies have procedures for collecting credentials when contractor assignments terminate.

Does PIV satisfy multi-factor authentication requirements?

Yes. PIV provides two-factor authentication (card plus PIN) that satisfies OMB and NIST requirements for MFA on federal information systems, a key control for FISMA compliance.