Smart cards are plastic devices that are  about the size of a credit card and contain an embedded integrated circuit  chip capable of storing and processing data. HSPD-12 Requires Standardized Agency ID and Credentialing Systems

In August 2004, the President issued HSPD-12, which directed  Commerce to develop a new standard for secure and reliable forms of ID  for federal employees and contractor personnel by February 27, 2005. OMB did not implement this recommendation. OMB and Agencies Have Made Progress but Have Not Yet Fully Implemented Homeland Security Presidential Directive 12

Overall, OMB and federal agencies have made mixed progress in  implementing HSPD-12 requirements aimed at establishing a common  identification standard for federal employees and contractor personnel. Lastly, agencies  have made minimal progress in achieving the goal of interoperability  among agencies, having generally not established systems and  procedures for universally reading and electronically validating PIV cards  issued by other federal agencies. The Federal CIO Council, OMB, and NIST Have Taken Steps to Promote Full Implementation of HSPD-12

While early HSPD-12 guidance from OMB focused on completion of  background investigations and issuance of PIV cards, beginning in 2008  the federal CIO Council, OMB, and NIST took actions to more fully  address HSPD-12 implementation, including focusing on the use of the  electronic capabilities of the cards for physical and logical access control. According to DHS officials, the agency has conducted an  assessment of all its facilities in the National Capitol region to determine  what method of authentication was being used for physical access and to  develop a strategy to implement PIV-based electronic authentication at  each facility. Agencies Have Made Limited Progress in Implementing the Electronic Capabilities of the PIV Credentials for Logical Access to Federal Information Systems

HSPD-12 requires agencies to use PIV credentials for access to federal  information systems. Agencies Face Obstacles in Fully Implementing Homeland Security Presidential Directive 12

Agencies reported that their mixed progress in issuing PIV credentials  and using them for electronic authentication of individuals accessing  federal facilities and information systems can be attributed to several  major management and technical obstacles. Several Agencies Reported Logistical Difficulties Associated with Issuing Credentials to Employees in Remote Locations

OMB’s August 2005 guidance specifies that HSPD-12 credentials are to  be issued to all employees and contractor personnel in executive branch  agencies who require long-term access to federally controlled facilities or  information systems. Several Agencies Have Not Put a Priority on Implementing the Electronic Capabilities of the PIV Credentials for Physical Access to Their Major Facilities

HSPD-12 required the use of the PIV credential for access to federal  facilities. Agency officials reported that they were working on solutions to this  problem. Nevertheless, agencies have made minimal progress in implementing  access control systems that can accept and validate PIV cards issued by  other agencies. Conclusions

Agencies have made substantial progress in issuing PIV cards to  employees and contractor personnel and have begun using the electronic  capabilities of the cards for physical and logical access but have made  less progress in using the credentials for access to federal facilities and  information systems. Agencies have established policies and procedures for accepting  credentials from other agencies only in limited circumstances, in part  because OMB only began requiring that agency systems accept  credentials from other agencies in 2009. Until such mechanisms are in place, agencies are likely to continue to  make slow progress in achieving interoperability. We are sending copies of this report to other interested congressional  committees; the Secretaries of the Departments of Agriculture,  Commerce, Homeland Security, Housing and Urban Development, the  Interior, and Labor; the Administrators of the General Services  Administration and National Aeronautics and Space Administration; the  Chairman of the Nuclear Regulatory Commission; and the Director of the  Office of Management and Budget. Appendix II: Requirements and Components of PIV-II

The requirements of PIV-II include the following:  specifications for the components of the PIV system that employees  and contractor personnel will interact with, such as PIV cards, card  and biometric readers, and personal identification number (PIN) input  devices; security specifications for the card issuance and management  provisions;   a suite of authentication mechanisms supported by the PIV card and  requirements for a set of graduated levels of identity assurances; specifications for the physical characteristics of PIV cards, including  requirements for both contact and contactless interfaces and the  ability to pass certain durability tests; and   mandatory information that is to appear on the front and back of the  cards, such as a photograph, cardholder name, card serial number,  and issuer identification.
Why GAO Did This Study

To increase the security of federal facilities and information systems, the President issued Homeland Security Presidential Directive 12 (HSPD-12) in 2004. This directive ordered the establishment of a governmentwide standard for secure and reliable forms of ID for employees and contractors who access government-controlled facilities and information systems. The National Institute of Standards and Technology (NIST) defined requirements for such personal identity verification (PIV) credentials based on "smart cards"--plastic cards with integrated circuit chips to store and process data. The Office of Management and Budget (OMB) directed federal agencies to issue and use PIV credentials to control access to federal facilities and systems. GAO was asked to determine the progress that selected agencies have made in implementing the requirements of HSPD-12 and identify obstacles agencies face in implementing those requirements. To perform the work, GAO reviewed plans and other documentation and interviewed officials at the General Services Administration, OMB, and eight other agencies.

What GAO Found

Overall, OMB and federal agencies have made progress but have not fully implemented HSPD-12 requirements aimed at establishing a common identification standard for federal employees and contractors. OMB, the federal Chief Information Officers Council, and NIST have all taken steps to promote full implementation of HSPD-12. For example, in February 2011, OMB issued guidance emphasizing the importance of agencies using the electronic capabilities of PIV cards they issue to their employees, contractor personnel, and others who require access to federal facilities and information systems. The agencies in GAO's review--the Departments of Agriculture, Commerce, Homeland Security, Housing and Urban Development, the Interior, and Labor; the National Aeronautics and Space Administration; and the Nuclear Regulatory Commission--have made mixed progress in implementing HSPD-12 requirements. Specifically, they have made substantial progress in conducting background investigations on employees and others and in issuing PIV cards, fair progress in using the electronic capabilities of the cards for access to federal facilities, and limited progress in using the electronic capabilities of the cards for access to federal information systems. In addition, agencies have made minimal progress in accepting and electronically authenticating cards from other agencies. The mixed progress can be attributed to a number of obstacles agencies have faced in fully implementing HSPD-12 requirements. Specifically, several agencies reported logistical problems in issuing credentials to employees in remote locations, which can require costly and time-consuming travel. In addition, agencies have not always established effective mechanisms for tracking the issuance of credentials to federal contractor personnel--or for revoking those credentials and the access they provide when a contract ends. The mixed progress in using the electronic capabilities of PIV credentials for physical access to major facilities is a result, in part, of agencies not making it a priority to implement PIV-enabled physical access control systems at all of their major facilities. Similarly, a lack of prioritization has kept agencies from being able to require the use of PIV credentials to obtain access to federal computer systems (known as logical access), as has the lack of procedures for accommodating personnel who lack PIV credentials. According to agency officials, a lack of funding has also slowed the use of PIV credentials for both physical and logical access. Finally, the minimal progress in achieving interoperability among agencies is due in part to insufficient assurance that agencies can trust the credentials issued by other agencies. Without greater agency management commitment to achieving the objectives of HSPD-12, agencies are likely to continue to make mixed progress in using the full capabilities of the credentials.

What GAO Recommends

GAO is making recommendations to nine agencies, including OMB, to achieve greater implementation of PIV card capabilities. Seven of the nine agencies agreed with GAO's recommendations or discussed actions they were taking to address them; two agencies did not comment.