A CIV (Commercial Identity Verification) is a secure credential (smart card) that leverages FIPS-201 and the PIV Specifications for commercial use.
Homeland Security Presidential Directive 12 (HSPD-12) mandates a standard for a secure and reliable form of identification to be used by all Federal employees and contractors. Signed by President George W. Bush in August 2004, HSPD-12 initiated the development of a set of technical standards and issuance policies (FIPS 201) that create the Federal infrastructure required to deploy and support an identity credential that can be used and trusted across all Federal agencies, regardless of which agency issues the credential.
This credential, the Personal Identity Verification (PIV) card, is now deployed and used by Federal agencies to assign controlled resource access privileges to Federal employees and to authorize the cardholder to access both physical and logical resources. The success of this program is largely due to the development of goals, issuance policies, and technical specifications that all agencies agree to follow. A cross-certification policy establishes trust between agencies, so that employees from one agency can use their PIV credentials to access controlled resources while visiting other agencies. Products and systems that conform to the defined technical interoperability standards are offered by a variety of suppliers. New standards-compliant products are introduced frequently. Today, well over 5 million PIV cards have been issued by the Federal government to employees and contractors.
As the benefits of a common identity credential become clear, interest is growing among non-Federal issuers. PIV-interoperable (PIV-I) cards are already being issued by Federal contractors to those employees who need access to Federal buildings and networks. The PIV-I credentials are technically interoperable with the PIV infrastructure. PIV-I issuers comply with the identity-proofing, registration, and issuance policies described in FIPS 201 and are cross-certified with the Federal Public Key Infrastructure (PKI) Bridge to allow contractor employees to access authorized resources.
Private enterprises can also take advantage of this technology. This white paper defines the Commercial Identity Verification (CIV) credential, which leverages the PIV-I specifications, technology and data model without the requirement for cross-certification. Any enterprise can create, issue, and use CIV credentials according to requirements established within that enterprise’s unique corporate environment.
The CIV credential is technically compatible with the PIV-I credential specifications. However, a CIV credential issuer need not comply with the strict policy framework associated with issuance and use of the PIV and PIV-I credentials. This freedom allows corporate enterprises to deploy the standardized technologies in a manner that is suitable for their own corporate environments.
