4.1302
Acquisition of approved products and services for personal identity verification
Agencies must acquire only FIPS PUB 201-approved personal identity verification products and services, ensuring compliance and proper documentation throughout the product lifecycle.
Overview
FAR 4.1302 establishes requirements for agencies acquiring personal identity verification (PIV) products and services, ensuring compliance with Federal Information Processing Standards Publication 201 (FIPS PUB 201). Agencies must only purchase approved PIV products and services, either through the GSA Federal Supply Schedule 70, Special Item Number (SIN) 132-62, or by certifying compliance with FIPS PUB 201 if using alternative acquisition methods. The regulation also mandates ongoing conformance and documentation to maintain compliance throughout the lifecycle of the PIV components.
Key Rules
- Purchase Only Approved PIV Products and Services
- Agencies must acquire PIV products and services that are approved as compliant with FIPS PUB 201.
- Preferred Acquisition Source
- Agencies are encouraged to use GSA FSS 70, SIN 132-62, following FAR 8.4 procedures.
- Alternative Acquisition Requirements
- If not using GSA FSS 70, agencies must certify compliance, ensure interoperability, and maintain a written plan for ongoing conformance.
Responsibilities
- Contracting Officers: Ensure only approved PIV products/services are acquired, follow proper acquisition channels, and maintain required documentation.
- Contractors: Provide only FIPS PUB 201-compliant products/services and support ongoing compliance.
- Agencies: Oversee acquisition processes, certify compliance, and maintain lifecycle conformance plans.
Practical Implications
- This section ensures government-wide consistency and security in PIV systems, reducing risk of non-compliance.
- Contractors must be prepared to demonstrate FIPS PUB 201 compliance and support agency documentation needs.
- Common pitfalls include failing to use approved sources or lacking required certification and documentation.