4.1302 Acquisition of approved products and services for personal identity verification
Source: FAR 4.1302 on acquisition.gov
Agencies must acquire only FIPS PUB 201-approved personal identity verification products and services, ensuring compliance and proper documentation throughout the product lifecycle.
Overview
FAR 4.1302 establishes requirements for agencies acquiring personal identity verification (PIV) products and services, ensuring compliance with Federal Information Processing Standards Publication 201 (FIPS PUB 201). Agencies must only purchase approved PIV products and services, either through the GSA Federal Supply Schedule 70, Special Item Number (SIN) 132-62, or by certifying compliance with FIPS PUB 201 if using alternative acquisition methods. The regulation also mandates ongoing conformance and documentation to maintain compliance throughout the lifecycle of the PIV components.
Key Rules
- Purchase Only Approved PIV Products and Services
- Agencies must acquire PIV products and services that are approved as compliant with FIPS PUB 201.
- Preferred Acquisition Source
- Agencies are encouraged to use GSA FSS 70, SIN 132-62, following FAR 8.4 procedures.
- Alternative Acquisition Requirements
- If not using GSA FSS 70, agencies must certify compliance, ensure interoperability, and maintain a written plan for ongoing conformance.
Responsibilities
- Contracting Officers: Ensure only approved PIV products/services are acquired, follow proper acquisition channels, and maintain required documentation.
- Contractors: Provide only FIPS PUB 201-compliant products/services and support ongoing compliance.
- Agencies: Oversee acquisition processes, certify compliance, and maintain lifecycle conformance plans.
Practical Implications
- This section ensures government-wide consistency and security in PIV systems, reducing risk of non-compliance.
- Contractors must be prepared to demonstrate FIPS PUB 201 compliance and support agency documentation needs.
- Common pitfalls include failing to use approved sources or lacking required certification and documentation.
(a) In order to comply with FIPS PUB 201, agencies must purchase only approved personal identity verification products and services.
(b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR subpart 8.4.
(c) When acquiring personal identity verification products and services not using the process in paragraph (b) of this section, agencies must ensure that the applicable products and services are approved as compliant with FIPS PUB 201 including-
(1) Certifying the products and services procured meet all applicable Federal standards and requirements;
(2) Ensuring interoperability and conformance to applicable Federal standards for the lifecycle of the components; and
(3) Maintaining a written plan for ensuring ongoing conformance to applicable Federal standards for the lifecycle of the components.
(d) For more information on personal identity verification products and services see http://www.idmanagement.gov" target="_blank">http://www.idmanagement.gov.