SA-4(10)—Acquisition Process | Use of Approved PIV Products
IL4 Mod
IL4 High
IL5
IL6
>Control Description
Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.
>DoD Impact Level Requirements
No specific parameter values or requirements for this impact level.
>Discussion
Products on the FIPS 201-approved products list meet NIST requirements for Personal Identity Verification (PIV) of Federal Employees and Contractors. PIV cards are used for multi-factor authentication in systems and organizations.
>Programmatic Queries
Beta
Related Services
AWS IAM
AWS Certificate Manager
AWS Secrets Manager
CLI Commands
Create IAM policy for PIV certificate validation
aws iam put-user-policy --user-name piv-user --policy-name piv-validation --policy-document file://piv-policy.jsonImport PIV certificate to Certificate Manager
aws acm import-certificate --certificate fileb://certificate.pem --certificate-chain fileb://chain.pem --private-key fileb://private-key.pemEnable MFA with PIV device
aws iam enable-mfa-device --user-name piv-user --serial-number arn:aws:iam::123456789012:mfa/piv-deviceList approved PIV devices
aws iam list-mfa-devices --user-name piv-user>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What acquisition policies and procedures address the requirements of SA-4(10)?
- •How are security and privacy requirements integrated into the acquisition process?
- •Who is responsible for ensuring that acquisitions comply with SA-4(10)?
Technical Implementation:
- •How are security requirements defined and documented in acquisition contracts?
- •What mechanisms ensure that acquired systems and services meet security requirements?
- •How do you validate that vendors and service providers comply with specified security controls?
Evidence & Documentation:
- •Can you provide examples of acquisition documentation that includes security requirements?
- •What evidence demonstrates that acquired systems meet security specifications?
- •Where is acquisition security documentation maintained throughout the system lifecycle?
Ask AI
Configure your API key to use AI features.