Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.


The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

NIST Updates Personal Identity Verification (PIV) Guidelines



Hildegard Ferraiolo, Larry Feldman, Gregory A. Witte


This bulletin summarized the information presented in NIST SP 800-156: Derived PIV Application and Data Model Test Guidelines and NIST SP 800-166: Representation of PIV Chain-of-Trust for Import and Export. These publications support Federal Information Processing Standard (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors , which specifies the model for identity credentials that are hosted on a smart card (i.e., the PIV card) and/or on mobile devices (i.e., Derived PIV Credentials).
ITL Bulletin - August 2016
Report Number
August 2016


authentication, derived PIV application, derived PIV application data model, derived PIV credential, derived test requirements (DTR), FIPS 201, implementation under test (IUT), mobile devices, Personal Identity Verification (PIV), test assertions, token command interface.
Created August 10, 2016, Updated February 19, 2017