FIPS 201-2 Compliance: What Your PACS Must Do

FIPS 201-2 is the federal standard that governs identity verification for federal employees and contractors. If your facility falls under HSPD-12, your PACS must do more than just read badges. It must verify, authenticate, and log against a specific set of requirements that most commercial access control systems are not configured to meet out of the box.

Here is what your PACS actually needs to do to be FIPS 201-2 compliant, and where most integrations fall short.

PIV Authentication, Not Just Badge Reading

The most common misconception is that reading a PIV card's credential identifier is the same as authenticating it. It is not. FIPS 201-2 requires that the PACS perform cryptographic verification of the PIV credential, not just read a number off the card. This means your PACS must support one of the approved authentication mechanisms defined in SP 800-116, typically the PIV Auth certificate and the associated challenge-response protocol.

If your PACS is only reading the CHUID (Card Holder Unique Identifier) without performing cryptographic verification, you are not meeting FIPS 201-2. You are doing badge reading, not identity authentication.

The SP 800-116 Authentication Model

NIST SP 800-116 defines three progressively stronger authentication mechanisms for PACS:

Visual: The guard or receptionist visually inspects the PIV card. This is the weakest form and is only acceptable for visitor processing or as a secondary check, not as the primary access control.

CHUID: The PACS reads the CHUID from the card and compares it against an authorization list. This provides identification but not strong authentication. It does not verify that the card is genuine or that the holder is the legitimate cardholder.

PIV Auth: The PACS performs a challenge-response using the PIV Auth certificate and the card's private key. This is strong authentication and is what FIPS 201-2 requires for access to federal facilities at the standard assurance level.

What Your PACS Must Support

To be FIPS 201-2 compliant, your PACS infrastructure must include: PIV-compatible readers that support the necessary card interface, a backend PKI validation capability that can verify PIV certificates against the Federal PKI trust chain, an authorization database that maps authenticated identities to access permissions, and audit logging that records the authentication method used for each access event.

Most commercial PACS platforms can be configured to support these requirements, but the PKI validation component is frequently missing. Without it, the system is reading badges, not authenticating identities.

Certificate Validation: The Missing Piece

The single most common FIPS 201-2 compliance gap is certificate validation. The PACS must verify that the PIV certificate presented is valid, not expired, not revoked, and issued by a trusted Certificate Authority in the Federal PKI. This requires either an inline OCSP/CRL validation capability or integration with a dedicated identity validation service.

If your PACS accepts a PIV credential without checking certificate revocation status, you have a compliance gap. A terminated employee whose PIV certificate has been revoked should not be able to badge in. Without revocation checking, they can.

Audit Logging Requirements

FIPS 201-2 compliance requires that the PACS log each access event with: the identity of the credential holder, the time and location of the access attempt, the authentication method used (CHUID or PIV Auth), the access decision (granted or denied), and the reason for denial if applicable. These logs must be retained per the facility's records retention policy and be available for audit.

Common Compliance Gaps

Reading CHUID only and calling it PIV authentication. It is not. CHUID reading does not meet the strong authentication requirement.

No certificate revocation checking. Revoked credentials remain functional, allowing terminated personnel to access facilities.

No logging of authentication method. If the audit log does not distinguish between CHUID and PIV Auth, an assessor cannot verify that strong authentication is being used.

Expired certificates accepted. The PACS does not check certificate expiration dates, allowing expired PIV credentials to remain functional.

Non-PIV credentials used for federal personnel. HSPD-12 requires PIV credentials for federal employees and contractors. If your PACS is issuing standalone badges instead of using PIV, you are not meeting the standard.

The Path to Compliance

Start with an assessment: What authentication method does your PACS actually use? If you do not know, that is the first gap. Check your reader specifications, your PACS configuration, and your audit logs. If the logs do not record authentication method, assume you are using CHUID only.

Then implement PKI validation. This is the single most impactful step. Whether through an inline service, a middleware layer, or a PACS upgrade, certificate validation is the core of FIPS 201-2 compliance.

Finally, configure audit logging to record the authentication method for every event. This creates the evidence trail that an assessor needs to verify compliance.

FIPS 201-2 compliance is not optional for federal facilities under HSPD-12. But it is achievable with the right configuration and the right understanding of what the standard actually requires. The question is not whether your PACS can read a PIV card. It is whether your PACS can authenticate one.

Ready to bring your PACS into FIPS 201-2 compliance? Blue Violet Security specializes in PIV-authenticated access control integration for federal facilities. Schedule a Consultation today.

This content is provided for general informational purposes only and does not constitute legal or regulatory advice. Compliance requirements and regulations are subject to change. Blue Violet Security, LLC recommends consulting with appropriate legal and regulatory counsel before making compliance determinations.