1

My company is applying for a P-ATO for FedRAMP certification. There's a mandatory requirement I'm not understanding well.

"Can the system fully support user authentication via Agency Common Access Card (CAC) or Personal Identity Verification (PIV) credentials?"

We make software, and specifically mobile applications. Our application would never need a CAC or PIV for end users. Further, we have two factor auth setup for our login to our cloud platform (AWS) but I can't see how/why we'd use PIV or CACs.

Anyone run across this before and how to handle? It's mandatory so assuming I have to deal with it in some way. Thanks!

  • ignore me; I was dead wrong :{ – Angelo Schilling Jul 9 '18 at 22:53
  • It's a tricky requirement, and I really can't find much guidance on the web on this one. – Boss2000 Jul 9 '18 at 22:54
0

"Can the system fully support user authentication via Agency Common Access Card (CAC) or Personal Identity Verification (PIV) credentials?"

We make software, and specifically mobile applications. Our application would never need a CAC or PIV for end users. Further, we have two factor auth setup for our login to our cloud platform (AWS) but I can't see how/why we'd use PIV or CACs.

The answer to the "why" question is: You will do it because it is mandated. ;)

As for the "how" question: If your "system" already supports some forms of two-factor authentication, you probably don't have too far to go to support PIV/CAC, in principle. In fact, any old desktop computer can use a PIV/CAC card reader, right? If I remember correctly you can also fit a mobile phone with a CAC card readers as well...

  • A little more background, our system is a virtual server hosted up in AWS, and the 2 factor auth is done through the AWS interface. And maybe I'm misinterpreting the requirement. It's saying "can" it support it, which, in theory, we could use an Amazon plugin called IdP to provide CAC support, so we "can". So saying we can support it (and knowing we could if asked to) is maybe good enough? – Boss2000 Jul 10 '18 at 23:12
  • Sounds to me more like you "could" than you "can." Probably would be good to at least test it out and show that you really can do it at least for a POC test case before saying that you "can." It would be embarrassing to get called out on it and then not be able to actually do it... – hft Jul 10 '18 at 23:15
  • Thanks hft, that makes sense. I appreciate the help! I upvoted your answer but not sure if it registered since I had to create a new account. – Boss2000 Jul 10 '18 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.