My company is applying for a P-ATO for FedRAMP certification. There's a mandatory requirement I'm not understanding well.
"Can the system fully support user authentication via Agency Common Access Card (CAC) or Personal Identity Verification (PIV) credentials?"
We make software, and specifically mobile applications. Our application would never need a CAC or PIV for end users. Further, we have two factor auth setup for our login to our cloud platform (AWS) but I can't see how/why we'd use PIV or CACs.
Anyone run across this before and how to handle? It's mandatory so assuming I have to deal with it in some way. Thanks!