We will be getting some data that needs to be kept in accordance with USGCB regulations. Our intent was to keep it secure by storing and using it on a non-networked computer, but the regulations seem to require a network connection, as they specify keeping the OS and virus scanner up to date. Surely there is a clause somewhere that exempts non-networked computers from these and similar parts of the regulations, but I can't find it.

Also, it requires a smart card reader on the computer, but I have no idea where to buy a couple of cards — the reader isn't hard to find but the vendors of cards seem to have a minimum order of 1,000.

How can a non-networked computer be made compliant with USGCB?

  • 1
    The cards are PIV or PIV-I cards; you won't be acquring them ion small batches. If you don't already have HSPD-12 credentials, you might want to look at the deviations procedure for USGCB – Mark C. Wallace Sep 20 '13 at 13:35

For updating non-connected computers, you can use offline updating tools that download the updates using another computer (which you can then transfer to the non-networked computer via USB drive for installation). For example, you can use the WSUS Offline Updater for Windows. For your AV vendor though, you would have to check with them on how to get offline updates.


I'm going on the assumption that you or your company is working as a contractor for the government... In which case, do you know if the contract stipulates that the computer needs to be certified to operate (i.e. is it going to be audited for compliance with the USGCB)? If so, it would be worth your while to speak with the auditor about the matter.

The USGCB is derived from the recommendations found in NIST SP 800-53, which is tailorable to a given set of circumstances. If the computer isn't going to be connected to a network, there's really no need for a smart card reader or for you to procure smart cards - the computer is not going to be connected to any sort of authentication server which renders the smart card useless...


If you're working as a contractor for the U.S. Government, as is generally implied by your requirement for USGCB compliance, then they will probably require that your system be put into a Security Plan which is compliant with NIST SP 800-53 guidelines. The process for this is not without exception. For any control in 800-53 that you cannot meet, for any reason, you may propose that your client simply accept the risk of not meeting the control.

Ultimately, it will be up to the government whether the proposal for accepted risk is approved but you should not have much problem so long as your justification is strong and sound. If they do not approve the AR, they may add remediation of the problem to the Security Plan's Plans of Action and Milestones (POA&Ms).

All that said, I do not expect you will get a full waiver on Flaw Remediation (SI-02) or Malicious Code Protection (SI-03) simply because the computer is non-networked. Security updates can be taken to the system via sneaker-net (e.g.: Offline WSUS) and most antivirus vendors also provide manual downloads of their signatures and program updates for offline install.

For multi-factor authentication however, you will probably need to propose an AR. Unless the system is connected to some sort of authentication server that can manage and validate the PIV credentials, I don't think there's any way that Smart Cards (or any similar two-factor authentication method) can be of any real use. For this, you'll have to propose an AR against some of the enhancements to Identification and Authentication (Organizational Users) (IA-02). Which ones will depend on the FIPS-199 categorization of the data type(s) handled by your system.

Low: 1
Medium: 1, 2, 3, 8
High: 1, 2, 3, 4, 8, 9

Enhancements 1, 2, 8, and 9 only apply to network access so your system will be exempt from those anyway. While enhancements 8 and 9 don't specifically call out multi-factor authentication, most "replay-resistant mechanisms" do involve multi-factor authentication. Check with your customer to see what the Organizational Defined Values (ODVs) are for "List of replay-resistant authentication mechanisms used for network access to accounts".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.