Navigate

PE-2 (2)

PE-2 (2): Two Forms Of Identification

The organization requires two forms of identification from [Assignment: organization-defined list of acceptable forms of identification] for visitor access to the facility where the information system resides.

Supplemental

Acceptable forms of government photo identification include, for example, passports, Personal Identity Verification (PIV) cards, and drivers� licenses. In the case of gaining access to facilities using automated mechanisms, organizations may use PIV cards, key cards, PINs, and biometrics.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
NC3

Related Controls

The controls below (if any) were marked by NIST as being related to PE-2 (2).

Control	Description
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-4	The organization manages information system identifiers by: IA-4a.: Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier; IA-4b.: Selecting an identifier that identifies an individual, group, role, or device; IA-4c.: Assigning the identifier to the intended individual, group, role, or device; IA-4d.: Preventing reuse of identifiers for [Assignment: organization-defined time period]; and IA-4e.: Disabling the identifier after [Assignment: organization-defined time period of inactivity].
IA-5	The organization manages information system authenticators by: IA-5a.: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator; IA-5b.: Establishing initial authenticator content for authenticators defined by the organization; IA-5c.: Ensuring that authenticators have sufficient strength of mechanism for their intended use; IA-5d.: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators; IA-5e.: Changing default content of authenticators prior to information system installation; IA-5f.: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators; IA-5g.: Changing/refreshing authenticators [Assignment: organization-defined time period by authenticator type]; IA-5h.: Protecting authenticator content from unauthorized disclosure and modification; IA-5i.: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and IA-5j.: Changing authenticators for group/role accounts when membership to those accounts changes.

Enhancements

The controls below (if any) add on to the requirements of PE-2 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PE-2 (2).

CCI	Definition
CCI-000917	The organization requires two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the information system resides.
CCI-002912	The organization defines a list of acceptable forms of identification for visitor access to the facility where the information system resides.