NASA Procedural Requirements

NPR 1600.4A Effective Date: April 08, 2016 Expiration Date: August 08, 2024

Subject: Identity and Credential Management

Responsible Office: Office of Protective Services

Chapter 5. Characteristics of NASA Badges

5.1 NASA Credential Types

5.1.1 NASA PIV Credentials - The information on a NASA PIV credential exists in both visual printed and electronic forms. The NASA PIV credential shall be equipped with technologies that allow for physical access through a proximity antennae and logical access through an embedded chip.

a. NASA PIV credentials contain the following security and distinguishable features on the front of the card:

(1) Holographic overlay.

(2) Smart chip.

b. NASA PIV credentials have the following printed vertically on the front of the badge.

(1) The photograph of the applicant in the top left corner.

(2) The legal name of the applicant, printed below the applicant photograph.

(3) Two badge expiration dates, one located in the upper right corner (MM YYYY format) and the second to the right of the applicant photograph, below the Agency identifier and over the Agency logo (YYYYMMDD format).

(4) The NASA Agency identifier logo.

(5) The affiliation of the applicant, to the right of the applicant photograph and over the Agency logo.

(6) The NASA Agency identifier, to the right of the applicant photograph, below the affiliation, and over the Agency logo.

(7) The unique badge identification number, below the NASA Agency identifier and the affiliation color band.

(8) Solid color band across the middle of the badge, over the full name with the color determined by the affiliation of the badge holder, per section 5.1.5, Visual Color Coding for Employee Type.

c. NASA PIV credentials have the following printed horizontally on the back of the badge:

(1) Return address.

(2) Applicant height.

(3) Applicant eye color.

(4) Applicant hair color.

(5) Bar code.

5.1.2 NASA Temporary Badge - Temporary badges may be equipped with technologies that allow for physical access through a proximity antennae and/or logical access through an embedded chip. Temporary badges shall not resemble the NASA PIV credential.

a. Temporary badges will have the following printed vertically on the badge:

(1) The silhouette of a vertical Space Shuttle on the right side of the badge, located above the solid affiliation color area.

(2) The photograph of the applicant in the top left corner.

(3) The legal name of the applicant, printed below the applicant photograph.

(4) The NASA Agency identifier, to the right of the applicant photograph.

(5) The designation of the issuing Center, below the applicant name.

(6) The unique badge identification number, below the NASA Agency identifier.

(7) The badge expiration date that is 180 calendar days or less from the date of Center/facility affiliation, below the badge identification number.

(8) Solid colored lower section based on the affiliation of the badge holder, per section 5.1.5, Visual Color Coding for Employee Type.

(9) OPS mailing information on the bottom front of the badge.

b. Temporary badges have the following printed horizontally on the back of the card:

(1) Return address.

(2) Applicant height.

(3) Applicant eye color.

(4) Applicant hair color.

5.1.3 NASA Visitor Badges - Centers may prescribe the topology for visitor badges as long as they meet the following criteria:

a. The legal name of the applicant.

b. The full name of the issuing Center.

c. The full badge expiration date that is 29 days or less from the date of Center/facility affiliation.

5.1.4 NASA alternate Agency credentials — Alternate Agency credentials will contain the following information:

a. The photograph of the applicant.

b. The legal name of the applicant.

c. The name of the issuing Center (Center name may be common abbreviation, e.g., ARC, DFRC, etc., as appropriate).

5.1.5 Visual Color Coding for Employee Type - NASA PIV and alternate Agency credentials use colored markings on the badge to determine the affiliation of the badge holder. NASA PIV credentials use a color band through the name of the applicant, and alternate Agency credentials use a colored lower section below the photograph and including the name. Unless otherwise indicated, the color being used is for both NASA PIV and alternate Agency credentials, as described in Table 5.1.5.

Table 5.1.5, PIV Credential Color Coding

5.1.6 Emergency Response Officials (ERO) Badges - Emergency Response Office badges shall be issued only to the following persons:

a. EROs to include individuals who are:

(1) Continuity of Operations (COOP) and Continuity of Governance (COG) personnel associated with COOP at a NASA Center or an alternate operating site during emergency/crisis situations. This includes only those persons who are members of the Emergency Relocation Group (ERG) and their respective support staff and Emergency Operation Center (EOC) personnel who are appropriately certified and trained.

(2) Disaster response personnel for each facility who possess National Incident Management System (NIMS) training or professional certifications.

b. Personnel to be deployed to support the NASA National Response Framework (NRF) Emergency Support Function (ESF) Annexes. Support personnel may not be issued the ERO PIV credential unless they possess the above mentioned NIMS training or professional certifications.

c. NASA, special agents, NASA, security police, or security officers who have graduated from NASA Federal Law Enforcement Training and members of the NASA Inspector General (IG) staff who are sworn law enforcement officers.

d. Center protective services and security staff who provide support or other security functions for 34 emergency/contingency operations as deemed necessary by the CCS/CCPS so long as they possess the above mentioned NIMS training or professional certifications.

e. Center Directors, Deputy Center Directors, and Directors of Center Operations and their deputies.

5.1.7 Personnel who will be fulfilling support duties shall be issued a NASA PIV credential, without the ERO designation, to facilitate verification of identity and ease movement through the various checkpoints. Support personnel may not be issued the ERO PIV credential unless they possess the above mentioned NIMS training or professional certifications.

5.1.8 Table 5.1.8 details the color coding for alternate Agency credentials:

Table 5.1.8, Color Coding for Badges

5.1.9 Badges for Press Corps - The press corps shall be recognized by the word "PRESS" printed vertically down the right side of the alternate Agency credential. U.S. press corps will be further recognized by a brown lower section. Foreign national press will also contain all characteristics from the foreign national color coding as detailed in Table 5.1.5.

5.2 NASA PIV Credential Data

5.2.1 Data printed on a NASA PIV credential shall consist of:

a. Name (last name, first name, and middle initial).

b. Photo.

c. Affiliation (civil servant, detailees, contractor, grantee, or foreign national, etc.).

d. Badge expiration date.

e. Badge number consisting of a three-digit Center code plus six unique digits and printed as a number on the front, and a 3x9 bar code on the back.

f. Height, eye color, and hair color.

g. Agency card serial number, preprinted and used for tracking card stock.

h. Issuer identification consisting of a six character department code, the Agency code for NASA, and a five-digit issuing facility number.

5.2.2 The digital data stored on the NASA PIV credential supports physical and/or logical access use, encryption, and signing capability and provides security and authentication protection for the PIV credential and PIV credential holder.

5.2.2.1 Card Holder Unique Identifier (CHUID) - The CHUID is used by access control applications and is the only data that is accessible through both the contact and contactless interfaces. Applications can read this data without any action from the badge holder. The CHUID is composed of:

a. Federal Agency Smart Credential Number (FASC-N).

b. NASA Agency code.

c. System code identifying the original issuing Center.

d. A credential number.

e. PIV credential holder's Uniform Universal Personal Identification Code (UUPIC).

f. Expiration date.

5.2.2.2 Digital Certificates

a. PKI X.509 certificates are used for authentication of the PIV credential and digital signing, encryption, and authentication of the PIV credential holder.

b. Credentials used for logical access have a certificate for PIV credential authentication. Additional certificates are loaded based on the duties and needs of the PIV credential holder.

5.2.2.3 Biometrics (typically fingerprints of the right and left index fingers) are stored as minutiae templates that represent a specific biometric, but cannot be reverse-engineered to recreate an image of that biometric.

5.2.2.4 Digital Representation of Printed Information - Certain items printed on the front and back of the card are stored on the chip as a security and authentication measure; including name, affiliation, organization, badge expiration date, Agency card serial number, and issuer identification.

5.2.2.5 Photograph - The facial image used in creating the photo printed on the front of the badge is stored in the badge. A facial image is required, and obscuring headwear may not be worn for the photograph.

5.2.2.6 The PIN is used to secure and protect the electronic data stored on the PIV credential. The PIN is used by the PIV credential holder to allow applications to access data and as part of the authentication process. It is stored in a secure section of the smart card, separate from the rest of the PIV credential digital data. All PIV credential data, with the exception of the CHUID, require the PIV credential holder to enter their PIN before an application can either access or use the data. The PIN is a minimum of a six-digit number selected by the PIV credential holder and written to the PIV credential during finalization. It is not stored in the identity management system and should not be written down or otherwise recorded by the PIV credential holder. The PIV credential is automatically locked after no more than 15 consecutive tries of entering an invalid PIN. PIV credential PIN reset details and requirements for resetting a PIN are identified in Section 6.7.

5.3 The Uniform Universal Personal Identification Code (UUPIC)

5.3.1 UUPIC System Management - The UUPIC system is the database and application that stores personnel information required for the creation of unique identities and that generates the UUPIC. This system shall be owned by OPS, working in concert with the OCIO and OCHCO, to ensure proper functioning, assignment, use, and protection of the UUPIC system. OPS is responsible for administrative identity management in the UUPIC system. The UUPIC system will be treated as a high confidentiality, integrity, and reliability system. Access to the system will be controlled by two-factor authentication, firewalls, and encryption techniques. The UUPIC generated by the system may be available to NASA employees for lookup and may be used for positive identification of individuals within NASA information systems. However, the UUPIC may not be used as a login identifier or user account name for any information systems, databases, Web sites, etc. Additionally the UUPIC may not be used for purposes other than those described above without the concurrence of the AIMO and the Director of Agency Workforce Systems, within OCHCO (or assigned delegate), with the exception of account initiation in the identity management system. System owners requiring access to the UUPIC system will submit a signed Service Level Agreement (SLA) and/or Memorandum of Understanding (MOU) to OPS.

5.3.2 Approval to Access the UUPIC System - The system owner requiring access to the UUPIC system shall submit a signed SLA/MOU to the ICAM Logical Access Management team detailing the purpose for accessing the UUPIC system. The ICAM Logical Access Management team will work with the system owner to ensure proper documentation and authority to access the UUPIC system. The ICAM Logical Access Management team will make a recommendation to approve or disapprove UUPIC system access to the AIMO. In the event of a denial for UUPIC access, the requesting system owner may appeal by sending a letter, along with the SLA/MOU, to OPS and OCIO. OPS and OCIO will respond with a final decision within 60 days of receipt of the appeal.

5.3.3 UUPIC Characteristics - UUPICs shall only be issued through the population of seed data (name, SSN or foreign national visitor number for foreign nationals without a SSN, and date of birth) into the UUPIC database. This information is required for all NASA civilians, contractors, partners, and remote IT system users. Any request for an UUPIC will be initiated via an approved work-flow method. The UUPIC database will auto-populate the NIMS, Identity Management System (IDMS), and EPACS upon returning a UUPIC number. The reliable assignment of the UUPIC to persons uses at least two unique attributes, in addition to name attributes, from approved identity source documents. The Agency directory is used as the UUPIC repository for general access to the UUPIC number. UUPIC numbers will be issued in random sequence, consistent with NASA policy, and will meet the following requirements:

a. Is a nine-digit numerical code without any significance as to the characteristics of the individual.

b. Is displayed as a set of 3 x 3 x 3 numbers, for example: 123 456 789.

c. Cannot be reverse-engineered based on other data contained in the UUPIC application.

5.3.4 UUPIC Usage - The UUPIC shall serve as a replacement for the SSN by providing a unique identifier that can serve as a data point across NASA information systems. Therefore, the UUPIC may not be used as a login identifier or user account name for any information systems, databases, Web site, etc. With the exception of account initiation in NIMS, use of the UUPIC for any identification purposes outside those needed for positive identification of individuals across and only within information systems is prohibited without the consent of the AIMO. The UUPIC may never be posted on any Internet accessible Web site. Any deviation from this policy will be coordinated with OPS through OCIO in advance. Requests for an UUPIC will be initiated via the approved workflow method. The UUPIC database will auto-populate the appropriate identity management systems upon returning a UUPIC number. UUPIC numbers are stored internally along with the first, middle, and last names and other information necessary to uniquely associate the UUPIC with a person.

DISTRIBUTION:
NODIS

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.