Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal Government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a Federal Government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

FIPS 201 Evaluation Program

The Federal Information Processing Standard 201 (FIPS 201) Evaluation Program (sometimes called the FICAM Testing Program) tests and certifies services and commercial products used in PIV credentialing systems, physical access control systems (PACS), and public key infrastructures (PKIs).

For the latest testing news, view the program announcements.

Testing and Certification

We test and certify a variety of products and services such as:

  • Smart cards (secure elements) used in Personal Identity Verification (PIV) and Common Access Card (CAC) credentials
  • Physical access control systems for buildings including readers and infrastructure
  • Service providers who manage, install, or provide hosted solutions for issuance of Personal Identity Verification (PIV) and CAC credentials

If you’re looking for testing procedures related to products not listed above, review the announcements. Over the years, some product testing has been deprecated to eliminate redundancy, or the product categories have become stable and represent general commercial use products.

Product Testing

Product testing is performed by either:

  • Third-party accredited testing labs, OR
  • GSA-managed testing labs

If the product passes testing and review, the vendor is granted a letter of certification, and the product is placed on the Approved Products List (APL). The APL includes product information, version, date of certification, and special considerations.

Visit the Vendors page for more on testing and certification.

Testing Guidance and Documents

Functional requirements for the products are outlined in each test procedure. Review the testing agreements, and the test procedure for your specific product, and submit the agreement and package to fips201ep at gsa.gov.

Testing Agreements

Review the testing agreements, and sign and submit the appropriate agreement with your testing package to fips201ep at gsa.gov.

Personal Identity Verification Credentials

PIV Card Body Application Package Requirements

All applicants, please complete the following steps:

  1. Review the Personal Identity Verification (PIV) Card Body Approval Procedures v11.0 (PDF, April 2023) – outlining the approval procedures and evaluation criterion for getting the PIV Card body (Product) on the APL and Section 2 Application Package
  2. Provide the Product itself (see Section 2) of the Personal Identity Verification (PIV) Card Body Approval Procedures v11.0 (PDF, April 2023)
  3. Complete and provide the PIV Card APL Evaluation Program Application Form (Word, April 2023) – Required for each product submission.
  4. Complete and provide the FIPS 201 Evaluation Program Lab Services Agreement, V3.0.0 (PDF) – Required for each product submission.
  5. Complete and provide the FIPS 201 Evaluation Program Attestations to Federal Acquisition Regulations related to the Trade Agreement Act v3.3 – Required for each product submission.
  6. Complete and provide the FIPS 201 Evaluation Program Attestations Form for PIV Card Body Approval v1.0 – Required for each product submission.

Derived PIV Credentials

Agencies that wish to issue D-PIV credentials should follow these steps:

  1. Perform a NIST SP 800-79 assessment and receive an Authority To Operate (ATO)
  2. Work with your Shared Service Provider (SSP) to obtain D-PIV Object Identifiers (OIDs)
  3. Submit sample D-PIV public certificates for testing or provide results from the Certificate Profile Conformance Tool (CPCT) to fips201ep at gsa.gov.

Upon successful completion of DPCI testing, the agency or organization will be granted approval to issue D-PIV credentials.

Physical Access Control System

GSA tests and validates the interoperability of PIV and CAC credentials with the software and hardware used to restrict physical access to government facilities.

Review the test procedures, choose one of the application packages, and submit to fips201ep at gsa.gov.

PACS Application Package for New Systems or for Updates to Previously Approved Systems

All applicants, please complete the following steps:

  1. Review the - Approved Product List Application Guidance Document (PDF, April 2022) – Instructions for completeing the Approved Product List Application Form.
  2. Complete the Approved Product List Application Form (Word, April 2022) – Required for each solution submission, new or upgrade.
  3. Provide the equipment table from the Approved Product List Application as a separate file. Equipment Table GSA PACS Application v0.1 (XLSX, February 2023)
  4. Reseller Acknowledgement Form (MS Word, September 2014) – If you are reselling another product, this must be disclosed, and the signed agreement submitted.
  5. Include the following document when adding a new series, or adding new product to a prior listed series, signed by a C- or VP-level individual:
  6. Provide a solution configuration guide that includes, at a minimum:
    • Screenshots and instructions on configuring the submitted solution to meet the test cases.
    • Location of all log files needed to verify the solution is performing the test cases.
    • Steps necessary to verify the hardware, software, and firmware of all items listed on the equipment table in the APL application.
  7. Complete the additional documentation
  8. Review the following documentation and select from the appropriate topology that best describes your solution:
  9. Complete the PACS FRTC Topology Mapping Workbook (XLSX, October 2021) for your topology.
  10. Complete the FIPS 201 Evaluation Program – Evaluation Agreement (MS Word, September 2020).
  11. Include all applicable VPAT statements, UL-294, and FIPS 140-2/140-3 listing documents.
  12. Submit all completed forms to fips201ep at gsa.gov.

Test Card Loaners

GSA can loan you test cards to help you pre-test your physical access control system products.

IDManagement.gov

An official website of the U.S. General Services Administration

Looking for U.S. government information and services?
Visit USA.gov

This site is a collaboration between GSA and the Federal CIO Council. It is managed by the Identity Assurance and Trusted Access Division in the GSA Office of Government-wide Policy.

Edit this page