Why does GSA have the responsibility to perform FIPS201 evaluation?

This responsibility has been mandated by OMB in OMB Memorandum M-05-24.

Why isn’t there a category on the FIPS201 Product/Service category list for my product/service?

The list created represents the technical data that has been defined. If a product doesn’t have a category, GSA felt that there wasn’t enough information to support that category. However, this doesn’t mean that agencies cannot purchase that specific product. It means that the agency has to determine how to make that product meet the HSPD-12 goals.

There have been a lot of references to NIST. Can the relationship between GSA and NIST during this process be described? And what if anything from this is a prerequisite for entering the evaluation through GSA?

NIST can be defined as the source in which GSA works from. GSA has been mandated to verify that the laid out requirements have been included in products and services in which the requirements apply. GSA plays a role in ensuring that NIST accomplishes what is required. NIST certification is part of the evaluation process before a product is put on the approved products list. A vendor can start the approval process before the NIST evaluation process is complete. However, prior to final approval, the NIST evaluation must be complete. The categories that require NIST certification include the template matcher, template generator, biometric functionality, the card itself, PIV middleware, and the crypto module.

The download ZIP file from the GSA FIPS 201 Evaluation Product for these products includes a non-disclosure agreement (NDA) with Atlan Laboratories of McLean, VA. Is Atlan the “Lab” that is referenced in the approval procedure documents associated with these products?

Yes, Atlan Laboratories is currently GSA’s FIPS 201 Evaluation Laboratory.

This OMB memorandum includes an attachment with a table that lists products and services applying for approval. Under Item #4 it indicates that there have been no products for which application package has been completed. However, under item #5, it states that 9 products have been approved. Please clarify how a product can be approved without a completed application package.

The number of products for which an application package has been completed (as defined in the OMB Table) defines products/services that have had application packages evaluated by the lab, and have been determined to have submitted all documents (as required by the appropriate approval procedure), but have not yet completed the entire evaluation process .

A reference is made to application fees and non-compliance fees. Can you be more specific regarding the fee structure and remittance of fees?

Starting April 2, 2007, Labs will perform evaluation for Vendors on a cost reimbursable basis. Fees will be determined based on the category. The exact fee value will be negotiated by the Lab and the Vendor prior to commencing evaluation.