What minimum process did HSPD-12 require for granting access to government-controlled facilities and information?

• A. A simple name check against an internal list.
• B. A full public disclosure of personnel records.
• C. A credentialing determination of employees and contractors, resulting in the issuance of a Personal Identification Verification (PIV) card.
• D. Annual fitness assessment for access privileges.

Answer: (C)

Federal guidance requires a process to verify and certify someone’s identity before granting access to government-controlled spaces and systems. The minimum approach is a credentialing determination for employees and contractors, which includes identity proofing and a background check, culminating in issuing a Personal Identification Verification (PIV) card. This card provides a trusted, verifiable identity that can be used for both physical access to facilities and logical access to information systems, often leveraging two-factor authentication (the card plus a PIN).

A simple name check doesn’t establish a verified identity or risk level. Public disclosure of personnel records is invasive and not part of the access-eligibility process. An annual fitness assessment is unrelated to identity or access control.