(a) In order to comply with FIPS PUB 201, agencies must purchase only approved personal identity verification products and services.

(b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

(c) When acquiring personal identity verification products and services not using the process in paragraph (b) of this section, agencies must ensure that the applicable products and services are approved as compliant with FIPS PUB 201 including—

(1) Certifying the products and services procured meet all applicable Federal standards and requirements;

(2) Ensuring interoperability and conformance to applicable Federal standards for the lifecycle of the components; and

(3) Maintaining a written plan for ensuring ongoing conformance to applicable Federal standards for the lifecycle of the components.

(d) For more information on personal identity verification products and services see http://www.idmanagement.gov.