Public Key Infrastructure(PKI)
A framework of policies and technologies that enable secure authentication and encryption using public-key cryptography, foundational to federal IT security.
Overview
Public Key Infrastructure (PKI) is the system of certificate authorities, digital certificates, and cryptographic keys that enables secure authentication, digital signatures, and encrypted communications. Federal agencies and contractors use PKI for PIV/CAC authentication, encrypted email, secure web connections, and code signing. PKI is a cornerstone of federal cybersecurity.
Why It Matters in GovCon
Contractors handling federal data often must integrate with federal PKI, including the Federal Bridge Certificate Authority and agency-specific PKI. Proposals for IT and cybersecurity work frequently require PKI expertise. Understanding PKI requirements is essential for compliance with FISMA, NIST standards, and contract security clauses.
Key Details
- Certificate Authority (CA): Issues and validates digital certificates.
- Federal PKI: The U.S. government operates a hierarchy of CAs for federal systems.
- PIV/CAC: Smart cards use PKI for two-factor authentication.
- Encryption: PKI enables TLS/SSL for secure communications.
- NIST Standards: NIST SP 800-57 provides guidance on key management.
- Contract Requirements: IT contracts often mandate PKI for accessing federal systems.
Related Terms
- Personal Identity Verification (PIV)
- Common Access Card (CAC)
- NIST SP 800-171
- System Security Plan (SSP)
More Security Terms
The government official with the authority to enter into, administer, and terminate contracts on behalf of the U.S. government.
A government employee designated by the contracting officer to monitor contractor performance and serve as the technical point of contact.
Federal law establishing a framework for securing federal information systems and protecting government data.
A government-wide program that provides a standardized approach to security assessment and authorization for cloud services.
A sensitivity designation for unclassified information that requires protection from unauthorized disclosure.
Policies and technologies that control who can access systems and data and what they can do.
Ready to Win More Contracts?
Use GovCon Data to find opportunities matched to your business and generate winning proposals with AI.