Home' RTCA Documents for Review : DO-230H FRAC Contents 39
©2017 RTCA, Inc.
might look to for ways to improve their identity management processes. Additional information on REAL
ID, including the status of implementation and state compliance with REAL ID requirements, can be found
at the DHS website.
Credentialing Implementation Checklist
The IDMS should provide access to the central database in a secure manner for identified airport operator
Trusted Agents to perform their functions via dedicated, directly connected workstations, and not via the
public Internet for security reasons.
It should be noted that integration may involve both internal and externally controlled data sources.
Where the airport has control over its data sources, integration is more easily accomplished because
there is a greater ability to ensure cooperation.
Airports should consider implementing a safeguard practice to address these considerations by
capturing a photo or biometric, such as a fingerprint, at the time of enrollment, potentially in
addition to that required by the CHRC requirement.
Only the level of access required for applicants to perform the duties of their job should be assigned
to the credential holder. To support these requirements, the IDMS should have several descriptive
options and associated procedures such as lost, stolen, recalled, revoked, expired and returned.
Utilize appropriate firewall techniques. Similar measures should also be considered for all
interfaces to external systems, including those to the federal government.
This authorization should include an indication of which areas and functions the applicant for which
will require a badge. Note that such “permission” may be authorizer specific, i.e. not all authorizers
can authorize all areas etc.
Airport operators should consider the implementation of an Identity Management System (IDMS)
as a common, modern approach to meeting the challenge of a complex and dynamic set of
regulations that govern the issuance and maintenance of airport credentials.
Where possible, airports should use document validation technologies such as ID scanners, UV
lights, and loupes to detect counterfeit or forged documents.
Breeder document services may be integrated with the IDMS or provided from another source. If
integrated with an IDMS, measures to protect against cyber-attack should be implemented.
Some IDMS solutions allow integration to Computer Based Training (CBT) systems. Each step in
the process should be gated and a person should not be able to progress through the process without
completing each step.
The IDMS should be integrated with the PACS to enable rapid disabling of a credential.
If an IDMS is fully integrated, it should include automatic submission of applicant demographics
and biometrics to the DAC. A fully integrated IDMS should push biographic information to the
live scan device so that information does not need to be re-entered. Fingerprint images with all the
biographic information is then sent to the DAC.
Airport operators should consider participating in the FBI's Rap Back service for recurrent
fingerprint vetting of aviation workers to enhance security and situational awareness.
Links Archive Navigation Previous Page Next Page