diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..8225a6ac
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+_site/
+Gemfile.lock
+*~
\ No newline at end of file
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 00000000..a6017ee3
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,43 @@
+## Welcome
+
+Thank you for considering contributing to our development of open and transparent playbook. If you're unsure or afraid of anything, just ask or submit the issue or pull request. We appreciate any sort of contribution and are committed to transparency and collaboration.
+
+Before contributing, we encourage you to read our CONTRIBUTING policy (you are here), our LICENSE, and our README, all of which are in this repository.
+
+The idea for open sourcing this content, the contributing framework, and the licensing framework are based on repositories from [18F](https://github.com/18f)
+
+## Public domain
+
+This project is in the public domain within the United States, and
+copyright and related rights in the work worldwide are waived through
+the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/).
+
+All contributions to this project will be released under the CC0
+dedication. By submitting a pull request, you are agreeing to comply
+with this waiver of copyright interest.
+
+## How to Contribute
+We welcome contributions in the form of requests, issues and pages.
+
+* _Requests:_ You've identified a useful addition to the playbook which benefits USG Agencies
+ * Open an Issue on this repository
+ * State the recommendation
+ * Include any links or other information
+ * Discuss the request with other contributors
+
+* _Issues:_ You've identified an issue with the information
+ * Open an Issue on this repository
+ * Discuss the Issue with other contributors
+ * Follow the progress of the updates
+
+* _Pages:_ You'd like to contribute a Page and content
+ * Open an Issue on this repository, identifying the content you would like to contribute
+ * Limit each Issue to one content topic
+ * Fork the repository
+ * Add a new Page or modify an existing Page with your suggested content
+ * Submit a Pull Request, referencing the Issue Number
+
+## General Practices
+This content is Vendor neutral. Marketing materials for Commercial Products should not be submitted. If you would like to contribute a page or content which includes Commercial Products and a specific references for development and engineering, please review the Commercial Product trademark or copyright guides from the Product Vendor and reference those guides in your Pull Request.
+
+Contributors should consider the audience when submitting content. Plain language benefits a broad audience. Review your proposed content for use of acronyms and specialized jargon before submitting.
diff --git a/Gemfile b/Gemfile
new file mode 100644
index 00000000..3a1ebf30
--- /dev/null
+++ b/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'github-pages'
\ No newline at end of file
diff --git a/LICENSE.md b/LICENSE.md
new file mode 100644
index 00000000..bc66d4bf
--- /dev/null
+++ b/LICENSE.md
@@ -0,0 +1,31 @@
+This project is in the
+public domain within the United States.
+
+We waive copyright and related rights in the work
+worldwide through the CC0 1.0 Universal public domain dedication.
+
+## CC0 1.0 Universal Summary
+
+This is a human-readable summary of the [Legal Code (read the full text)](https://creativecommons.org/publicdomain/zero/1.0/legalcode).
+
+### No Copyright
+
+The person who associated a work with this deed has dedicated the work to
+the public domain by waiving all of his or her rights to the work worldwide
+under copyright law, including all related and neighboring rights, to the
+extent allowed by law.
+
+You can copy, modify, distribute and perform the work, even for commercial
+purposes, all without asking permission.
+
+### Other Information
+
+In no way are the patent or trademark rights of any person affected by CC0,
+nor are the rights that other persons may have in the work or in how the
+work is used, such as publicity or privacy rights.
+
+Unless expressly stated otherwise, the person who associated a work with
+this deed makes no warranties about the work, and disclaims liability for
+all uses of the work, to the fullest extent permitted by applicable law.
+When using or citing the work, you should not imply endorsement by the
+author or the affirmer.
diff --git a/README.md b/README.md
new file mode 100644
index 00000000..f9048234
--- /dev/null
+++ b/README.md
@@ -0,0 +1,40 @@
+---
+layout: default
+permalink: /
+---
+
+## How to Contribute
+We welcome contributions in the form of requests, issues and pages.
+
+* _Requests:_ You've identified a useful addition to the playbook which benefits USG Agencies
+ * Open an Issue on this repository
+ * State the recommendation
+ * Include any links or other information
+ * Discuss the request with other contributors
+
+* _Issues:_ You've identified an issue with the information
+ * Open an Issue on this repository
+ * Discuss the Issue with other contributors
+ * Follow the progress of the updates
+
+* _Pages:_ You'd like to contribute a Page and content
+ * Open an Issue on this repository, identifying the content you would like to contribute
+ * Limit each Issue to one content topic
+ * Fork the repository
+ * Add a new Page or modify an existing Page with your suggested content
+ * Submit a Pull Request, referencing the Issue Number
+
+### Public domain
+
+This project is in the worldwide [public domain](LICENSE.md). As stated in [CONTRIBUTING](CONTRIBUTING.md):
+
+> This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/).
+>
+> All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.
+
+### Special Thanks
+This site is based on GitHub Pages and Jekyll templates. The templates are based on [DOCter](https://github.com/cfpb/docter/) from [CFPB](http://cfpb.github.io/).
+
+The README, LICENSING and CONTRIBUTING are based on [18F Pages](https://pages.18f.gov/).
+
+Special thanks to the teams at [18F](https://18f.gsa.gov/), [18F Pages](https://pages.18f.gov/), and [US Digital Services Playbooks](https://playbook.cio.gov/) for their open and transparent model which benefits citizens, government and technology.
diff --git a/_config.yml b/_config.yml
new file mode 100644
index 00000000..089862fd
--- /dev/null
+++ b/_config.yml
@@ -0,0 +1,131 @@
+# Site settings
+title: PIV Enablement Guides
+name: PIV Enablement Guides
+email: icam@gsa.gov
+author:
+ name: FICAM
+description: PIV Guidance
+baseurl: '/piv-guides'
+#url: "http://yourdomain.com" # the base hostname & protocol for your site
+#twitter_username: jekyllrb
+github_username: lachellel
+highlighter: pygments
+
+# Point the logo URL at a file in your repo or hosted elsewhere by your organization
+logourl:
+logoalt: Federal Identity Credential and Access Management
+
+# Repo list
+# List repos that you would like to appear on the homepage here
+repos:
+- name: playbook-piv
+ description: FICAM Playbook - PIV Guidance
+ url: https://github.com/gsa/piv-guides
+
+# Build settings
+markdown: kramdown
+
+exclude:
+- bin
+- config.rb
+- Gemfile
+- Gemfile.lock
+- gems
+- Procfile
+- Rakefile
+- README.md
+- script
+- vendor
+
+navigation:
+- text: Introduction
+ url: index.html
+ internal: true
+ coll: false
+- text: Elements of a PIV Card
+ url: elements
+ internal: true
+ coll: false
+#- text: PIV Infrastructure
+# url: boxes
+# internal: true
+# coll: false
+#- text: PIV Authentication Mechanisms
+# url: authen
+# internal: true
+# coll: false
+#- text: How do I enable Microsoft AD for Admin access?
+# url: 4_adadmin
+# internal: true
+# coll: false
+#- text: How do I enable a domain to assert assurance in AD?
+# url: 5_domainassert
+# internal: true
+# coll: false
+#- text: How do I enable Firefox to allow the use of PIV/CAC?
+# url: 6_firefox
+# internal: true
+# coll: false
+#- text: How do I enable Internet Explorer to allow the use of PIV/CAC?
+# url: 7_ie
+# internal: true
+# coll: false
+#- text: How do I enable Chrome to allow the use of PIV/CAC?
+# url: 8_chrome
+# internal: true
+# coll: false
+#- text: How do I validate trust stores on a Windows platform?
+# url: 9_trustwindows
+# internal: true
+# coll: false
+#- text: How do I validate trust stores on a Mac platform?
+# url: 10_trustmac
+# internal: true
+# coll: false
+#- text: How do I enable PIV/CAC for SSH to a Unix-like system?
+# url: 11_ssh
+# internal: true
+# coll: false
+#- text: How do I enable Remote Desktop Protocol (RDP) to allow PIV/CAC?
+# url: 12_rdp
+# internal: true
+# coll: false
+#- text: How do I use PIV/CAC with a mainframe?
+# url: 13_mainframe
+# internal: true
+# coll: false
+#- text: How do I enable a website to use PIV/CAC?
+# url: 14_website
+# internal: true
+# coll: false
+- text: Developer Guides
+ url: devconfig/index/
+ internal: true
+ coll: true
+ collname: devconfig
+- text: User Guides
+ url: userconfig/index/
+ internal: true
+ coll: true
+ collname: userconfig
+
+
+collections:
+ userconfig:
+ label: "User Guides"
+ permalink: /userconfig/:path/
+ output: true
+ devconfig:
+ label: "Developer Guides"
+ permalink: /devconfig/:path/
+ output: true
+
+
+include:
+- _stylesheets
+- _javascript
+
+
+
+# Custom site configuration
+lang: en
diff --git a/_devconfig/15_network.md b/_devconfig/15_network.md
new file mode 100644
index 00000000..13a9433a
--- /dev/null
+++ b/_devconfig/15_network.md
@@ -0,0 +1,130 @@
+---
+layout: page_collection
+title: How do I PIV enable my network logon?
+collection: devconfig
+permalink: devconfig/15_network/
+---
+
+#### Overview
+This guide will take you through the steps necessary to configure your Windows based computer network to accept and potentially require PIV cards for authentication.
+
+##### Assumptions
+* Your organization users are currently issued PIV cards
+* Your organization is using Microsoft Active Directory to manage your Windows network users
+* Your organization is using Microsoft Windows Server 2008 R2 or 2012
+ * Concepts will likely remain applicable to other versions of Windows Server, however, specific instructions may require modification
+* Your organization's systems are configured to automatically receive certificate updates via auto-enrollment or some other technique
+
+#### Before you get started
+The following reference information may be useful or required for configuring your systems depending on your architecture. Some information will need to be obtained from the appropriate organization.
+
+* CA Certificate that signed the authentication certificates
+ * The Federal PKI [Federal Common Policy CA Certificate](http://http.fpki.gov/fcpca/fcpca.crt) - the root CA Certificate created by the Federal PKI Management Authority (FPKIMA)
+ * Subordinate CAs in the chain including the Certification Authority that issued the certificates - If your agency issues your certificates, it will be your agency's CA certificate. If your agency's certificates are generated by another organization, such as a managed service, you'll need to acquire it from them.
+* Certificate Revocation Lists (CRL)
+ * The FPKI
+ * [CRL over HTTP](http://http.fpki.gov/fcpca/fcpca.crl)
+ * [CRL over LDAP](ldap://ldap.fpki.gov/cn=Federal%20Common%20Policy%20CA,ou=FPKI,o=U.S. %20Government,c=US)
+ * The CRL of the Certification Authority that issued your agency's certificates.
+
+
+
+#### Complete the following tasks
+
+
+### Request and install Domain Controller certificates
+
+> TODO
+{:class="warning"}
+
+
+
+### Add the CA Certificates to the Trusted Root Certification Authorities
+
+
+The root certificate and intermediate CA certs are required by the domain controller to establish a chain of trust between the parent CA and the end users and applications. This allows the domain controller to issue trusted certificates to PIV cards within the directory and confirm the validity of smart card certificates during an access attempt.
+
+Active Directory must be configured to trust a certification authority to authenticate users based on certificates from that CA. Both Smartcard workstations and domain controllers must be configured with correctly configured certificates.
+
+This task will configure Active Directory to trust the Certification Authority chain that signed the users' authentication certificates. To configure Active Directory with the signing CA Certificate chain:
+
+1. On your Active Directory Domain Controller server, select **Active Directory Users and Computers**
+2. In the **Management Console**, right click the **Domain** and click **Properties**
+3. Once you're on the **Group Policy Tab**, click **Open** to open the **Group Policy Management Console plug-in**
+4. Right Click **Default Domain Policy** and click **Edit**
+5. Expand the **Computer Configuration** section and open **Windows Settings > Security Settings > Public Key**
+6. Right click **Trusted Root Certification Authorities** and select **Import**
+7. Follow the prompts in the Wizard to import the **Root Certificate** for the CA and click OK
+
+From here, follow these steps to import the intermediate certificate(s):
+
+1. Right click **Intermediate Certification Authorities** and select **Import**
+2. Follow the prompts in the Wizard to import the **Intermediate Certificate(s)** for the CA and click OK
+
+
+
+### Publish the CA Certificates to the NTAuth Store
+
+
+By publishing the CA certificate to the enterprise NTAuth store, the system administrator indicates that the CA is trusted to issue certain certificates. This allows the correct certificates to be issued to smartcards and thus enables logon through PIV card authentication.
+
+This task will configure Active Directory to trust the CA chain that signed the users' authentication certificates. To configure Active Directory with the signing CA Certificate chain:
+
+1. On the Active Directory Domain Controller, launch an **elevated command prompt** to use the **certutil** utility
+2. To **Publish the Certificate** to the **Enterprise NTAuth store** type
+
+ certutil –dpublish –f "path_to_root_CA_cert" NTAuthCA
+
+3. The CA is now trusted to issue certificates of this type
+
+
+
+### Associate PIV Credentials with Active Directory Accounts (AltSecID)
+
+
+> TODO
+{:class="warning"}
+
+
+
+### Configure group policies for PIV Authentication
+
+
+This task describes 2 common configurations related to domain Group Policy Objects (GPO).
+
+| scforceoption | This security policy setting requires users to log on to a computer by using a smart card. | Enabled / Disabled |
+| scremoveoption | This setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. | No Action / Lock Workstation / Force Logoff / Disconnect if a Remote Desktop Services session |
+
+**scforceoption** directs client Windows computers to enforce PIV logon for users. It is important to understand the ramifications of executing this step.
+
+When you select the Smart Card is required for interactive logon check box in the Active Directory (AD) user account properties, Windows automatically resets the user password to a random complex password. In addition, Windows adds the SMARTCARD_REQUIRED flag to the UserAccountControl user account attribute and sets the DONT_EXPIRE_PASSWORD flag on the user account. The latter ensures that the user's password never expires after the Smart Card is required for interactive logon option is selected.
+
+When a user logs on to Windows either locally or remotely using a Remote Desktop session, the Windows client automatically checks for the presence of the SMARTCARD_REQUIRED flag. If the Smart Card is required for interactive logon option is set for the user, Windows rejects the logon attempt if it's not made with smart card credentials.
+
+Again, upon activation of scforceoption, users will **no longer know the password** to their account and will be **required** to use their PIV for authentication. Care should be used if enabling this option.
+
+To enable or disable either of these policies:
+
+1. Open the Group Policy Management Console
+1. In the GPMC console tree, double-click Group Policy Objects in the forest and domain containing the GPO that you want to edit.
+1. Right-click the GPO, and then click Edit.
+1. In the console tree, edit the settings as appropriate.
+
+
+
+
+#### References
+
+Elements of this guide were derived from a [Microsoft Knowledgebase Article](https://support.microsoft.com/en-us/kb/281245)
diff --git a/_devconfig/index.html b/_devconfig/index.html
new file mode 100644
index 00000000..4992b1e1
--- /dev/null
+++ b/_devconfig/index.html
@@ -0,0 +1,19 @@
+---
+layout: default
+title: Introduction
+collection: devconfig
+---
+{% capture index %}{% include dev_index.md %}{% endcapture %}
+{{ index | markdownify }}
+
+
\ No newline at end of file
diff --git a/_includes/dev_index.md b/_includes/dev_index.md
new file mode 100644
index 00000000..6a9d2cd6
--- /dev/null
+++ b/_includes/dev_index.md
@@ -0,0 +1,21 @@
+## Introduction to PIV Developer Guides
+
+PIV Developer Guides are designed to help system administrators configure their organization's systems to require PIV authentication. These guidance documents are often highly technical in nature and cover specific step-by-step procedures to configure a system successfully. All completed guidance documents can be found in the Developer Guides dropdown in the navigation bar to the left.
+
+Future developer guides may cover the following topics:
+
+ * How do I validate trust stores on a Mac platform?
+* How do I enable PIV/CAC for SSH to a Unix-like system?
+* How do I enable Remote Desktop Protocol (RDP) to allow PIV/CAC?
+* How do I use PIV/CAC with a mainframe?
+* How do I enable a website to use PIV/CAC?
+* How do I use PIV/CAC with a Unix-like system?
+* How do I use PIV/CAC on a Mac?
+* How do I enable Microsoft AD for Admin access?
+* How do I enable a domain to assert assurance in AD?
+* How do I enable Firefox to allow the use of PIV/CAC?
+* How do I enable Internet Explorer to allow the use of PIV/CAC?
+* How do I enable Chrome to allow the use of PIV/CAC?
+* How do I validate trust stores on a Windows platform?
+
+To help contribute to this effort, please follow 'Submit Issues Here' link at the top right to access the GitHub page for this site and provide any feedback.
\ No newline at end of file
diff --git a/_includes/footer.html b/_includes/footer.html
new file mode 100644
index 00000000..be3976f7
--- /dev/null
+++ b/_includes/footer.html
@@ -0,0 +1,55 @@
+
diff --git a/_includes/head.html b/_includes/head.html
new file mode 100644
index 00000000..47057b50
--- /dev/null
+++ b/_includes/head.html
@@ -0,0 +1,12 @@
+
+
+
+
+
+ {% if page.title %}{{ page.title }}{% else %}{{ site.title }}{% endif %}
+
+
+
+
+
+
diff --git a/_includes/header.html b/_includes/header.html
new file mode 100644
index 00000000..cfe381f7
--- /dev/null
+++ b/_includes/header.html
@@ -0,0 +1,27 @@
+
+
+
+
+
diff --git a/_includes/index.md b/_includes/index.md
new file mode 100644
index 00000000..4919d1a9
--- /dev/null
+++ b/_includes/index.md
@@ -0,0 +1,27 @@
+## Introduction to PIV Enablement Guides
+
+Welcome to the Personal Identity Verification (PIV) Card Playbook! On this site you will find detailed documentation on how to successfully implement common PIV processes at your organization.
+
+To return to the main playbook, [click here](/ficam-guides/).
+
+#### What is PIV?
+
+A Personal Identity Verification (PIV) card is a reliable, government-wide identity credential used to access Federally controlled facilities and information systems at the appropriate security level. PIV cards store information such as pin numbers, biometrics like fingerprints and pictures, and other unique identifiers that allow for multifactor authentication. The release of [HSPD-12](http://www.dhs.gov/homeland-security-presidential-directive-12) and the subsequent technical requirements of [FIPS 201](http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf) have driven and guided the development and implementation of PIV cards across the Federal Government.
+
+#### Why is PIV enablement important?
+
+Enabling systems and facilities to use PIV authentication greatly enhances the security stance of an organization. PIV cards allow for a high level of assurance in the individuals that access your resources, as they are only issued by trusted providers to individuals that have been thoroughly verified, and are highly resistant to identity fraud, tampering, counterfeiting, and exploitation.
+
+#### What should be PIV enabled?
+
+Any system at your organization that requires heightened security for determining who should gain access to the resources it protects can be PIV enabled. While PIV cards can be used for making authentication decisions on almost any system, they are especially useful for systems that protect highly sensitive information, as PIV cards provide the highest level of assurance in the user attempting to access the protected resource. Physical locations can also be safeguarded through PIV enablement, ensuring that only the proper individuals can gain access to a particular facility, building, or room.
+
+#### This Playbook
+
+You will find two different kinds of guidance documents in this Playbook; Developer Guides and User Guides. Developer guides are tailored to help system administrators and developers assure that they have technically configured their systems and infrastructure to fully support PIV solutions. User guides are to be leveraged by end users seeking general information on their PIV card and how to use it to successfully access federal resources.
+
+For more information on PIV cards:
+
+- [NIST Special Publication 800-73, "Interfaces for Personal Identity Verification"](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-73-4.pdf) - specifies the interface and data elements of PIV cards
+- [NIST Special Publication 800-76, "Biometric Data Specification for Personal Identity Verification"](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-76-2.pdf) - specifies the technical acquisition and formatting requirements for biometric data of the PIV system
+- [NIST Special Publication 800-78, "Cryptographic Algorithms and Key Sizes for Personal Identity Verification"](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-78-4.pdf) - specifies the acceptable cryptographic algorithms and key sizes to be implemented and used for the PIV system
diff --git a/_includes/primary-nav-items.html b/_includes/primary-nav-items.html
new file mode 100644
index 00000000..bb88a652
--- /dev/null
+++ b/_includes/primary-nav-items.html
@@ -0,0 +1,17 @@
+
diff --git a/_includes/sidebar.html b/_includes/sidebar.html
new file mode 100644
index 00000000..2fb590a0
--- /dev/null
+++ b/_includes/sidebar.html
@@ -0,0 +1,29 @@
+
diff --git a/_includes/user_index.md b/_includes/user_index.md
new file mode 100644
index 00000000..5ef12399
--- /dev/null
+++ b/_includes/user_index.md
@@ -0,0 +1,5 @@
+## Introduction to PIV User Guides
+
+PIV User Guides are designed to help end users successfully understand and leverage their PIV card to access federal systems and facilities. These guides will be created as relevant topics are identified.
+
+To help contribute to this effort, please follow 'Submit Issues Here' link at the top right to access the GitHub page for this site and provide any feedback.
\ No newline at end of file
diff --git a/_layouts/default.html b/_layouts/default.html
new file mode 100644
index 00000000..3922baa3
--- /dev/null
+++ b/_layouts/default.html
@@ -0,0 +1,64 @@
+
+
+
+
+
+
+ {% if page.title == null %}
+ {{ site.name }}
+ {% else %}
+ {{ page.title }} - {{ site.name }}
+ {% endif %}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Most applications for the PIV card leverage the logical data elements on the card to perform electronic verification of a claimed identity. These data elements are defined as part of the PIV card data model, outlined in NIST SP 800-73. The PIV card data objects provide graduated levels of identity assurance and allow an agency the opportunity to select appropriate levels of security for applications being accessed with the PIV card. The following elements comprise the mandatory objects of the PIV card data model:
+
+- Card Capability Container: An object that holds data sets and supports minimum capacity for retrieval of the Data Model. The Card Capability Container allows each PIV card to carry the information needed for software to communicate with the card
+- Cardholder Unique Identifier (CHUID): A data element used by the card to prove the identity of the cardholder to an external entity. The CHUID includes a 16 byte Global Unique Identifier (GUID), a 25-byte Federal Agency Smart Credential Number (FASC-N), which uniquely identifies each card, expiration date, and issuer digital signature.
+- Certificate for PIV Authentication: A certificate used with its associated private key to authenticate the card and the cardholder.
+- Cardholder fingerprints: Primary and secondary fingerprint templates stored on the card for performing authentication.
+- Security Object: Signed data object that enforces the integrity of unsigned information (and optionally all PIV data objects, excluding digital certificates).
+
+In addition to the mandatory data objects, there are also 28 optional data objects for interoperable use. Of particular note are the optional certificates that further support authentication and expanded uses, including encryption and digital signing. Digital certificates are a primary tool for performing electronic verification for logical access applications and for modernization of physical access applications.
diff --git a/pages/infrastructure.md b/pages/infrastructure.md
new file mode 100644
index 00000000..a10d6856
--- /dev/null
+++ b/pages/infrastructure.md
@@ -0,0 +1,14 @@
+---
+layout: page
+title: PIV Infrastructure
+permalink: /infrastructure/
+---
+