NIST SP 800-63A-4 日本語訳

•Identity resolution: Determine that the claimed identity corresponds to a single, unique individual within the context of the population of users served by the CSP or online service.

•Evidence validation: Confirm that supplied identity evidence is genuine, authentic, and accurate.

•Attribute validation: Confirm the accuracy of the core attributes, which are the minimum set of attributes required to complete identity proofing and provide services.

•Identity verification: Confirm that the applicant is the genuine owner of the presented evidence and attributes.

•Identity enrollment: Enroll the identity-proofed applicant into the CSP’s identity service as a subscriber.

•Fraud mitigation: Detect, respond to, and prevent access to benefits, services, data, or assets using a fraudulent identity.

•Specific terms in CAPITALS represent normative requirements. When these same terms are not in CAPITALS, the term does not represent a normative requirement.

•The terms “SHALL” and “SHALL NOT” indicate requirements to be followed strictly in order to conform to the publication and from which no deviation is permitted.

•The terms “SHOULD” and “SHOULD NOT” indicate that among several possibilities, one is recommended as particularly suitable without mentioning or excluding others, that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited.

•The terms “MAY” and “NEED NOT” indicate a course of action permissible within the limits of the publication.

•The terms “CAN” and “CANNOT” indicate a possibility and capability — whether material, physical, or causal — or, in the negative, the absence of that possibility or capability.

•Section 1 introduces the document. This section is informative.

•Section 2 describes requirements for identity proofing. This section is normative.

•Section 3 describes general requirements for IALs. This section is normative.

•Section 4 describes requirements for specific IALs. This section is normative.

•Section 5 describes subscriber accounts. This section is normative.

•Section 6 provides security considerations. This section is informative.

•Section 7 provides privacy considerations. This section is informative.

•Section 8 provides customer experience considerations. This section is informative.

•The References section contains a list of publications that are cited in this document. This section is informative.

•Appendix A provides a non-exhaustive list of types of identity evidence grouped by strength. This appendix is informative.

•Appendix B contains a selected list of abbreviations used in this document. This appendix is informative.

•Appendix C contains a glossary of selected terms used in this document. This appendix is informative.

•Appendix D contains a summarized list of changes in this document’s history. This appendix is informative.

1.Resolution

•The CSP collects one or two pieces of identity evidence of appropriate strength.

•The CSP collects any additional core attributes, as needed, from the applicant to supplement those contained in the presented identity evidence.

2.Validation

•The CSP confirms that the presented evidence is authentic, accurate, and valid.

•The CSP validates the attributes obtained in step 1 by checking them against authoritative or credible validation sources, as described in Sec. 2.4.2.4.

3.Verification

•The CSP employs an approved identity verification process to confirm that the applicant is the genuine owner of the presented identity evidence.

4.Enrollment Upon the successful completion of the three identity proofing steps, a notification of proofing is sent to a validated address, and the applicant can be enrolled into a subscriber account with the CSP, as described in Sec. 5. A subscriber account includes at least one validated address (e.g., phone number, mailing address) that can be used to communicate with the subscriber about their account. Additionally, one or more authenticators are bound to the proven identity in the subscriber account.

•Proofing agent: An agent of the CSP who is vetted and trained to attend on-site or remote identity proofing sessions and make limited, risk-based decisions (e.g., visually inspecting identity evidence and determining it has not been altered). See Sec. 3.13 for minimum training requirements for proofing agents.

•Trusted referee: An agent of the CSP, a third-party service, or a relying party (RP) who is vetted and trained to make risk-based decisions regarding an applicant’s identity proofing case when that applicant is unable to meet the expected requirements of a defined IAL proofing process. Requirements for trusted referees are contained in Sec. 3.15.1. In contrast to proofing agents, trusted referees receive additional training and resources to support exception handling scenarios, including when applicants do not possess the required identity evidence or the attributes on the evidence do not all match the claimed identity (e.g., due to a recent name or address change).

•Applicant reference: A representative of the applicant who can vouch for the identity of the applicant, specific attributes related to the applicant, or conditions relative to the context of the individual (e.g., emergency status, homelessness). An applicant reference does not act on behalf of the applicant in the identity proofing process but can support claims of identity. Requirements for applicant references are contained in Sec. 3.15.3.

•Process assistant: An individual who provides support services (e.g., translation, transcription, or accessibility support) to assist the applicant in the identity proofing process but does not support decision-making or risk-based evaluation. Since the process assistant is not involved in decision-making there are no requirements in these guidelines for this role.

•Remote unattended identity proofing: Identity proofing conducted where the resolution, validation, and verification processes are completely automated, and interaction with a proofing agent or trusted referee is not required. The location and devices used in the proofing process are not controlled by the CSP.

•Remote attended identity proofing: Identity proofing conducted where the applicant completes resolution, validation, and verification steps through a secure video session with a proofing agent or trusted referee. The location and devices used in the proofing process are not controlled by the CSP.

•On-site unattended identity proofing: Identity proofing conducted where an individual interacts with a controlled workstation or kiosk, but interaction with a proofing agent or trusted referee is not required. The process is fully automated but at a physical location and on devices controlled by the CSP.

•On-site attended identity proofing: Identity proofing conducted in a physical setting where the applicant completes the entire identity proofing process (i.e., resolution, validation, and verification) in the presence of a proofing agent or trusted referee. The proofing agent or trusted referee can be co-located with the user or interact with the user via a kiosk or device. The physical location and devices are controlled by the CSP.

•First name: The applicant’s given name.

•Middle name or initial: The applicant’s middle name or initial, as applicable.

•Last name: The applicant’s last name or family name, as appropriate.

•Date of birth: The date on which the applicant was born.

•Physical or digital address: A physical (i.e., mailing address) or digital (e.g., phone number or email) address at which the applicant can receive communications related to the proofing process.

•The level of rigor associated with its issuance process

•The ability to be validated to a given level of confidence, including accuracy and authenticity checks

•The ability to support one or more of the identity verification methods presented in Sec. 2.5.1

1.There is a reasonable expectation that the issuing source of the evidence confirmed the claimed identity by following formal procedures designed to provide assurance that the claimed identity is associated with the subject, such as evidence issued by financial institutions that have customer identity verification obligations under the Customer Identification Program (CIP) rule or procedures for establishing a mobile phone account with a mobile network operator (MNO).

2.The evidence has an issuance process that results in the delivery of the evidence to the person to whom it relates, such as delivery to a postal address, issuance in person, or through a protected remote provisioning process.

3.The evidence contains the name of the claimed identity.

4.The evidence contains at least one reference number, a facial image or other biometric characteristic, or sufficient attributes to uniquely identify the person to whom it relates.

5.The evidence contains physical (e.g., security printing, optically variable features, holograms) or digital (e.g., digitally signed assertions, addressable SIM or ESIM) security features that make it difficult to reproduce.

6.Core attributes on the evidence can be validated against information held by an authoritative or credible source, as described in Sec. 2.4.2.4.

7.The evidence can be validated through an approved method, as provided in Sec. 2.4.2.2.

8.The evidence can support the identity verification process, as described in Sec. 2.5.1.

1.There is a reasonable expectation that the issuing source of the evidence confirmed the claimed identity by following written procedures (e.g., identity proofing at IAL2 or above) designed to provide assurance that the claimed identity is associated with the subject. Additionally, these procedures are subject to recurring oversight by regulatory or publicly accountable institutions, such as states, the Federal Government, and some regulated industries.

2.The evidence has an issuance process that results in the delivery of the evidence to the person to whom it relates, such as delivery to a postal address, issuance in person, or through a protected remote provisioning process.

3.The evidence contains the name of the claimed identity.

4.The evidence contains a reference number or other attributes that uniquely identify the person to whom it relates.

5.The evidence contains a facial image or other biometric characteristic of the person to whom it relates.

6.The evidence contains physical (e.g., security printing, optically variable features, holograms) or digital security (e.g., digitally signed assertions, addressable SIM or ESIM) features that make it difficult to reproduce.

7.Core attributes on the evidence can be validated against information held by authoritative or credible sources, as described in Sec. 2.4.2.4.

8.The evidence can be validated through an approved method, as provided in Sec. 2.4.2.2.

9.The evidence can support the identity verification process, as described in Sec. 2.5.1.

1.The issuing source of the evidence confirmed the claimed identity by following written procedures (e.g., identity proofing at IAL2 or above) designed to enable it to have high confidence that the claimed identity is associated with the subject. Additionally, these procedures are subject to recurring oversight by regulatory or publicly accountable institutions, such as states, the Federal Government, and some regulated industries.

2.The identity evidence contains attributes and data objects that are cryptographically protected and can be validated using approved cryptography through verification of a digital signature applied by the issuing source.

3.The issuing source had the subject participate in an attended enrollment and identity proofing process that confirmed their physical existence.

4.The evidence has an issuance process that results in the delivery of the evidence to the person to whom it relates, such as delivery to a postal address, issuance in person, or through a protected remote provisioning process.

5.The evidence contains the name of the claimed identity.

6.The evidence contains at least one reference number that uniquely identifies the person to whom it relates.

7.The evidence contains a facial image or other biometric characteristic of the person to whom it relates.

8.The evidence contains physical (e.g., security printing, optically variable features, holograms) or digital security (e.g., digitally signed assertions, addressable SIM or ESIM) features that make it difficult to reproduce.

9.The evidence can be validated through an approved method, as provided in Sec. 2.4.2.2.

10.The evidence can support the identity verification process, as described in Sec. 2.5.1.

•The evidence is in the correct format and includes complete information for the identity evidence type

•The evidence does not show signs of being counterfeit or tampered with

•The evidence contains physical or digital security features

•The core attributes and data fields necessary to determine authenticity on the evidence are accurate

•Visual and tactile inspection by trained personnel for on-site identity proofing

•Visual inspection by trained personnel for remote identity proofing

•Automated document validation processes using appropriate technologies

•Cryptographic verification of the source and integrity of digital evidence or attribute data objects

•Confirmation code verification: The individual is able to demonstrate control of a piece of identity evidence through the return of a confirmation code, consistent with the requirements specified in Sec. 3.8.

•Authentication and federation protocols: The individual is able to demonstrate control of a digital account (e.g., online bank account) or signed digital assertion through the use of authentication or federation protocols. This can be done in person, through presentation of the credential to a device or reader, or during a remote identity proofing session.

•Transaction verification: An individual is able to demonstrate control of a piece of evidence by returning a value based on a microtransaction made between the CSP and the issuing source of the evidence (e.g., a micro-deposit to verify ownership of a financial account).

•Visual facial image comparison — on-site attended: The proofing agent and applicant interact directly during the identity proofing process. The proofing agent performs a visual comparison of the facial image presented on identity evidence to the face of the applicant engaged in the identity proofing event.

•Visual facial image comparison — remote attended or remote unattended: The proofing agent performs a visual comparison of the facial image presented on identity evidence or stored by the issuing source to the facial image of the applicant engaged in the identity proofing event. The proofing agent may interact directly with the applicant during some or all of the identity proofing process or may conduct the comparison at a later time using a captured video or photograph and the uploaded copy of the evidence.

•Automated biometric comparison: Automated biometric comparison (e.g., facial recognition or other fully automated algorithm-driven biometric comparison) can be performed for onsite or remote identity proofing events. The facial image or other biometric characteristic (e.g., fingerprints, palm prints, iris and retina patterns, voiceprints, vein patterns) on the identity evidence or stored in authoritative records is compared to the equivalent biometric sample collected from the applicant during the identity proofing event.

1.A complete service description, including the particular steps that the CSP follows to identity-proof applicants at each offered assurance level

2.The CSP’s policy for providing notice to applicants about the types of identity proofing processes available, the evidence and attribute collection requirements for the IALs offered by the CSP, the purpose for collecting personal information (see Sec. 3.3.2), and the purposes for collecting, using, and retaining biometrics (see Sec. 3.1.11)

3.The CSP’s policy for ensuring that the identity proofing process concludes in a timely manner once the applicant has met all of the requirements

4.The types of evidence that the CSP accepts and the justification for how the evidence fulfills the strength requirements of the level at which it will be accepted by the CSP

5.The CSP’s policy and process for validating and verifying identity evidence, including training and qualification requirements for personnel who serve in identity proofing roles, as provided in Sec. 2.1.2

6.The specific technologies that the CSP employs for evidence validation and verification

7.The CSP’s policy and processes for supporting applicants who lack sufficient identity evidence for the required IAL (Sec. 3.15) and for addressing identity proofing exceptions and errors

8.The attributes that the CSP considers to be core attributes (Sec. 2.2) and the authoritative and credible sources it uses for validating those attributes (Sec. 2.4.2.4)

9.The CSP’s policy for managing and communicating service changes to RPs, such as changes in data sources, integrated vendors, or biometric algorithms

10.The CSP’s approach to fraud management (see Sec. 3.2), including its policy and process for identifying and remediating suspected or confirmed fraudulent accounts and communicating such information to RPs and affected individuals

11.The CSP’s policy for any conditions that would require reverification of the user (e.g., account recovery, account abandonment, regulatory “recertification” requirements)

12.The CSP’s policy for conducting privacy risk assessments, including the timing of its periodic reviews and specific conditions that will trigger an updated privacy risk assessment (see Sec. 3.3.1)

13.The CSP’s policy for assessing customer experience, including the testing methods employed, timing of its periodic reviews, and any specific conditions that will trigger an out-of-cycle review (see Sec. 3.4)

14.The CSP’s policy for the retention, protection, and deletion of all personal, sensitive, and biometric data, including the treatment of all such data if the CSP ceases operation or merges or transfers operations to another CSP

15.The CSP’s policy for reporting and updating performance metrics, as described in Sec. 3.5.2 of SP 800-63

16.The CSP’s policy for accessing or removing a subscriber’s account in the event of their death or incapacitation (see Sec. 5)

1.CSPs SHALL establish and maintain a fraud management program that provides fraud identification, detection, investigation, reporting, and resolution capabilities. The specific capabilities and details of this program SHALL be documented within their CSP practice statement.

2.CSPs SHALL conduct a privacy risk assessment of all fraud checks and fraud mitigation technologies prior to implementation.

3.The CSP SHALL establish a self-reporting mechanism and investigation capability for subjects who believe they have been the victim of fraud or an attempt to compromise their involvement in the identity proofing processes.

4.CSPs SHALL analyze all remote proofing communication channels to look for high-risk indicators (e.g., blocklisted proxies and IP addresses).

5.The CSP SHALL take measures to prevent unsuccessful applicants from inferring the accuracy of any self-asserted information with that confirmed by authoritative or credible sources.¹

6.CSPs SHALL monitor the performance of their fraud checks and fraud mitigation technologies to ensure continued effectiveness in mitigating fraud risks.

7.CSPs SHALL establish a technical or process-based mechanism to communicate suspected and confirmed fraudulent events to RPs.

8.CSPs SHALL implement a death records check for all identity proofing processes by confirming with a credible, authoritative, or issuing source that the applicant is not deceased. Such checks can aid in preventing synthetic identity fraud, the use of stolen identity information, and exploitation by a close associate or relative.

9.CSPs SHOULD implement the following fraud checks for their identity proofing processes based on their available identity proofing types, selected technologies, evidence, and user base:

•SIM swap detection: Confirm that the phone number used in the identity proofing process has not been recently ported to a new user or device. Such checks can provide an indication that a phone or device was compromised by a targeted attack.

•Device or account tenure check: Evaluate the length of time a phone service subscription or other account (e.g., email account) has existed without substantial modifications or changes. Such checks can provide additional confidence in the reliability of a device or piece of evidence used in the identity proofing process.

•Mailing address check: Determine whether the mailing address is a known virtual Post Office (PO) Box or has other high-risk characteristics.

•Device fingerprinting: Incorporate device fingerprinting checks to protect against scaled and automated attacks and enrollment duplication. Device fingerprinting is the process of collecting and analyzing the hardware and software characteristics of a device in order to create a unique identifier (i.e., fingerprint) for the device.

•Transaction analytics: Evaluate anticipated transaction characteristics (e.g., IP addresses, geolocations, transaction velocities) to identify anomalous behaviors or activities that can indicate a higher risk or a potentially fraudulent event. Fraud velocity checks monitor the frequency and pattern of transactions over a specific period of time to identify unusual activity associated with transaction data. Such checks can protect against scaled and automated attacks, as well as indicate whether specific attack patterns are being executed on identity systems.

•Fraud indicator check: Evaluate records (e.g., reported, confirmed, or historical fraud events) to determine whether there is an elevated risk related to a specific applicant, applicant’s data, or device. Such checks can indicate identity theft or compromise. Where such information is collected, aggregated, or exchanged across commercial platforms and made available for use by RPs and other CSPs, users SHALL be made aware of any privacy implications based on a privacy risk assessment. This also applies to all websites that report user activity to federal RPs.

10.CSPs SHOULD periodically employ independent testing (e.g., red teaming exercises) to validate the effectiveness of their fraud mitigation measures.

11.CSPs SHOULD consider the recency of fraud-related data when factoring such data into fraud prevention capabilities and decisions.

12.For attended proofing processes, CSPs SHALL train proofing agents to detect indicators of fraud and SHALL provide proofing agents and trusted referees with tools to flag suspected fraudulent events for further treatment and investigation.

13.Collusion is possible whenever CSP representatives are directly involved in proofing processes or decisions. CSPs SHALL implement insider threat controls to detect and prevent collusion involving CSP representatives that are directly involved with or can intervene in proofing processes or decisions.

14.CSPs SHOULD communicate fraud events in real time to RPs through methods such as shared signaling, as described in Sec. 4.8 of [SP800-63C].

15.CSPs MAY employ KBV as part of its fraud management program.

16.CSPs MAY implement fraud mitigation measures as compensating controls. When this is done, these SHALL be documented as deviations from the normative guidance of these guidelines and SHALL be conveyed to all RPs through a Digital Identity Acceptance Statement (DIAS) prior to integration. See Sec. 3.4.4 of [SP800-63] for more information about the DIAS.

1.RPs SHALL establish a point of contact with whom CSPs can interact and communicate fraud data.

2.RPs SHALL conduct a privacy risk assessment (see Sec. 3.3.1) of any CSP fraud checks and mitigation technologies to identify potential privacy risks or unintended harms. Federal agency RPs SHALL implement this consistent with the requirements contained in Sec. 3.7.

3.RPs SHOULD include any requirements for fraud checks and fraud mitigation technologies in trust agreements with their CSPs.

4.RPs SHALL conduct periodic reviews of their CSP’s fraud management program, fraud checks, and fraud technologies to adjust thresholds, review investigations into fraud events, and evaluate the effectiveness and efficacy of fraud controls.

5.RPs SHALL review all fraud mitigation measures that have been deployed as compensating or supplemental controls by CSPs to align with their internal risk tolerance and acceptance. The RP SHALL record the CSP’s compensating controls in their own DIAS prior to integration.

6.Pursuant to applicable laws and regulations, RPs SHOULD establish a mechanism to communicate the outcomes of fraud reports and investigations, including both positive and negative results, to CSPs and other partners in order to allow them to improve their own fraud identification, mitigation, and reporting capabilities.

7.RPs SHOULD establish a fraud management program for digital identity management consistent with their mission, regulatory environment, systems, applications, data, and resources.

8.Informed by risks identified in a privacy risk assessment, the RP MAY also request additional attributes beyond what a CSP provides as its core attributes to combat fraud or to support other business processes.

1.CSPs SHALL establish and document actions and practices related to each of their fraud checks and provide these actions and practices to RPs.

2.CSPs SHALL establish procedures for redress to allow applicants to resolve issues associated with fraud checks and mitigation technologies. See Sec. 3.6 of [SP800-63] for more information about redress.

3.The CSP SHOULD offer trusted referee services to applicants who fail fraud checks in unattended remote processes. If trusted referees are offered to applicants who fail fraud checks in unattended remote processes, the trusted referees SHALL be provided with a summary of the results of the fraud failures to inform their risk-based decision-making processes.

1.The CSP SHALL conduct and document a privacy risk assessment for the processes used for identity proofing and enrollment.² At a minimum, the privacy risk assessment SHALL assess the risks associated with:

1.Processing personal information for the purposes of identity proofing, enrollment, or fraud management, including identity attributes, biometrics, images, video, scans, or copies of identity evidence

2.Additional steps that the CSP takes to verify the identity of an applicant beyond the mandatory requirements specified herein

3.Processing of personal information for purposes outside of the scope of identity proofing and enrollment, except to comply with law or legal processes

4.The retention schedule for identity records and personal information

5.Processing non-personal information that could be used to identify a person when aggregated or processed by an algorithm (e.g., AI or ML tools)

6.Personal information that is processed by a third-party service on behalf of the CSP

2.Based on the results of its privacy risk assessment, the CSP SHALL document the measures it takes to maintain the disassociability, predictability, manageability, confidentiality, integrity, and availability of any personal information it collects or processes.³ In determining such measures, the CSP SHOULD apply relevant guidance and standards, such as the NIST Privacy Framework [NIST-Privacy] and NIST SP 800-53 [SP800-53].

3.The CSP SHALL reassess privacy risks and update its privacy risk assessment any time it makes changes to its identity service that affect the processing of personal information.

4.The CSP SHALL review its privacy risk assessment periodically, as documented in its practice statement, to ensure that it accurately reflects the current risks associated with the collection and processing of personal information.

5.The CSP SHALL make a summary of its privacy risk assessment available to any RPs that use its services. The summary SHALL be in sufficient detail to enable such RPs to make reasonable determinations about privacy risks associated with the CSPs services and to complete their own privacy risk assessments.

6.The CSP SHALL perform a privacy risk assessment for the processing of any personal information maintained in subscriber accounts (see Sec. 5).

1.The processing of personal information SHALL be limited to the minimum necessary to validate the existence of the claimed identity, associate the claimed identity with the applicant, mitigate fraud, and provide RPs with attributes that they may use to make authorization decisions.

2.The CSP SHALL provide privacy training to all personnel and any third-party service providers who have access to sensitive information associated with the CSP’s identity service.

3.The CSP MAY collect a Social Security number (SSN) as an attribute when necessary for identity resolution. Knowledge of an SSN is not sufficient to act as evidence of identity, nor is it considered an acceptable method of verifying possession of the Social Security card when used as evidence. If the SSN is collected on behalf of a federal, state, or local government agency, the CSP SHALL provide notice to the applicant for the collection in accordance with applicable laws.

4.At the time of collection, the CSP SHALL provide explicit notice to the applicant regarding the purpose for collecting any attributes and personal information. Such a notice SHALL include whether the personal information and attributes are voluntary or mandatory to complete the identity proofing process, the specific attributes and other sensitive data that the CSP intends to store in the applicant’s subsequent subscriber account, the consequences of not providing the attributes, and the details of any records retention requirement if one is in place, including an applicant’s right to request data deletion or engage in other forms of redress.

5.CSPs SHOULD implement techniques that protect an applicant’s privacy based on the privacy considerations in Sec. 7.

1.The CSP SHALL assess the elements of its identity proofing processes to identify processes or technologies that can result in customer experience challenges, particularly if those challenges prevent the CSP from consistently delivering identity proofing services to all users served by an RP.

2.CSPs SHALL provide RPs with a summary of their customer experience assessments that includes information about common challenges or issues faced by users.

3.Based on the results of its assessment, the CSP SHALL document any measures it takes to mitigate the possible access challenges.

4.The CSP SHALL reassess the customer experience risks periodically and any time the CSP makes changes to its identity service that affect the processes or technologies that impact customer experience.

5.The CSP SHALL NOT make applicant participation in these risk assessments mandatory.

1.Each online transaction within the identity proofing process, including transactions that involve third parties, SHALL occur over an authenticated protected channel.

2.The CSP SHALL implement automated attack protections for the identity proofing process, such as bot detection, mitigation, and management solutions; behavioral analytics⁴; web application firewall settings; and network traffic analysis.

3.All personal information that is collected as part of the identity proofing process SHALL be protected to maintain the confidentiality and integrity of the information, including the encryption of data at rest and the exchange of information using authenticated protected channels.

4.The CSP SHALL assess the information security and privacy risks associated with operating its identity service, according to the NIST Risk Management Framework [NIST-RMF] or equivalent risk management guidelines. At a minimum, the CSP SHALL apply appropriate controls consistent with the NIST SP 800-53 [SP800-53] moderate baseline, regardless of IAL.

5.The CSP SHALL assess risks associated with its use of third-party services and apply appropriate controls, as provided in the [SP800-161] Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.

1.The CSP SHALL provide mechanisms for the redress of applicant complaints and problems that arise from the identity proofing process, including proofing failures, delays, difficulties, and the recovery of a compromised subscriber account (e.g., as a result of a scam or fraud).

2.These redress mechanisms SHALL be easy for applicants to find and use.

3.The CSP SHALL assess the mechanisms for their efficacy in achieving a resolution of complaints or problems.

1.The agency SHALL consult with their Senior Agency Official for Privacy (SAOP) to determine whether the collection of personal information, including biometrics, to conduct identity proofing triggers Privacy Act requirements.

2.The agency SHALL consult with their SAOP to determine whether the collection of personal information, including biometrics, to conduct identity proofing triggers E-Government Act of 2002 [E-Gov] requirements.

3.The agency SHALL publish a System of Records Notice (SORN) to cover such collections, as applicable.⁵

4.The agency SHALL publish a Privacy Impact Assessment (PIA) to cover such collections, as applicable.

5.The agency SHOULD consult with public affairs and communications professionals within their organization to determine whether a communications or public awareness strategy should be developed to accompany the implementation of any new process or update to an existing process, including requirements associated with identity proofing. Such strategies should consider the use of materials that describe how to use the technology associated with the service, a Frequently Asked Questions (FAQs) page, prerequisites to participate in the identity proofing process (e.g., required evidence), or media (e.g., webinars, live or pre-recorded information sessions) to support adoption of the identity service and provide applicants with a mechanism to communicate questions, issues, and feedback.

6.If the agency uses a third-party CSP, the agency SHALL conduct its own PIA and use the CSP’s privacy risk assessment as input.

•21 days when sent to a validated postal address within the contiguous United States

•30 days when sent to a validated postal address outside of the contiguous United States

•10 minutes when sent to a validated telephone number (SMS or voice)

•24 hours when sent to a validated email address

1.Continuation codes SHOULD be delivered in-session but MAY be delivered out-of-band to a physical mailing address, phone number, or email address.

2.Continuation codes SHALL include at least 64 bits from an approved random bit generator (see Sec. 3.2.12 of [SP800-63B]).

3.The continuation code MAY be presented as numeric or printable ASCII representation for manual entry or as a machine-readable optical label (e.g., QR code).

4.The verification of continuation codes SHALL be subject to throttling requirements, as provided in Sec. 3.2.2 of [SP800-63B].

5.Continuation codes SHALL be stored in hashed form using a Federal Information Processing Standards (FIPS)-approved or NIST-recommended one-way function.

6.Upon its use, the CSP SHALL invalidate the continuation code.

1.SHALL be sent to a validated postal address or phone number at all IALs or MAY be sent to a validated email address at IAL1

2.SHALL include details about the identity proofing event, including the name of the identity service and the date on which the identity proofing was completed

3.SHALL provide clear instructions, including contact information, on actions for the recipient to take if they repudiate their participation in the identity proofing event

4.SHALL provide information about how the organization or CSP protects the security and confidentiality of the information it collects

5.SHALL provide information about any responsibilities that the recipient has as a subscriber of the identity service

6.SHOULD provide instructions on how to access their subscriber account or information about how the subscriber can update the information contained in that account

1.CSPs SHALL provide clear, publicly available information about all uses of biometrics, including what biometric data is collected, how it is stored and protected, and how to remove biometric data consistent with applicable laws and regulations.

2.CSPs SHALL obtain explicit informed consent to collect and use biometrics from all applicants.

3.CSPs SHALL store a record of the subscriber’s consent for biometric use and associate it with the subscriber’s account.

4.CSPs SHALL have a documented and publicly available deletion process and default retention period for all biometric information. Retention periods SHALL be consistent with applicable regulations, policies, and statutes for the regions and sectors that the CSP serves.

5.CSPs SHOULD support the deletion of all of a subscriber’s biometric information upon the subscriber’s request, except where otherwise restricted by regulation, law, or policy. CSPs that do not support biometric deletion requests SHALL publicly document the regulatory, statutory, or risk-based justification for their policy.

6.CSPs SHALL have their biometric recognition and attack detection algorithms periodically tested by independent entities (e.g., accredited laboratories or research institutions) for their performance characteristics, including performance across demographic groups. In addition, the CSP SHOULD conduct internal testing on biometric algorithms based on the update schedule of the provider.

7.CSPs SHALL assess the performance and demographic impacts of employed biometric technologies in conditions that are substantially similar to the operational environment and user base of the system. The user base is defined by both the expected users and the devices they are expected to use. When such assessments include real-world users, participation by users SHALL be voluntary.

8.CSPs SHALL meet the following performance thresholds if one-to-one (1:1) comparison algorithms are used for verification against a claimed identity:

•False match rate: 1:10,000 or better

•False non-match rate: 1:100 or better

9.CSPs MAY use one-to-many (1:N) identification in support of resolution or deduplication, pursuant to a privacy risk assessment. In 1:N scenarios, CSPs SHALL meet a minimum performance threshold for false positive identification of 1:1,000 or better.

10.A 1:N search of an applicant’s collected biometric characteristics against a database is done to determine whether the applicant is already present in the database, possibly under a different name. The false positive identification rate (FPIR) refers to the proportion of 1:N searches in which a biometric system incorrectly identifies another person as a match, which is a false positive result. The performance metric of 1:1,000 means that a false positive outcome occurs for no more than 1 in every 1,000 searches. Tests that demonstrate this requirement SHALL employ a gallery no smaller than 90 % of the current or intended operational size (N).

11.CSPs that make use of 1:N biometric identification for resolution, deduplication, or fraud detection purposes SHALL NOT decline a user’s enrollment without a manual review to confirm the automated search results and confirm that the results are not a false positive identification (e.g., twins submitting face photographs for different accounts with the same CSP).

12.Biometric verification technologies SHALL provide performance for applicants of different demographic types that is no more than 25 % worse than the performance for the overall population. For example, if the measured false non-match rate (FNMR) for the overall population is 0.006, the FNMR for a specific demographic group cannot exceed 0.0075. Similarly, if the false match rate (FMR) for the overall population is 0.0001, the FMR for each demographic group cannot exceed 0.000125. The biometric system SHALL be configured with a fixed threshold; it is not feasible to change the threshold for each demographic group. Demographic categories to be considered SHALL include sex, age, and skin tone when these factors affect biometric performance.

13.All biometric performance tests SHALL be conformant to ISO/IEC 19795-1:2021 and ISO/IEC 19795-10:2024, including demographics testing.

14.CSPs SHALL make the results of their biometric algorithm performance and biometric system operational test results publicly available. The CSP MAY provide these test results in summary form if the results indicate performance against the defined metrics in these guidelines and across the tested demographic groups.

1.CSP SHALL collect biometric characteristics in a way that provides reasonable assurance that the biometric characteristic is collected from the applicant and not another subject.

2.When collecting and comparing biometric characteristics remotely, the CSP SHALL implement presentation attack detection (PAD) capabilities that meet the impostor attack presentation accept rate (IAPAR) performance metric of <0.07 to confirm the genuine presence of a live human being and to mitigate spoofing and impersonation attempts. All biometric presentation attack detection tests SHALL be conformant to ISO/IEC 30107-3:2023.

3.When collecting biometric characteristics on-site, the CSP SHALL have the operator view the biometric source (e.g., fingers, face) for the presence of unexpected non-natural materials and perform such inspections as part of the proofing process.

1.Proofing agents and trusted referees SHALL be trained to conduct visual facial image comparison. This training SHALL include techniques and methods for identifying facial characteristics, unique traits, and other indicators of matches or non-matches between an applicant and their presented evidence.

2.Proofing agents and trusted referees SHALL be assessed on their ability to conduct visual facial image comparisons. Additionally, proofing agents and trusted referees SHALL be reassessed on an annual basis and remedially trained, if needed. Training SHALL be designed to reflect potential real-world attack scenarios, such as comparing applicants to images of relatives, twins, and individuals with a similar appearance.

3.CSPs SHALL provide proofing agents and trusted referees that conduct visual facial comparisons during remote attended transactions with resources that support accurate comparisons, such as high-quality image feeds, high-definition monitors, and image analysis software.

4.CSPs SHALL document their training and assessment procedures for visual image comparisons and make them available to RPs upon request.

5.These requirements SHALL apply for visual facial image comparisons done as manual reviews for failures of automated biometric comparisons (e.g., failure of 1:N checks conducted for resolution or deduplication).

1.Automated evidence validation technology SHALL meet the following performance measures:

•Document false acceptance rate (DFAR) of 0.1 or less⁶

•Document false rejection rate (DFRR) of 0.1 or less⁷

2.If a Machine Readable Zone (MRZ) or barcode is present on the evidence, the optical capture and inspection SHALL compare the MRZ data to the printed data on the evidence for consistency.

3.CSPs SHALL implement live capture of documents during the validation process and SHALL implement passive or active document presence checks (also called document liveness). Live capture techniques confirm that the document is physically present and that the image captured during the identity proofing session is not a manipulated digital copy. For additional requirements to prevent the injection of modified media (i.e., digitally generated video or images of evidence), see Sec. 3.14.

4.CSPs SHALL assess the performance of employed optical capture and inspection technologies in conditions that are substantially similar to the operational environment and the types of evidence presented by the user base of the system. These tests SHALL account for all available identity evidence types that the CSPs allow to be validated using optical capture and inspection technology. If subscribers’ documents, personal information, or images are used as part of the testing, it SHALL be on a voluntary basis and with subscriber notification and consent.

5.CSPs SHOULD have their evidence validation technology periodically tested by independent entities (e.g., accredited laboratories or research institutions) for their performance characteristics.

6.CSPs SHALL make the results of their testing publicly available.

1.Proofing agents and trusted referees SHALL be trained and provided with the resources to visually inspect all forms of evidence supported by the CSP. This training SHALL include:

•Authentic layouts and topography of evidence types

•Physical security features (e.g., raised letters, holographic features, microprinting)

•Techniques for assessing features (e.g., tools to be used, where tactile inspection is needed, manipulation required to view specific features)

•Common indications of tampering (e.g., damage to the lamination, image modification)

2.Proofing agents and trusted referees SHALL be assessed regarding their ability to visually inspect evidence based on their training. Additionally, proofing agents and trusted referees SHALL be reassessed on an annual basis or whenever significant new threats to the evidence validation process are identified and remedially trained as needed.

3.Proofing agents and trusted referees SHALL be provided with specialized tools and equipment to support the visual inspection of evidence (e.g., magnifiers, ultraviolet lights, barcode readers) as appropriate for the identity evidence type.

4.Proofing agents and trusted referees who conduct visual inspections via remote means SHALL be provided with devices and internet connections that support sufficiently high-quality imagery to be able to effectively inspect presented evidence. In these instances, the visual validation SHOULD be supported by automated document validation technologies that provide additional confidence in the authenticity of the evidence (e.g., submitting and validating evidence in advance of an attended remote session).

5.CSPs SHALL document their training and assessment procedures for visual inspections of evidence and make them available to RPs upon request.

1.CSPs SHALL implement technical controls to increase confidence that digital media is being produced by a genuine sensor during the proofing process (e.g., detect the presence of a virtual camera, device emulator, or a jailbroken device).

2.CSPs SHALL analyze all digital media submitted during the identity proofing process for artifacts and indicators of potential modification, manipulation, tampering, or forgery. Automated image analysis algorithms SHALL be tested against available attack artifacts (i.e., forged and manipulated images and videos) and genuine media to provide a baseline of performance and to determine the expected rate of false positives and false negatives generated by the system. The kinds of available attack artifacts that were tested and the corresponding false negative rates SHALL be documented and made available to RPs upon request. Algorithmic analysis of media and automated decisioning SHOULD be augmented by manual reviews to address detection errors.

3.CSPs SHALL only use authenticated protected channels for the exchange of data during remote identity proofing processes.

4.CSPs SHOULD introduce a passive means of detecting forged or manipulated media for all capture scenarios.

5.CSPs SHOULD authenticate capture sensors or implement device attestation to increase the confidence in a device being used to transmit digital media as part of a remote identity proofing process.

6.CSPs SHOULD analyze digital media for signatures of generative AI algorithms and deepfake tools that are known to be used to create forged digital media.

1.CSPs SHALL train proofing agents and trusted referees to look for indications of manipulated media (e.g., high latency, synchronization issues, inconsistent skin tone and resolution).

2.CSPs SHALL introduce random “human-in-the-loop” cues into their capture processes to increase the possibility of forged or manipulated media being detected (e.g., by requesting user movements or requesting that the user move objects between the capture sensor and their face).

1.The CSP SHALL notify the public of the availability of trusted referee services and how such services are obtained.

2.The CSP SHALL establish written policies and procedures for the use of trusted referees as part of its practice statement, as specified in Sec. 3.1.

3.The CSP SHALL train and certify its trusted referees to make risk-based decisions that allow applicants to be successfully identity-proofed based on their unique circumstances. At a minimum, such training SHALL include:

1.Document identification and validation, such as common templates, security features, layouts, and topography (see Sec. 3.13)

2.Indicators of fraudulent documents, such as damage, tampering, modification, fabrication, or forgery (see Sec. 3.13)

3.Facial image comparisons to verify applicants against presented documents (see Sec. 3.12)

4.Indicators of social engineering exhibited by an applicant, such as distress, confusion, or coercion

5.An annual review of the trusted referee’s abilities to visually inspect evidence and make visual facial image comparisons (see Sec. 3.12)

4.The CSP SHALL establish a record of any identity proofing session that involves a trusted referee, including the reasons why a trusted referee was used (e.g., automated process failure, applicant request, established exception policy), the identity of the trusted referee, what evidence was presented, which processes were completed (e.g., validation or verification), and the trusted referee’s decision and, if negative, their rationale.

5.The CSP MAY offer trusted referee services for either on-site attended or remote attended sessions. These sessions SHALL be consistent with the requirements of these proofing types based on the IAL of the proofing event.

1.CSPs SHALL document which types of exceptions and failures are eligible for the use of a trusted referee.

2.CSPs SHOULD offer trusted referee services for failures of automated verification processes (e.g., biometric comparisons).

3.CSPs SHOULD offer trusted referee services for failures in completing automated validation processes, such as mismatched core attributes or the absence of the applicant in a record source. If a CSP offers trusted referees for this purpose, the following requirements apply:

1.CSPs SHALL provide a policy for additional evidence types that may be used to corroborate core attributes or changes in core attributes.

2.Trusted referees SHALL review additional evidence types for authenticity to the greatest degree allowed by the evidence.

3.If no authoritative or credible records are available to support validation, the trusted referee MAY compare the attributes on additional pieces of evidence with the strongest piece of evidence available to corroborate the consistency of core attributes.

4.If there is a partial mismatch of core attributes to authoritative records, the trusted referee SHALL review evidence that supports the legitimacy of the asserted attribute value (e.g., recent move or change of name).

1.The CSP SHALL notify the public of the allowability of applicant references and any requirements for the relationship between the reference and an applicant.

2.The CSP SHALL establish written policies and procedures for the use of applicant references as part of its practice statement, as specified in Sec. 3.1.

3.The CSP SHALL identity-proof an applicant reference to the same or higher IAL intended for the applicant. The CSP SHALL include the information collected, recorded, and retained for identity proofing the applicant references in its privacy risk assessment, as required in section Sec. 3.3.1.

4.The CSP SHALL record the use of an applicant reference in the subscriber account and maintain a record of the applicant reference and their relationship to the applicant.

5.The RP SHALL conduct a risk assessment to determine the applicability, business requirements, and potential risks associated with excluding or including applicant references for proofing events.

1.The applicant reference MAY vouch for one or more claimed core attributes relative to the applicant as part of the evidence and attribute validation process.

2.The applicant reference MAY vouch for the identity of the applicant in the absence of sufficient identity evidence.

3.The applicant reference MAY vouch for a specific condition or status of an applicant relative to the identity proofing process (e.g., homelessness, disaster scenarios).

1.Capturing and recording the statements and assertions made by the applicant reference

2.Capturing a digital signature or physical signature of the applicant reference

3.Capturing consent and acknowledgement relative to the legal and liability impacts of the applicant reference’s statements

1.The CSP and RP SHALL establish requirements for applicant reference relationship confirmation processes and document them in any contracts or trust agreements.

2.The CSP SHALL make a list of acceptable evidence of relationship available to the applicant reference prior to initiating the relationship confirmation process.

3.The CSP SHALL request evidence of the applicant’s relationship (e.g., notarized power of attorney, a professional certification).

4.Upon successfully identity proofing an applicant, the CSP SHALL record the evidence used to confirm the applicant reference’s relationship to the applicant in the subscriber account.

1.The CSP SHALL establish a written policy and procedures as part of its practice statement for identity proofing minors who may not be able to meet the evidence requirements for a given IAL.

2.When interacting with persons under the age of 13, the CSP SHALL ensure compliance with the Children’s Online Privacy Protection Act of 1998 [COPPA] or other laws and regulations that deal with the protection of minors, as applicable.

3.CSPs SHALL support the use of applicant references when interacting with individuals under the age of 18.

1.CSPs SHALL document their approved approaches for elevating assurance levels in their practice statements.

2.CSPs SHALL require subscribers to authenticate at the highest authentication assurance level (AAL) available on their account prior to initiating the upgrade process.

3.CSPs SHALL collect, validate, and verify additional evidence, as mandated to achieve the higher IAL.

4.CSPs SHOULD avoid collecting, validating, and verifying previously processed evidence, though they MAY do so based on an extended period of account inactivity, indicators of fraud, or if evidence has become invalidated since the original proofing event.

1.IAL1 identity proofing MAY be delivered through any proofing type, as described in Sec. 2.1.3.

2.CSPs MAY combine proofing types and their stated requirements to create hybrid processes. For example, a CSP might leverage remote unattended identity proofing validation processes in advance of a remote attended session where the verification will take place. If such steps are combined, CSPs SHALL document their hybrid process and state how the applicable requirements for each of the employed proofing types are met.

1.One piece of:

•FAIR evidence that can be digitally validated or that includes a facial portrait or other biometric or

•STRONG evidence or

•SUPERIOR evidence.

•Confirming the authenticity of digital evidence by interrogating the digital security features (e.g., signatures on assertions or data)

•Confirming the authenticity of physical evidence using automated scanning technology that can detect physical security features, as described in Sec. 3.14

•Confirming the integrity of physical security features on presented evidence through visual inspection by a proofing agent using real-time or asynchronous processes (e.g., offline manual review)

•Confirming the integrity of physical security features through physical and tactile inspection by a proofing agent at an on-site location

1.The CSP SHALL validate all core attributes and the government identifier against an authoritative or credible source to determine accuracy.

2.CSPs SHOULD evaluate attributes obtained from different sources (e.g., presented evidence, self-asserted, authoritative or credible sources) for consistency.

3.CSPs SHOULD validate any reference numbers on the presented identity evidence, if available.

•Confirming the applicant’s ability to return a confirmation code delivered to a validated address associated with the evidence

•Confirming the applicant’s ability to return a microtransaction value delivered to a validated financial or similar account

•Confirming the applicant’s ability to successfully complete an authentication and federation protocol equivalent to AAL2/FAL2 or higher to access an account related to the identity evidence

•Comparing the applicant’s facial image to a facial portrait on evidence via an automated comparison

•Visually comparing the applicant’s facial image to a facial portrait on evidence or in records associated with the evidence during an on-site attended session (i.e., in-person with a proofing agent), a remote attended session (i.e., live video with a proofing agent), or an asynchronous process (i.e., visual comparison made by a proofing agent at a different time). If the comparison is performed asynchronously at a later time, the CSP SHALL implement PAD and passive or active document presence checks to increase confidence that both the live applicant and physical documents are present during the submission or capture event.

•Using automated means to compare a facial image represented on or stored in the identity evidence or in records associated with the evidence to a live sample provided by the applicant

1.During the video session, the applicant SHALL remain in view of the proofing agent during each step of the proofing process.

2.The video quality SHALL be sufficient to support the necessary steps in the validation and verification processes, such as inspecting evidence and comparing the applicant to the evidence.

3.The proofing agent SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the session.

4.CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following further requirements apply:

1.The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.

2.The CSP SHALL gain consent from the applicant prior to initiating a recorded session.

3.The CSP SHALL publish their retention schedule and deletion processes for all video records.

5.The CSP SHALL implement injection protection and modified media controls, as defined in Sec. 3.14.

6.The CSP SHALL provide proofing agents with a method or mechanism to flag events for potential fraud.

1.The CSP SHALL provide a physical setting in which on-site identity proofing sessions are conducted.

2.All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.

3.CSP proofing agents SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the on-site session.

4.CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:

1.The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.

2.The CSP SHALL gain consent from the applicant prior to initiating a recorded session.

3.The CSP SHALL publish their retention schedule and deletion processes for all video records.

5.The CSP SHALL provide proofing agents with a method or mechanism to covertly flag events for potential fraud.

1.All devices SHALL be safeguarded from tampering through observation by CSP representatives and/or physical and digital tamper prevention features.

2.All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.

3.All devices SHALL be inspected periodically by trained technicians to deter tampering, modification, or damage.

4.CSPs MAY record and maintain video recordings of on-site unattended identity proofing sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:

1.The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.

2.The CSP SHALL gain consent from the applicant prior to initiating a recorded session.

3.The CSP SHALL publish their retention schedule and deletion processes for all video records.

1.The CSP SHALL provide the ability for the applicant to bind an authenticator using one of the following methods:

1.Remote enrollment of a subscriber-provided authenticator consistent with the requirements for the authenticator type, as defined in Sec. 4.1.3 of [SP800-63B]

2.Distribution of a physical authenticator to a validated address

3.Distribution or on-site enrollment of an authenticator

2.If authenticators are bound outside of a single protected session with the user, the CSP SHALL confirm the presence of the intended subscriber through one of the following methods:

1.Return of a continuation code

2.Comparison against a biometric collected at the time of proofing

1.IAL2 identity proofing MAY be delivered through any identity proofing type, as described in Sec. 2.1.3.

2.CSPs MAY combine identity proofing types and their stated requirements to create hybrid processes. For example, a CSP might leverage remote unattended identity proofing validation processes in advance of a remote attended session where the verification will take place. If such steps are combined, CSPs SHALL document their hybrid process and state how the applicable requirements for each of the employed proofing types are met.

1.One piece of FAIR evidence and one piece of STRONG evidence or

2.Two pieces of STRONG evidence or

3.One piece of SUPERIOR evidence.

1.Each piece of FAIR or STRONG evidence that is presented SHALL be validated using one of the following techniques:

1.Confirming the authenticity of the digital evidence by interrogating the digital security features (e.g., signatures on assertions or data)

2.Confirming the authenticity of the physical evidence using automated scanning technology that can detect physical security features

3.Confirming the integrity of any physical security features through a visual inspection by a proofing agent using a real-time or asynchronous process (e.g., offline manual review)

4.Confirming the integrity of any physical security features through physical and tactile inspection by a proofing agent at an on-site location

2.Each piece of SUPERIOR evidence SHALL be validated through the cryptographic verification of the evidence contents and the issuing source, including digital signature verification and the validation of any trust chain back to a trust anchor. Any piece of SUPERIOR evidence that cannot be validated using this method MAY be considered STRONG evidence if it can be validated by using one of the techniques provided above.

1.The CSP SHALL validate all core attributes by either:

1.Comparing the government identifier and other core attributes against an authoritative or credible source to determine accuracy

2.Validating the accuracy of digitally signed attributes that are contained on SUPERIOR evidence through the public key of the issuing source

2.CSPs SHOULD evaluate attributes obtained from different sources (e.g., presented evidence, self-asserted, authoritative or credible sources) for consistency.

3.CSPs SHOULD validate any reference numbers on the presented identity evidence, if available.

1.For remote attended, remote unattended, and on-site unattended identity proofing, the CSP SHALL verify the applicant’s ownership of all pieces of presented identity evidence. For on-site attended identity proofing, the CSP SHALL verify the applicant’s ownership of the strongest piece of presented identity evidence.

2.Approved non-biometric methods for verifying FAIR evidence at IAL2 include:

1.Confirming the applicant’s ability to return a confirmation code delivered to a validated address associated with the evidence (e.g., postal address, phone number)

2.Visually comparing the applicant’s facial image to a facial portrait on the presented evidence (e.g., student or employee ID card) or in records associated with the evidence during an on-site attended session (i.e., in-person with a proofing agent), a remote attended session (i.e., live video with a proofing agent), or an asynchronous process (i.e., visual comparison made by a proofing agent at a different time)

3.Approved non-biometric methods for verifying STRONG and SUPERIOR evidence at IAL2 include:

1.Confirming the applicant’s ability to return a confirmation code delivered to a physical address (i.e., postal address) that was obtained from the evidence and validated with an authoritative source

2.Visually comparing the applicant’s facial image to a facial portrait on the presented evidence or in records associated with the evidence during an on-site attended session (i.e., in-person with a proofing agent), a remote attended session (i.e., live video with a proofing agent), or an asynchronous process (i.e., visual comparison made by a proofing agent at a different time). If the comparison is performed asynchronously at a later time, the CSP SHALL implement PAD and passive or active document presence checks to increase confidence that both the live applicant and physical documents are present during the captured identity proofing event.

1.For remote attended, remote unattended, and on-site unattended identity proofing, the CSP SHALL verify the applicant’s ownership of all pieces of presented identity evidence. For on-site attended identity proofing, the CSP SHALL verify the applicant’s ownership of the strongest piece of presented identity evidence.

2.Approved digital evidence verification methods for FAIR evidence at IAL2 include:

1.Confirming the applicant’s ability to return a microtransaction value delivered to a validated account (e.g., checking account owned by the applicant that has been validated by an authoritative or credible source)

2.Confirming the applicant’s ability to return a confirmation code delivered to a validated digital address associated with the digital evidence (e.g., MNO/phone account)

3.Confirming the applicant’s ability to successfully complete an authentication and federation protocol equivalent to AAL2/FAL2 to access an account related to the identity evidence

3.Approved digital evidence verification methods for STRONG evidence at IAL2 involve confirming the applicant’s ability to successfully complete an authentication and federation protocol equivalent to AAL2/FAL2 or higher to access an account related to the identity evidence.

4.Approved digital evidence verification methods for SUPERIOR evidence at IAL2 include confirming the applicant’s possession of the evidence through the use of a local activation factor and the presentation of a cryptographically verifiable attribute bundle.

1.For remote attended, remote unattended, and on-site unattended identity proofing, the CSP SHALL verify the applicant’s ownership of all pieces of presented identity evidence. For on-site attended identity proofing, the CSP SHALL verify the applicant’s ownership of the strongest piece of presented identity evidence.

2.Approved methods for verifying FAIR, STRONG, and SUPERIOR evidence for use in the IAL2 Biometric Pathway include:

1.Using automated means to compare a facial image represented on or stored in the identity evidence or in records associated with the evidence to a live sample provided by the applicant

2.Using automated means to compare a biometric characteristic other than a facial image stored on the identity evidence or in records associated with the evidence to a live sample provided by the applicant

1.During the video session, the applicant SHALL remain in view of the proofing agent during each step of the proofing process.

2.The video quality SHALL be sufficient to support the necessary steps in the validation and verification processes, such as inspecting evidence and comparing the user to the evidence.

3.The proofing agent SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the recorded session.

4.CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following further requirements apply:

1.The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.

2.The CSP SHALL gain consent from the applicant prior to initiating a recorded session.

3.The CSP SHALL publish their retention schedule and deletion processes for all video records.

5.The CSP SHALL implement injection protection and modified media controls, as defined in Sec. 3.14.

6.The CSP SHALL provide proofing agents with a method or mechanism to flag events for potential fraud.

1.The CSP SHALL provide a physical setting in which on-site identity proofing sessions are conducted.

2.All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.

3.CSP proofing agents SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the on-site session.

4.CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:

1.The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.

2.The CSP SHALL gain consent from the applicant prior to initiating a recorded session.

3.The CSP SHALL publish their retention schedule and deletion processes for all video records.

5.The CSP SHALL provide proofing agents with a method or mechanism to safely flag events for potential fraud.

1.All devices SHALL be safeguarded from tampering through observation by CSP representatives and/or physical and digital tamper prevention features.

2.All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.

3.All devices SHALL be inspected periodically by trained technicians to deter tampering, modification, or damage.

4.CSPs MAY record and maintain video recordings of on-site unattended identity proofing sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:

1.The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.

2.The CSP SHALL gain consent from the applicant prior to initiating a recorded session.

3.The CSP SHALL publish their retention schedule and deletion processes for all video records.

1.The CSP SHALL provide the ability for the applicant to bind an authenticator using one of the following methods:

1.Remote enrollment of a subscriber-provided authenticator consistent with the requirements for the authenticator type, as defined in Sec. 4.1.3 of [SP800-63B]

2.Distribution of a physical authenticator to a validated address

3.Distribution or on-site enrollment of an authenticator

2.If authenticators are bound outside of a single protected session with the user, the CSP SHALL confirm the presence of the intended subscriber through one of the following methods:

1.Return of a continuation code

2.Comparison against a biometric collected at the time of proofing

1.One piece of FAIR evidence and one piece of STRONG evidence or

2.Two pieces of STRONG evidence or

3.One piece of SUPERIOR evidence.

1.The CSP SHALL collect all core attributes, including at least one government identifier. Validated evidence is the preferred source of identity attributes. If the presented identity evidence does not provide all of the attributes that a CSP considers to be core attributes, the CSP MAY collect attributes that are self-asserted by the applicant.

2.The CSP SHALL collect and retain a biometric sample from the applicant during the identity proofing process to support account recovery and non-repudiation and to establish a high level of confidence that the same participant is present in the proofing and issuance processes, if done separately. CSPs MAY choose to periodically re-enroll user biometrics based on the modalities they use and the likelihood that subscriber accounts will persist long enough to warrant such a refresh.

1.Each piece of FAIR or STRONG evidence that is presented SHALL be validated using one of the following techniques:

1.Confirming the authenticity of the digital evidence by interrogating the digital security features (e.g., signatures on assertions or data)

2.Confirming the authenticity of the physical evidence using automated scanning technology that can detect physical security features

3.Confirming the integrity of any physical security features through a visual inspection by a proofing agent using a real-time or asynchronous process (e.g., offline manual review)

4.Confirming the integrity of any physical security features through physical and tactile inspection by a proofing agent at an on-site location

2.Each piece of SUPERIOR evidence SHALL be validated through the cryptographic verification of the evidence contents and the issuing source, including digital signature verification and the validation of any trust chain back to a trust anchor. Any piece of SUPERIOR evidence that cannot be validated using this method MAY be considered STRONG evidence if it can be validated by using one of the techniques provided above.

1.The CSP SHALL validate all core attributes by either:

1.Comparing the government identifier and other core attributes against an authoritative or credible source to determine accuracy or

2.Validating the accuracy of digitally signed attributes that are contained on SUPERIOR evidence through the public key of the issuing source

2.CSPs SHOULD evaluate attributes obtained from different sources (e.g., presented evidence, self-asserted, authoritative or credible sources) for consistency.

3.CSPs SHOULD validate any reference numbers on the presented identity evidence, if available.

1.The CSP SHALL verify the applicant’s ownership of the strongest piece of evidence (STRONG or SUPERIOR) by one of the following methods:

1.Confirming the applicant’s ability to successfully authenticate to a physical device or application (e.g., a mobile driver’s license) and comparing a digitally protected and transmitted facial portrait to the applicant

2.Comparing the applicant’s facial image to the facial portrait on the presented evidence via an automated comparison

3.Visually comparing the applicant’s facial image to the facial portrait on the presented evidence during an on-site attended session or a remote attended session

4.Performing an automated comparison of a stored biometric on the identity evidence or in the authoritative records associated with the evidence to a sample provided by the applicant

1.The CSP SHALL provide a secure, physical setting in which on-site identity proofing sessions are conducted.

2.The CSP SHALL provide sensors and capture devices for the collection of biometrics from the applicant.

3.The CSP SHALL have the proofing agent view the source of the collected biometric for the presence of any non-natural materials (e.g., putty, glue).

4.The CSP SHALL have the proofing agent collect the biometric samples in such a way that ensures the sample was collected from the applicant and no other source.

5.The CSP SHALL ensure that all information systems and technology leveraged by proofing agents and trusted referees are protected consistent with at least FISMA moderate or comparable levels of controls, including physical controls for the proofing facility.

6.CSP proofing agents SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the on-site session.

7.CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a session, the following additional requirements apply:

1.The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.

2.The CSP SHALL gain consent from the applicant prior to initiating a recorded session.

3.The CSP SHALL publish their retention schedule and deletion processes for all video records.

8.The CSP SHALL provide proofing agents with a method or mechanism to discretely flag events or actions as potential fraud.

1.The CSP SHALL monitor the entire identity proofing session through a high-resolution video transmission with the applicant.

2.The CSP SHALL have a live proofing agent participate remotely with the applicant for the evidence collection, evidence validation, and verification steps of the identity proofing process. Data entry of attributes for resolution and enrollment MAY be done without the presence of a live proofing agent.

3.The CSP SHALL require all actions taken by the applicant during the evidence collection, evidence validation, and verification steps to be clearly visible to the remote proofing agent.

4.The CSP SHALL require that all digital validation and verification of evidence (e.g., via chip or wireless technologies) be performed by integrated scanners and sensors (e.g., embedded fingerprint reader).

5.All devices used to support interaction between the proofing agent and the applicantSHALL be safeguarded from tampering through observation by CSP representatives or monitoring devices (e.g., cameras) and through physical and digital tamper prevention features.

6.All devices used to support interaction between the proofing agent and the applicant SHALL be protected by appropriate baseline security features that are comparable to at least FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.

7.All devices used to support interaction between the proofing agent and the applicant SHALL be inspected periodically by trained technicians to deter tampering, modification, or damage.

1.The CSP SHALL distribute or enroll the subscriber’s initial authenticator during an on-site attended interaction with a proofing agent.

2.If the CSP distributes or enrolls the initial authenticator outside of a single authenticated protected session with the subscriber, the CSP SHALL compare a biometric sample collected from the subscriber to the one collected at the time of proofing prior to registration of the authenticator and MAY request that the subscriber bring the identity evidence used during the proofing process to further strengthen the process of binding the authenticator to the subscriber.

•The unique identifier associated with the subscriber account

•Any subject identifiers established for the subscriber, including any RP-specific subject identifiers

•A record of the identity proofing steps completed for the subscriber, including:

•The type and issuer of identity evidence

•The type of proofing (i.e., remote unattended, remote attended, on-site attended, on-site unattended)

•The validation and verification methods used

•The use of a trusted referee or other exception handling process

•The use of an applicant reference, including a unique identifier for the applicant reference

•Maximum IAL successfully achieved for the identity proofing of the subscriber

•Records of any applicant consent agreements related to the collection and processing of information about the applicant throughout the subscriber account life cycle, including biometrics

•All authenticators currently bound to the subscriber account, whether registered at enrollment or subsequent to enrollment

•Attributes that were validated during the identity proofing process or in subsequent transactions to support RP access

•The subscriber elects to terminate their subscriber account with the CSP.

•The CSP determines that the subscriber account has been compromised.

•The CSP determines that the subscriber has violated the policies or rules for participation in the CSP identity service.

•The CSP determines that the subscriber account is inactive in accordance with the policies or rules established by the CSP.

•The CSP receives notification of a subscriber’s death from an authoritative source.

•The CSP receives a legal instrument instructing it to terminate a subscriber’s account.

•The CSP ceases identity system and services operations.

1.The CSP SHALL develop and document their process for reviewing and assessing subscribers with multiple accounts to identify possible fraud.

2.The CSP SHALL maintain a mapping of all accounts associated with a unique government identifier or common core attributes.

3.The CSP SHALL provide individuals with visibility into the full list of subscriber accounts associated with their identity.

4.The CSP SHOULD allow subscribers to block the creation of additional accounts using their personal information.

1.Impersonation: An attacker attempts to pose as another legitimate individual (e.g., identity theft)

2.False or fraudulent representation: An attacker attempts to create a false identity or false claims about an identity (e.g., synthetic identity fraud)

3.Social engineering attacks: An attacker uses deception or coercion to convince a victim to take some action during the identity proofing process with the ultimate goal of controlling access to the resulting subscriber account

4.Infrastructure attacks: An attacker attempts to compromise the confidentiality, availability, or integrity of the infrastructure, data, software, or people supporting the CSP’s identity proofing process (e.g., distributed denial of service, insider threats)

1.The likelihood that an action it takes (e.g., additional verification steps or records retention) could create a privacy problem for the applicant, such as loss of trust

2.The impact on the applicant if a problem should occur. CSPs should be able to justify any response they take to identified privacy risks, including accepting the risk, mitigating the risk, and sharing the risk. Applicant consent is considered to be a form of sharing the risk and, therefore, should only be used when an applicant could reasonably be expected to have the capacity to assess and accept this shared risk.

•To avoid user frustration, streamline the identity proofing and enrollment process and make each step as clear and easy as possible.

•Clearly communicate how and where to acquire technical assistance. For example, provide helpful information, such as links to an online self-service portal, chat sessions, and a phone number for help desk support. Ideally, sufficient information should be provided to enable users to answer their own enrollment preparation questions without outside intervention.

•Clearly explain what personal data is being collected and whether collecting the data is optional or not. Additionally, provide information indicating with whom the data will be shared, where it will be stored, and how it will be protected.

•Ensure that all information presented is usable.

•Follow good information design practices for all user-facing materials (e.g., data collection notices, fillable forms).

•Write materials in plain language, and avoid technical jargon. If appropriate, tailor the language to the literacy level of the intended population. Use an active voice and a conversational style; logically sequence main points; use the same word consistently rather than synonyms to avoid confusion; and use bullets, numbers, and formatting where appropriate to aid readability.

•Consider text legibility, such as font style, size, color, and contrast with the surrounding background. The highest contrast is black on white. Text legibility is important because users have different levels of visual acuity. Illegible text will contribute to user comprehension errors or user entry errors (e.g., when completing fillable forms). Use sans serif font styles for electronic materials and serif fonts for paper materials. When possible, avoid fonts that do not clearly distinguish between easily confusable characters (e.g., the letter “O” and the number “0”). This is especially important for confirmation codes. Use a minimum font size of 12 points, as long as the text fits the display.

•Perform a usability evaluation for each step with representative users. Establish realistic goals and tasks and appropriate contexts of use for the usability evaluation.

•Information about the entire process, such as what to expect at each step

•Clear explanations of the expected time frames to allow users to plan accordingly

•An explanation of the need for and benefits of identity proofing to enable users to understand the value proposition

•Identity evidence requirements for the intended IAL and a list of acceptable evidence documents with information about how they will be validated

•Information about whether there is a fee and, if so, the amount and variety of acceptable forms of payment

•Relevant information on whether the identity proofing and enrollment process will be conducted on-site, over remote channels, or a combination of the two and whether the user has the option to choose

•Information on the location, whether a user can choose their preferred location, and necessary logistical information for on-site attended or unattended sessions. Users may be reluctant to bring identity evidence to certain public places (e.g., a supermarket versus a bank), as it increases exposure to loss or theft.

•Information on the technical requirements (e.g., requirements for internet access) for remote sessions

•An option to set an appointment for remote attended or on-site attended identity proofing sessions in order to minimize wait times. If walk-ins are allowed, make it clear to users that their wait times may be greater without an appointment.

•Provide clear instructions for how to schedule an identity proofing appointment, obtain reminders, and reschedule existing appointments, if necessary.

•Offer appointment reminders, and allow users to specify their preferred appointment reminder method (e.g., postal mail, voicemail, email, text message). Users need information such as the date, time, location, and a description of the required identity evidence.

•Information on the allowed and required identity evidence and attributes, whether each piece is voluntary or mandatory, and the consequences for not providing the complete set of identity evidence. Users need to know the specific combinations of identity evidence, including requirements that are specific to a piece of identity evidence (e.g., a raised seal on a birth certificate). This is especially important due to potential difficulties procuring the necessary identity evidence.

•Where possible, implement tools to make it easier to obtain the necessary identity evidence.

•Inform users of any special requirements for minors or people with unique needs. For example, provide users with information on whether applicant reference and/or trusted referee processes are available and the information necessary to use those processes (see Sec. 3.14).

•If forms are required:

•Make fillable forms available before and during the identity proofing process.

•Do not require users to have access to a printer.

•Minimize the amount of information that users must enter on a form, as users are easily frustrated and more error-prone with longer forms. The CSP may auto-fill form fields when such data entry does not disclose personal information to unauthenticated users, such as data from scanned documents or data provided during the identity proofing process.

•At the start of an identity proofing session, remind users of the procedure. Do not expect them to remember the process that was described during the preparation step. If the identity proofing session does not immediately follow the preparation step, it is especially important to clearly remind users of the typical time frame for completing the identity proofing and enrollment process.

•Depending on the identity proofing method (e.g., remote or on-site unattended), provide a separate video window with a step-by-step tutorial of the identity proofing process. When these types of tutorials or examples are offered, service providers should have a range of support options to cover a broad set of users. Alternatives to a video window include verbal or written instructions.

•Provide options for the user to reschedule the time or type of their identity proofing appointment, if needed.

•Provide a checklist with the allowed and required identity evidence to ensure that users have the requisite identity evidence to proceed with the identity proofing and enrollment process. If users do not have the complete set of identity evidence, they must be informed regarding whether they can complete a partial identity proofing session or use exception processing through a trusted referee or, as appropriate, applicant references for identity proofing exception processing. This would also apply to international users if the types of identity evidence and access to data, services, and validation sources may not be easily or readily available to achieve IAL identity proofing requirements. Trusted referees and applicant references are intended to provide capabilities for alternative identity proofing workflows and risk-based decisions for users who need exception processing.

•Notify users regarding what information will be destroyed or retained for future follow-up sessions and what identity evidence they will need to bring to complete a future session. Ideally, users can choose whether they would like to complete a partial identity proofing session.

•Set user expectations regarding the outcome of the identity proofing and enrollment process, including time frames for any subsequent activities (e.g., delivery of a notification of proofing).

•Clearly indicate whether users will 1) receive an authenticator immediately at the end of a successful identity proofing and enrollment process, 2) have to schedule a follow-up appointment to pick up an authenticator in person, or 3) receive the authenticator in the mail and, if so, when they can expect to receive it.

•If subscriber-provided authenticators are permitted, provide information to users about how to register them to their subscriber accounts.

•During the identity proofing and enrollment process, there are several requirements to provide users with explicit notice, such as what data will be collected and processed by the CSP. See Sec. 3 and Sec. 7 for detailed requirements on notices. CSPs should be aware that seeking consent from users for the use of their attributes for purposes other than identity proofing, authentication, authorization, or attribute assertions may make them uncomfortable. If users do not understand how they will benefit from the additional collection or uses, they may be unwilling or hesitant to provide consent or continue the process. Therefore, it is recommended that CSPs provide users with a thorough explanation of how they may benefit from the additional processing of their personal information and the steps that the CSP takes to mitigate the risks associated with such processing. Additionally, CSPs should provide users with the opportunity to opt out of the additional processing.

•Confirmation codes are used to confirm that an applicant has access to a postal address, email address, or phone number for the purposes of future communications. If confirmation codes are used:

•Notify users in advance that they will receive a confirmation code, when to expect it, the length of time for which the code is valid, and how it will arrive (e.g., physical mail, SMS, landline telephone).

•When a confirmation code is delivered to a user, remind the users which service they are enrolling in and include instructions on how to use the code and the length of time for which the code is valid. This is especially important given the short validity time frames specified in Sec. 3.8.

•If issuing a machine-readable optical label, such as a QR Code (see Sec. 3.8), provide users with information on how to obtain QR code scanning capabilities (e.g., acceptable QR code applications). Additionally, provide a human-readable code as an alternative to QR codes.

•Inform users what will happen if the confirmation code expires or is lost before use.

•If an applicant is unable to complete identity proofing and enrollment in a single session, or if they will have to complete identity proofing via a different identity proofing type (e.g., remote attended, on-site attended), they may be issued a continuation code. Continuation codes are used to reestablish an applicant’s linkage to an incomplete identity proofing or enrollment process. If a continuation code is issued:

•Provide users with information about continuation codes, why they are used, how they will be delivered, and how they will be used to complete their identity proofing process.

•When a continuation code is delivered to a user, remind them which service they are enrolling in and include instructions on what they need to do or where to go to complete the identity proofing or enrollment process.

•If issuing a machine-readable optical label, such as a QR Code (see Sec. 3.9), provide users with information on how to obtain QR code scanning capabilities (e.g., acceptable QR code applications). Additionally, provide a human-readable code as an alternative to QR codes.

•Provide users with alternative options for reestablishing their linkage to an incomplete identity proofing or enrollment process, as not all users may have access to the necessary technologies.

•At the end of the identity proofing and enrollment process:

•If enrollment is successful, send subscribers a notification of proofing that confirms successful identity proofing and enrollment (see Sec. 3.10) as well as directions on the next steps they need to take (e.g., when and where to pick up their authenticator, when it will arrive in the mail).

•If enrollment is partially complete (e.g., due to users not having the complete set of identity evidence, users choosing to stop the process, or session timeouts), communicate to users:

•What information will be destroyed;

•What information will be retained for future follow-up sessions;

•How long the information will be retained; and

•What identity evidence they will need to bring to a future session.

•If enrollment is not successful, provide users with clear instructions for alternative identity proofing and enrollment options (e.g., on-site attended, use of trusted referee).

•If users receive an authenticator during the enrollment session, provide instructions on its use and maintenance. For example, information could include instructions for use (especially if there are different requirements for first-time use or initialization), information on authenticator expiration, how to protect the authenticator, and what to do if the authenticator is lost or stolen.

•For both in-person and remote identity proofing, additional usability considerations apply:

•At the start of the enrollment session, operators or attendants need to explain their role to users (e.g., whether operators or attendants will walk users through the enrollment session or observe silently and only interact as needed).

•At the start of the enrollment session, inform users that they must not depart during the session and that their actions must be visible throughout the session.

•When biometric samples are collected during the enrollment session, provide users with clear instructions on how to complete the capture process. The instructions are best given just prior to the process. Verbal instructions with guidance from a live operator are the most effective (e.g., instructing users where the biometric capture device is and how to interact with it, when to begin the capture process, how to know when the biometric capture is completed).

•Since remote identity proofing is conducted online, follow general web usability principles, such as:

•Design the user interface to walk users through the enrollment process.

•Reduce users’ memory load through techniques such as simplifying the interface or using visual aids.

•Make the interface consistent.