BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.2 Identity Proofing and Enrollment (was: Considerations, Other Requirements, and Flexibilities)

NIST PIV and digital identity SP 800-63-4 against SP 800-63-3
All changes in this version
modified 2 Continuous improvement programs. Establishing a continuous evaluation part of 2

Title changed

Before · SP 800-63-3

Considerations, Other Requirements, and Flexibilities

After · SP 800-63-4

Considerations, OtherIdentity Requirements,Proofing and FlexibilitiesEnrollment

Control changed

Before · SP 800-63-3

Agencies may employ other risk mitigation measures and compensating controls not specified herein. Agencies need to ensure that any mitigations and compensating controls do not degrade the selected assurance level’s intended security and privacy protections. Agencies may consider partitioning the functionality of a digital service to allow less sensitive functions to be available at a lower level of authentication and identity assurance.

Agencies may determine based on their risk analysis that additional measures are appropriate in certain contexts. In particular, privacy requirements and legal risks may lead agencies to determine that additional authentication measures or other process safeguards are appropriate. When developing digital authentication processes and systems, agencies should consult OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 [ M-03-22 ] . See the Use of Electronic Signatures in Federal Organization Transactions [ ESIG ] for additional information on legal risks, especially those related to the need to 1) satisfy legal standards of proof and 2) prevent repudiation.

Additionally, federal agencies implementing these guidelines should adhere to their statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283 [ FISMA ], and related NIST standards and guidelines. FISMA directs federal agencies to develop, document, and implement agency-wide programs to provide security for the information and systems that support the agency’s operations and assets. This includes the security authorization and accreditation (SA&A) of IT systems that support digital authentication. NIST recommends that non-federal entities implementing these guidelines follow equivalent standards to ensure the secure operations of their digital systems.

After · SP 800-63-4

Agencies[SP800-63A] may, employDigital otherIdentity riskGuidelines: mitigationIdentity measuresProofing and compensating controls not specified herein. Agencies needEnrollment to, ensureprovides thatgeneral anyguidance mitigationsinformation and compensating controls donormative notrequirements degradefor the selected assurance level’s intendedidentity securityproofing and privacyenrollment protections.processes Agenciesas maywell consideras partitioningIAL-specific therequirements.

[SP800-63A] functionalityprovides ofgeneral ainformation digitaland servicenormative torequirements allowfor lessthe sensitiveidentity functionsproofing toand beenrollment availableprocesses atas awell loweras levelrequirements ofthat authenticationare andspecific identityto assuranceIALs.

Agencies may determineFigure based1 onillustrates theira riskcommon analysistransaction thatsequence additionalfor measuresthe areidentity appropriateproofing inand certainenrollment contextsfunctions.

Identity Inproofing particular,and privacyenrollment requirementsbegin andwhen legalan risksapplicant mayinitiates leadidentity agenciesproofing, tooften determineby thatattempting additionalto authenticationaccess measuresan oronline otherapplication processserved safeguardsby arethe appropriateCSP. When developing digitalThe authenticationCSP processesor andits systems,component agenciesservice shouldrequests consultidentity OMBevidence Guidanceand forattributes Implementingfrom the Privacy Provisionsapplicant, ofwhich the E-Governmentapplicant Actsubmits ofvia 2002an [online M-03-22or ]in-person transaction. See theThe UseCSP ofresolves Electronicthe Signaturesuser in(i.e., Federaluniquely Organizationdistinguishes Transactionsthe [user), ESIGvalidates ]the foraccuracy additionaland informationauthenticity onof legalthe risksevidence, especially those relatedand tovalidates the need to 1) satisfy legal standardsaccuracy of proof and 2) preventthe repudiationattributes.

Additionally, federal agencies implementingIf thesethe guidelinesapplicant shouldis adheresuccessfully toidentity-proofed, theirthey statutoryare responsibilitiesenrolled underin the Federal Informationidentity Securityservice Modernizationas Acta (FISMA)subscriber of 2014, 44 U.S.C. § 3551 etthat seqCSP., PublicA Lawunique (P.L.)subscriber 113-283account [is FISMAthen ]created, and related NIST standards and guidelines. FISMA directs federal agencies to develop,one document,or andmore implementauthenticators agency-wideare programsregistered to provide security for the information and systems that support the agency’s operations and assetsaccount. This includes

Subscribers thehave securitya authorizationresponsibility andto accreditationmaintain (SA&A)control of IT systems that supporttheir digitalauthenticators authentication(e. NIST recommends thatg., non-federalguard entitiesagainst implementingtheft) theseand guidelinescomply followwith equivalentCSP standardspolicies to ensure theremain securein operationsgood ofstanding theirwith digitalthe systemsCSP.