3.1 Define the Online Service

Before · SP 800-63-3

After · SP 800-63-4

Define the Online Service

Before · SP 800-63-3

After · SP 800-63-4

The purpose of defining the online service is to understand its functionality and establish a common understanding of its context, which will inform subsequent steps of the DIRM process. The role of the online service is contextualized as part of the broader Fig. 6. High-level diagram of the Digital Identity Risk Management Process Flow

25 Step 1: Define the Online Service Outcome: Functional Scope; User Groups; Impacted Entities

Step 2: Conduct Initial Impact Assessment for each User Group

Outcome: Combined Impact Level (Low/Mod/High) for each User Group Determine Impact Levels per Impact Category

Step 3: Select Initial Assurance Levels for each User Group

Outcome: Baseline Controls for Initial IAL/AAL/FAL for each User Group Map Combined Impact Level to Initial IAL/AAL/FAL and Controls

Step 4: Tailor and Document Assurance Levels for each User Group

Outcome: Digital Identity Acceptance Statement with Final IAL/AAL/FAL and Controls Using Baseline Controls, Conduct Privacy, Customer Experience, and Threat Assessments Adjust Initial IAL/AAL/FAL; Select Compensating and Supplemental Controls

Step 5: Continuously Evaluate and Improve

Outcome: Updated Digital Identity Acceptance Statement with Adjustments to Controls Establish Performance Metrics; Collect Evaluation Inputs; Assess Performance Implement/Deploy/Adjust Identity Management System for Online Services business environment and associated processes, resulting in a documented description of the scope of the online service, user groups and their expectations, data processed, impacted entities, and other pertinent details.

RPs SHALL develop a description of the online service that includes, at minimum:

• The organizational mission and business objectives supported by the online service

• The mission and business partner dependencies associated with the online service

• Legal, regulatory, and contractual requirements, including privacy obligations that apply to the online service

• The functionality of the online service and the data that it is expected to process

• User groups that need to have access to the online service as well as the types of online transactions and access privileges available to each user group

• The set of entities (to include users of the online service, organizations, and populations served) that will be impacted by the online service and the broader business process of which it is a part

• The results of any preexisting DIRM assessments (as an input) and the current state of any preexisting identity technologies (i.e., proofing, authentication, or federation)

• The estimated availability of the types of identity evidence required for identity proofing across all user groups served

It is imperative to consider unexpected and undesirable impacts, as well as the scale of impact, on different entities that result from an unauthorized user gaining access to the online service due to a failure of the digital identity system. For example, if an attacker obtained unauthorized access to an online service that controls a power plant, the actions taken by the bad actor could have devastating environmental impacts on the local populations that live near the facility and cause power outages for the localities served by the plant.

It is important to differentiate between user groups and impacted entities , as described in this document. The online service will allow access to a set of users who may be partitioned into a few user groups based on the kind of functionality that is offered to that user group. For example, an online income tax filing and review service may have the following user groups: (1) citizens who need to check the status of their personal tax returns, (2) tax preparers who file tax returns on behalf of their clients, and (3) system administrators who assign privileges to different groups of users or create new user groups as needed. Impacted entities include all those who could face negative consequences in the event of a digital identity system failure. This will likely include members of the user groups but may also include those who never directly use the system. Accordingly, the scope of impact assessments SHALL include individuals who use the online application as well as the organization itself. Additionally, organizations SHALL identify other entities (e.g., mission partners, communities, and those identified in [SP800-30] ) that need to be specifically included based on mission and business needs. At a minimum, organizations SHALL document all impacted entities (both internal and external to the organization) when conducting their impact assessments.

The output of this step is a documented description of the online service, including a list of the user groups and other entities that are impacted by the functionality provided by the online service. This information will serve as a basis and establish the context for effectively applying the impact assessments detailed in the following sections.