BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.4.4 Digital Identity Acceptance Statement

NIST PIV and digital identity SP 800-63-4 against SP 800-63-3
All changes in this version
added 3 Digital Identity Risk Management part of 3.4

Title changed

Before · SP 800-63-3

After · SP 800-63-4

Digital Identity Acceptance Statement

Control changed

Before · SP 800-63-3

After · SP 800-63-4

Organizations SHALL develop a Digital Identity Acceptance Statement (DIAS) to document the results of the DIRM process for (i) each online service managed by the organization, and (ii) each external online service used to support the mission of the organization, including software-as-a-service offerings (e.g., social media platforms, email services, online marketing services). RPs who intend to use a particular CSP/IdP SHALL review the latter’s DIAS and incorporate relevant information into the organization’s DIAS for each online service.

Organizations SHALL prepare a DIAS for their online service that includes, at a minimum:

• Initial impact assessment results,

• Initially assessed xALs,

• Tailored xAL and rationale if the tailored xAL differs from the initially assessed xAL,

• All compensating controls with their comparability or residual risks, and

• All supplemental controls.

Federal agencies SHOULD include this information in the information system authorization package described in [NISTRMF] .

CSPs/IdPs SHALL implement the DIRM process and develop a DIAS for the services they offer if they deviate from the normative guidance in these guidelines, including when supplemental or compensating controls are added. To complete a DIRM of their offered assurance levels and controls, CSPs/IdPs MAY base their assessment on anticipated or representative digital identity services that they wish to support. In creating this risk assessment, they SHOULD seek input from real-world RPs on their user populations and anticipated context. The DIAS prepared by a CSP SHALL include, at a minimum:

• Claimed xAL, related controls, and rationale for any deviations from normative guidance;

• All compensating controls with their comparability or residual risks; and

• All supplemental controls. The DIRM process for external online services used by the organization SHALL consider relevant inputs from the provider of the service and document the results in a DIAS. The DIAS prepared by the organization for external online services SHALL include, at a minimum:

• Assessed xAL, related controls, and rationale for any deviations from normative guidance;

• All compensating controls with their comparability or residual risks; and

• All supplemental controls.

The final implemented xALs do not all need to be at the same level. There may be variance based on the functions of the online service, the impact assessment, and the tailoring process.