BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.5.2 Performance Metrics

NIST PIV and digital identity SP 800-63-4 against SP 800-63-3
All changes in this version
added 3 Digital Identity Risk Management part of 3.5

Title changed

Before · SP 800-63-3

After · SP 800-63-4

Performance Metrics

Control changed

Before · SP 800-63-3

After · SP 800-63-4

The exact metrics available to organizations will vary based on the technologies, architectures, and deployment methods they use. Additionally, the availability and usefulness of certain metrics will vary over time. Therefore, these guidelines do not attempt to define a comprehensive set of metrics for all scenarios. Table 4 provides a set of recommended metrics that organizations SHOULD track as part of their continuous evaluation program. However, organizations are not constrained by this table and SHOULD implement metrics based on their specific systems, technology, and program needs. See [SP800-55V2] for more information on identifying additional performance metrics. In Table 4 , all references to unique users include both legitimate users and imposters.

Table 4. Performance Metrics

Title Description Type Pass Rate (Overall) Percentage of unique users who successfully complete identity proofing Proofing

Pass Rate (Per Proofing Type) Percentage of unique users who are successfully proofed for each offered type (i.e., remote unattended, remote attended, on-site attended, on-site unattended) Proofing

Continued on next page Continued from previous page Title Description Type Fail Rate (Overall) Percentage of unique users who start the identity proofing process but are unable to successfully complete all of the steps Proofing

Estimated Adjusted Fail Rate Percentage of failures adjusted to account for identity proofing attempts that are suspected to be fraudulent Proofing

Fail Rate (Per Proofing Type) Percentage of unique users who do not complete proofing due to a process failure for each offered type (i.e., remote unattended, remote attended, on-site attended, on-site unattended) Proofing

Abandonment Rate (Overall) Percentage of unique users who start the identity proofing process but do not complete it without failing a process Proofing

Abandonment Rate (Per Proofing Type) Percentage of unique users who start a specific type of identity proofing process but do not complete it without failing a process Proofing

Failure Rates (Per Proofing Process Step) Percentage of unique users who are unsuccessful at completing each identity proofing step in a CSP process Proofing

Completion Times (Per Proofing Type) Average time that it takes a user to complete each defined proofing type offered as part of an identity service Proofing

Authenticator Type Usage Percentage of subscribers who have an active authenticator by each type available Authentication

Authentication Failures Percentage of authentication events that fail (not to include authentication attempts that are successful after re- entry of an authenticator output) Authentication

Account Recovery Attempts The number of account or authenticator recovery processes initiated by subscribers Authentication

Continued on next page Continued from previous page Title Description Type Confirmed Unauthorized Access or Fraud Percentage of total transaction events (i.e., identity proofing + authentication events) that the organization determines to be unauthorized or fraudulent through analysis or self- reporting Fraud

Suspected Unauthorized Access or Fraud Percentage of total transaction events (i.e., identity proofing + authentication events) that are suspected to be unauthorized or fraudulent Fraud

Reported Unauthorized Access or Fraud Percentage of total transaction events (i.e., identity proofing + authentication events) reported to be unauthorized or fraudulent by users Fraud

Unauthorized Access or Fraud (Per Proofing Type) Number of identity proofing events that are suspected or reported as being fraudulent for each available type of proofing Fraud

Unauthorized Access or Fraud (Per Authentication Type) Number of authentication events that are suspected or reported to be unauthorized or fraudulent by each available type of authentication Fraud

Help Desk Calls Number of calls received by the CSP or identity service Customer Experience

Help Desk Calls (Per Type) Number of calls received related to each offered service (e.g., proofing failures, authenticator resets, complaints) Customer Experience

Help Desk Resolution Times Average length of time that it takes to resolve a complaint or help desk ticket Customer Experience

Customer Satisfaction Surveys The results of customer feedback surveys conducted by CSPs, RP, or both Customer Experience

Redress Requests The number of redress requests received related to the identity management system Customer Experience

Redress Resolution Times The average time it takes to resolve redress requests related to the identity management system Customer Experience The data used to generate continuous evaluation metrics may not always reside with the identity program or the organizational entity responsible for identity management systems. The intent of these metrics is to integrate with existing data sources whenever possible to collect information that is critical to identity program evaluation. For example, customer service representative (CSR) teams may already have substantial information on customer requests, complaints, or concerns. Organizations that implement and maintain identity management systems are expected to coordinate with these teams to acquire the information needed to discern identity management system- related complaints or issues.