NIST PIV and digital identity SP 800-63A
All1 The CSP SHALL NOT use KBV to verify an applicant's identity against more than one10 References2 The CSP SHALL only use information that is expected to be known only to the applicant3 The CSP SHALL allow a resolved and validated identity to opt out of KBV and leverage4 The CSP SHOULD perform KBV by verifying knowledge of recent transactional history5 The CSP SHALL require operators to have undergone a training program to detect6 The CSP SHALL employ physical tamper detection and resistance features appropriate7 The CSP SHALL ensure that all communications occur over a mutually authenticated8 Privacy Considerations9 Usability Considerations
| Ref | Title | Text | |
|---|---|---|---|
| 1 | The CSP SHALL NOT use KBV to verify an applicant's identity against more than one | piece of validated identity evidence. | |
| 2 | The CSP SHALL only use information that is expected to be known only to the applicant | and the authoritative source, to include any information needed to begin the KBV process. Information accessible freely, for a fee in the public domain, or via the black market SHALL NOT be used. | |
| 3 | The CSP SHALL allow a resolved and validated identity to opt out of KBV and leverage | another process for verification. | |
| 4 | The CSP SHOULD perform KBV by verifying knowledge of recent transactional history | in which the CSP is a participant. The CSP SHALL ensure that transaction information has at least 20 bits of entropy. For example, to reach minimum entropy requirements, the CSP could ask the applicant for verification of the amount(s) and | |
| 5 | The CSP SHALL require operators to have undergone a training program to detect | potential fraud and to properly perform a supervised remote proofing session. | |
| 6 | The CSP SHALL employ physical tamper detection and resistance features appropriate | for the environment in which it is located. For example, a kiosk located in a restricted area or one where it is monitored by a trusted individual requires less tamper detection than one that is located in a semi-public area such as a shopp | |
| 7 | The CSP SHALL ensure that all communications occur over a mutually authenticated | protected channel. | |
| 7.1 in 7 |
Threat Mitigation Strategies | Enrollment threats can be deterred by making impersonation more difficult to accomplish or by increasing the likelihood of detection. This recommendation deals primarily with methods for making impersonation more difficult; however, it does | |
| 8 | Privacy Considerations | This section is informative. These privacy considerations provide information regarding the General Requirements set forth in Section 4.2 . | |
| 8.1 in 8 |
Collection and Data Minimization | Section 4.2 requirement 2 permits the collection of only the PII necessary to validate the existence of the claimed identity and associate the claimed identity to the applicant, based on best available practices for appropriate identity res | |
| 8.1.1 in 8.1 |
Social Security Numbers | Section 4.2 requirement 13 does not permit the CSP to collect the SSN unless it is necessary for performing identity resolution, when resolution cannot be accomplished by collection of another attribute or combination of attributes. Overrel | |
| 8.2 in 8 |
Notice and Consent | Section 4.2 requirement 3 requires the CSP provide explicit notice to the applicant at the time of collection regarding the purpose for collecting and maintaining a record of the attributes necessary for identity proofing, including whether | |
| 8.3 in 8 |
Processing Limitation | Section 4.2 requirement 4 requires CSPs to use measures to maintain the objectives of predictability (enabling reliable assumptions by individuals, owners, and operators about PII and its processing by an information system) and manageabili | |
| 8.4 in 8 |
Redress | Section 4.2 requirement 5 requires the CSP to provide effective mechanisms for redressing applicant complaints or problems arising from the identity proofing, and make the mechanisms easy for applicants to find and access. The Privacy Act | |
| 8.5 in 8 |
Privacy Risk Assessment | Section 4.2 requirement 7 and 10 require the CSP to conduct a privacy risk assessment. In conducting a privacy risk assessment, CSPs should consider: | |
| 8.6 in 8 |
Agency Specific Privacy Compliance | Section 4.2 requirement 12 covers specific compliance obligations for federal CSPs. It is critical to involve your agency’s SAOP in the earliest stages of digital authentication system development to assess and mitigate privacy risks and ad | |
| 9 | Usability Considerations | This section is informative . This section is intended to raise implementers’ awareness of the usability considerations associated with enrollment and identity proofing (for usability considerations for typical authenticator usage and inte | |
| 9.1 in 9 |
General User Experience Considerations During Enrollment and Identity Proofing | This sub-section provides usability considerations that are applicable across all steps of the enrollment process. Usability considerations specific to each step are detailed in Sections 9.2 to 9.4 . • To avoid user frustration, streamline | |
| 9.2 in 9 |
Pre-Enrollment Preparation | This section describes an effective approach to facilitate sufficient pre-enrollment preparation so users can avoid challenging, frustrating enrollment sessions. Ensuring users are as prepared as possible for their enrollment sessions is cr | |
| 9.3 in 9 |
Enrollment Proofing Session | Usability considerations specific to the enrollment session include: • Remind users at the start of the enrollment session of the enrollment session procedure, without expecting them to remember from the pre-enrollment preparation step. If | |
| 9.4 in 9 |
Post-Enrollment | Post-enrollment refers to the step immediately after enrollment but prior to typical usage of an authenticator (for usability considerations for typical authenticator usage and intermittent events, see SP800-63B , Section 10.1-10.3. As desc | |
| 10 | References | This section is informative. | |
| 10.1 in 10 |
General References | [A-130] OMB Circular A-130, Managing Federal Information as a Strategic Resource , July 28, 2016, available at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/OMB/circulars/a130/a13 0revised.pdf . [COPPA] Children’s On | |
| 10.2 in 10 |
Standards | [Canada] Government of Canada, Guideline on Identity Assurance , available at: http://www.tbs- sct.gc.ca/pol/doc-eng.aspx?id=30678§ion=HTML . [ISO 9241-11] International Standards Organization, ISO/IEC 9241-11 Ergonomic requirements fo | |
| 10.3 in 10 |
NIST Special Publications | NIST 800 Series Special Publications are available at: http://csrc.nist.gov/publications/PubsSPs.html . The following publications may be of particular interest to those implementing systems of applications requiring e-authentication. [SP |
25 of 25.