BaselineWatch
25 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST PIV and digital identity SP 800-63A

25 requirements · published 2020-03-02
Changes in this version
All1 The CSP SHALL NOT use KBV to verify an applicant's identity against more than one10 References2 The CSP SHALL only use information that is expected to be known only to the applicant3 The CSP SHALL allow a resolved and validated identity to opt out of KBV and leverage4 The CSP SHOULD perform KBV by verifying knowledge of recent transactional history5 The CSP SHALL require operators to have undergone a training program to detect6 The CSP SHALL employ physical tamper detection and resistance features appropriate7 The CSP SHALL ensure that all communications occur over a mutually authenticated8 Privacy Considerations9 Usability Considerations
RefTitleText
8 Privacy Considerations This section is informative. These privacy considerations provide information regarding the General Requirements set forth in Section 4.2 .
8.1
in 8
 Collection and Data Minimization Section 4.2 requirement 2 permits the collection of only the PII necessary to validate the existence of the claimed identity and associate the claimed identity to the applicant, based on best available practices for appropriate identity res
8.1.1
in 8.1
 Social Security Numbers Section 4.2 requirement 13 does not permit the CSP to collect the SSN unless it is necessary for performing identity resolution, when resolution cannot be accomplished by collection of another attribute or combination of attributes. Overrel
8.2
in 8
 Notice and Consent Section 4.2 requirement 3 requires the CSP provide explicit notice to the applicant at the time of collection regarding the purpose for collecting and maintaining a record of the attributes necessary for identity proofing, including whether
8.3
in 8
 Processing Limitation Section 4.2 requirement 4 requires CSPs to use measures to maintain the objectives of predictability (enabling reliable assumptions by individuals, owners, and operators about PII and its processing by an information system) and manageabili
8.4
in 8
 Redress Section 4.2 requirement 5 requires the CSP to provide effective mechanisms for redressing applicant complaints or problems arising from the identity proofing, and make the mechanisms easy for applicants to find and access. The Privacy Act
8.5
in 8
 Privacy Risk Assessment Section 4.2 requirement 7 and 10 require the CSP to conduct a privacy risk assessment. In conducting a privacy risk assessment, CSPs should consider:
8.6
in 8
 Agency Specific Privacy Compliance Section 4.2 requirement 12 covers specific compliance obligations for federal CSPs. It is critical to involve your agency’s SAOP in the earliest stages of digital authentication system development to assess and mitigate privacy risks and ad

8 of 25.