BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.1 Subscriber Accounts

NIST PIV and digital identity SP 800-63A-4 against SP 800-63A
All changes in this version
added 5 Subscriber Accounts part of 5

Title changed

Before · SP 800-63A

After · SP 800-63A-4

Subscriber Accounts

Control changed

Before · SP 800-63A

After · SP 800-63A-4

The CSP SHALL establish and maintain a unique subscriber account for each active subscriber in its identity system from the time of enrollment to the time of account closure. The CSP establishes a subscriber account to record each subscriber as a unique identity within its identity service and to maintain a record of all authenticators associated with that account.

The CSP SHALL assign a unique identifier to each subscriber account. The identifier SHOULD be randomly generated by the CSP’s system and of sufficient length and entropy to ensure uniqueness within its user population and to support federation with RPs, where applicable. The identifier MAY be used as a subject identifier in the generation of assertions, consistent with [SP800-63C] .

At a minimum, the CSP SHALL include the following information in each subscriber account:

• The unique identifier associated with the subscriber account

• Any subject identifiers established for the subscriber, including any RP-specific subject identifiers

• A record of the identity proofing steps completed for the subscriber, including:

– The type and issuer of identity evidence

– The type of proofing (i.e., remote unattended, remote attended, on-site attended, on-site unattended)

– The validation and verification methods used

– The use of a trusted referee or other exception handling process

– The use of an applicant reference, including a unique identifier for the applicant reference

• Maximum IAL successfully achieved for the identity proofing of the subscriber

• Records of any applicant consent agreements related to the collection and processing of information about the applicant throughout the subscriber account life cycle, including biometrics

• All authenticators currently bound to the subscriber account, whether registered at enrollment or subsequent to enrollment

• Attributes that were validated during the identity proofing process or in subsequent transactions to support RP access The CSP may enroll and establish a subscriber account for applicants who have not been identity-proofed (e.g., pseudonymous accounts) and record such status in the subscriber account.