BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1 Usability (was: Collection and Data Minimization)

NIST PIV and digital identity SP 800-63A-4 against SP 800-63A
All changes in this version
modified 8 Customer Experience Considerations part of 8

Title changed

Before · SP 800-63A

Collection and Data Minimization

After · SP 800-63A-4

Collection and Data MinimizationUsability

Control changed

Before · SP 800-63A

Section 4.2 requirement 2 permits the collection of only the PII necessary to validate the existence of the claimed identity and associate the claimed identity to the applicant, based on best available practices for appropriate identity resolution, validation, and verification. Collecting unnecessary PII can create confusion regarding why information not being used for the identity proofing service is being collected. This leads to invasiveness or overreach concerns, which can lead to loss of applicant trust. Furthermore, PII retention can become vulnerable to unauthorized access or use. Data minimization reduces the amount of PII vulnerable to unauthorized access or use, and encourages trust in the identity proofing process.

After · SP 800-63A-4

Section[ISO/IEC9241-11] 4.2focuses requirementon 2the permitsusers, thegoals, collectionand context of onlyuse as the PIInecessary elements for achieving effectiveness, efficiency, and satisfaction. A holistic approach that considers these key elements is necessary to validateachieve usability.

The overarching goal of usability for identity proofing and enrollment is to promote a smooth, positive enrollment process for users by minimizing user burden (e.g., time, frustration) and enrollment friction (e.g., the existencenumber of steps to complete, the claimedamount of information to track). To achieve this goal, organizations must first familiarize themselves with their users.

The identity proofing and associateenrollment process establishes a user’s interactions with a given CSP and the claimedonline identityservices tothat the applicantuser will access. As negative first impressions can influence user perception of subsequent interactions, basedorganizations need to promote a positive user experience throughout the process.

An effective usability evaluation on bestthe availableidentity practicesproofing forand enrollment process involves representative users, realistic goals and tasks, and appropriate contexts of use. The identity resolutionproofing and enrollment process should be designed and implemented so that it is easy for users to do the right thing, validationhard for them to do the wrong thing, and verificationeasy for them to recover if the wrong thing happens. Collecting[ISO/IEC9241-11], unnecessary[ISO16982], PIIand can[ISO25060] createprovide confusionguidance regardingon whyhow informationto notevaluate beingthe usedoverall usability of an identity service and additional considerations for improving usability.

From the user’s perspective, the three main steps of identity proofing serviceand isenrollment beingare collected1) preparation, 2) identity proofing and enrollment, and 3) post-enrollment actions. ThisThese leadssteps tomay invasivenessoccur orin overreacha concernssingle session, whichor canthere leadcould tobe lossa significant amount of applicanttime trustbetween each one (e.g., Furthermoredays, PIIweeks).

General retentionand canstep-specific becomeusability vulnerableconsiderations toare unauthorizeddescribed accessin orthe usesubsections below and are described from the users’ perspective. DataSection minimization508 reducesof the amountRehabilitation Act of PII1973 vulnerable[Section508] was enacted to unauthorizedeliminate accessbarriers orin useinformation technology and require federal agencies to make electronic and information technology accessible to people with disabilities. While these guidelines do not directly assert requirements from Section 508, identity service providers are expected to comply with Section 508 provisions. Beyond compliance with Section 508, federal agencies and encouragestheir trustservice inproviders are generally expected to design services and systems with the experiences of people with disabilities in mind to ensure that accessibility is prioritized throughout identity proofingsystem processlife cycles.