BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.2 Customer Success Considerations (was: Notice and Consent)

NIST PIV and digital identity SP 800-63A-4 against SP 800-63A
All changes in this version
modified 8 Customer Experience Considerations part of 8

Title changed

Before · SP 800-63A

Notice and Consent

After · SP 800-63A-4

NoticeCustomer andSuccess ConsentConsiderations

Control changed

Before · SP 800-63A

Section 4.2 requirement 3 requires the CSP provide explicit notice to the applicant at the time of collection regarding the purpose for collecting and maintaining a record of the attributes necessary for identity proofing, including whether such attributes are voluntary or mandatory in order to complete the identity proofing transactions, and the consequences for not providing the attributes.

An effective notice will take into account user experience design standards and research, and an assessment of privacy risks that may arise from the collection. Various factors should be considered, including incorrectly inferring that applicants understand why attributes are collected, that collected information may be combined with other data sources, etc. An effective notice is never only a pointer leading to a complex, legalistic privacy policy or general terms and conditions that applicants are unlikely to read or understand.

After · SP 800-63A-4

Section 4.2 requirement 3 requires the CSPA provideprimary explicitaspect noticeof tocustomer theexperience applicantis atanticipating the timeneeds of collection regarding the purpose foruser collectingpopulation and maintaining a recordoffering ofsolutions thethat attributesare necessarysuitable for identitythat proofing,population. includingThis whetherbecomes suchconsiderably attributesmore aredifficult voluntarywithin orthe mandatorycontext inof orderidentity toproofing completeas the processes of identity proofingresolution, transactionsvalidation, and theverification consequenceseach forintroduce nottheir providingown theuser attributeschallenges.

An effective noticeBy willanalyzing takethe intoentire accountproofing userprocess experienceand designassessing standardsfor andcommon researchchallenges, and an assessmentCSPs ofcan privacydeploy riskssolutions that may arise from“meet the collection. Varioususer factorswhere shouldthey beare” considered,and includingprovide incorrectlya inferringmore thataccessible applicantsand understandresponsive whyset attributesof aresolutions collected,for thattheir collectedusers. informationConsistent maywith bethe combinednormative withrecommendations otherwithin datathis sourcesdocument, etc. Anthe effectivefollowing noticesubsections isdiscuss neverthe onlyvalue aof pointerdeploying leadingoptionality toand achoice complex,for legalisticusers privacythroughout policythe oridentity generalproofing termsprocess and conditions that applicants are unlikelythe torisks readthey orcan understandmitigate.