+4.2 Identity Assurance Level 2 Requirements
---+4.2.1 Proofing Types
---+4.2.2 Evidence Collection
---+4.2.3 Attribute Collection
---+4.2.4 Evidence Validation
---+4.2.5 Attribute Validation
---+4.2.6 Verification Requirements
------+4.2.6.1 IAL2 Verification — Non-Biometric Pathway
------+4.2.6.2 IAL2 Verification — Digital Evidence Pathway
------+4.2.6.3 IAL2 Verification — Biometric Pathway
---+4.2.7 Remote Unattended Requirements
---+4.2.8 Remote Attended Requirements
---+4.2.9 On-Site Attended Requirements
---+4.2.10 On-Site Unattended Requirements
---+4.2.11 Notification of Proofing
---+4.2.12 Initial Authenticator Binding

4.2 Identity Assurance Level 2 Requirements

IAL2 identity proofing includes additional evidence, validation, and verification requirements to better mitigate impersonation attacks and other identity proofing errors relative to IAL1. IAL2 can be achieved through different types of identity proofing (e.g., remote unattended, remote attended), and identity verification at IAL2 can be accomplished with or without the use of biometrics. This section presents three different pathways to align with IAL2 outcomes and requirements: IAL2 Verification — Non-Biometric Pathway, IAL2 Verification — Biometric Pathway, and IAL2 Verification — Digital Evidence Pathway.

1. Přehled

4.2.1 Proofing Types
IAL2 identity proofing MAY be delivered through any identity proofing type, as described in Sec. 2.1.3.
CSPs MAY combine identity proofing types and their stated requirements to create hybrid processes. For example, a CSP might leverage remote unattended identity proofing validation processes in advance of a remote attended session where the verification will take place. If such steps are combined, CSPs SHALL document their hybrid process and state how the applicable requirements for each of the employed proofing types are met.
4.2.2 Evidence Collection

For identity proofing at IAL2, the CSP SHALL collect:

One piece of FAIR evidence and one piece of STRONG evidence or
Two pieces of STRONG evidence or
One piece of SUPERIOR evidence.
4.2.3 Attribute Collection

The CSP SHALL collect all core attributes, including at least one government identifier. Validated evidence is the preferred source of identity attributes. If the presented identity evidence does not provide all of the attributes that the CSP considers to be core attributes, it MAY collect attributes that are self-asserted by the applicant.
4.2.4 Evidence Validation
Each piece of FAIR or STRONG evidence that is presented SHALL be validated using one of the following techniques:
Confirming the authenticity of the digital evidence by interrogating the digital security features (e.g., signatures on assertions or data)
Confirming the authenticity of the physical evidence using automated scanning technology that can detect physical security features
Confirming the integrity of any physical security features through a visual inspection by a proofing agent using a real-time or asynchronous process (e.g., offline manual review)
Confirming the integrity of any physical security features through physical and tactile inspection by a proofing agent at an on-site location
Each piece of SUPERIOR evidence SHALL be validated through the cryptographic verification of the evidence contents and the issuing source, including digital signature verification and the validation of any trust chain back to a trust anchor. Any piece of SUPERIOR evidence that cannot be validated using this method MAY be considered STRONG evidence if it can be validated by using one of the techniques provided above.
4.2.5 Attribute Validation
The CSP SHALL validate all core attributes by either:
Comparing the government identifier and other core attributes against an authoritative or credible source to determine accuracy
Validating the accuracy of digitally signed attributes that are contained on SUPERIOR evidence through the public key of the issuing source
CSPs SHOULD evaluate attributes obtained from different sources (e.g., presented evidence, self-asserted, authoritative or credible sources) for consistency.
CSPs SHOULD validate any reference numbers on the presented identity evidence, if available.
4.2.6 Verification Requirements

Verification pathways SHOULD be implemented consistent with relevant policy and be responsive to the use cases, populations, and threat environment of the online service being protected. CSPs SHOULD deploy more than one pathway to IAL2 verification and MAY combine pathways in order to achieve desired outcomes.

CSPs that offer multiple verification pathways SHALL record in the subscriber record which pathways were followed to achieve IAL2 and SHALL make that information available to RPs in the assertion, API, or as part of their trust agreement. When the Non-Biometric Pathway is used, the CSP SHALL additionally record whether a mailed confirmation code or a visual comparison of the applicant against evidence was used for verification.
4.2.7 Remote Unattended Requirements

There are no additional requirements for remote unattended identity proofing beyond the requirements specified in Sec. 2, 3, and 4.
4.2.8 Remote Attended Requirements
During the video session, the applicant SHALL remain in view of the proofing agent during each step of the proofing process.
The video quality SHALL be sufficient to support the necessary steps in the validation and verification processes, such as inspecting evidence and comparing the user to the evidence.
The proofing agent SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the recorded session.
CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following further requirements apply:
The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.
The CSP SHALL gain consent from the applicant prior to initiating a recorded session.
The CSP SHALL publish their retention schedule and deletion processes for all video records.
The CSP SHALL implement injection protection and modified media controls, as defined in Sec. 3.14.
The CSP SHALL provide proofing agents with a method or mechanism to flag events for potential fraud.
4.2.9 On-Site Attended Requirements
The CSP SHALL provide a physical setting in which on-site identity proofing sessions are conducted.
All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.
CSP proofing agents SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the on-site session.
CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:
The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.
The CSP SHALL gain consent from the applicant prior to initiating a recorded session.
The CSP SHALL publish their retention schedule and deletion processes for all video records.
The CSP SHALL provide proofing agents with a method or mechanism to safely flag events for potential fraud.
4.2.10 On-Site Unattended Requirements
All devices SHALL be safeguarded from tampering through observation by CSP representatives and/or physical and digital tamper prevention features.
All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.
All devices SHALL be inspected periodically by trained technicians to deter tampering, modification, or damage.
CSPs MAY record and maintain video recordings of on-site unattended identity proofing sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:
The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.
The CSP SHALL gain consent from the applicant prior to initiating a recorded session.
The CSP SHALL publish their retention schedule and deletion processes for all video records.
4.2.11 Notification of Proofing

Upon the successful completion of identity proofing at IAL2, the CSP SHALL send a notification of proofing to a validated address for the applicant, as specified in Sec. 3.10. CSPs SHOULD send the notification of proofing to the applicant’s postal address.
4.2.12 Initial Authenticator Binding

Once a unique subscriber account is established for the applicant (now subscriber) in the CSP’s identity system, one or more authenticators can be associated (i.e., bound) to the subscriber’s account. To minimize the need for account recovery, CSPs SHOULD encourage subscribers to bind at least two separate means of authentication. See Sec. 5 for more information about subscriber accounts and Sec. 4.1.2.1 of [SP800-63B] for more information on binding authenticators.

The CSP SHALL provide the ability for the applicant to bind an authenticator using one of the following methods:
Remote enrollment of a subscriber-provided authenticator consistent with the requirements for the authenticator type, as defined in Sec. 4.1.3 of [SP800-63B]
Distribution of a physical authenticator to a validated address
Distribution or on-site enrollment of an authenticator
If authenticators are bound outside of a single protected session with the user, the CSP SHALL confirm the presence of the intended subscriber through one of the following methods:
Return of a continuation code
Comparison against a biometric collected at the time of proofing

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.