+4.1 Identity Assurance Level 1 Requirements
---+4.1.1 Proofing Types
---+4.1.2 Evidence Collection
---+4.1.3 Attribute Collection
---+4.1.4 Evidence Validation
---+4.1.5 Attribute Validation
---+4.1.6 Verification Requirements
---+4.1.7 Remote Unattended Requirements
---+4.1.8 Remote Attended Requirements
---+4.1.9 On-Site Attended Requirements
---+4.1.10 On-Site Unattended Requirements
---+4.1.11 Notification of Proofing
---+4.1.12 Initial Authenticator Binding

4.1 Identity Assurance Level 1 Requirements

Identity proofing processes at IAL1 allow for a range of acceptable techniques to detect fraudulent claims to identities by malicious actors while facilitating user adoption, minimizing the rejection of legitimate users, and reducing application departures. The use of biometric matching (e.g., automated comparison of the applicant’s facial image to a facial portrait on supplied evidence) is optional at IAL1.

1. Przegląd

4.1.1 Proofing Types
IAL1 identity proofing MAY be delivered through any proofing type, as described in Sec. 2.1.3.
CSPs MAY combine proofing types and their stated requirements to create hybrid processes. For example, a CSP might leverage remote unattended identity proofing validation processes in advance of a remote attended session where the verification will take place. If such steps are combined, CSPs SHALL document their hybrid process and state how the applicable requirements for each of the employed proofing types are met.
4.1.2 Evidence Collection

For identity proofing at IAL1, the CSP SHALL collect:

One piece of:
FAIR evidence that can be digitally validated or that includes a facial portrait or other biometric or
STRONG evidence or
SUPERIOR evidence.
4.1.3 Attribute Collection

The CSP SHALL collect all core attributes, including at least one government identifier. Validated evidence is the preferred source of identity attributes. If the presented identity evidence does not provide all of the attributes that the CSP considers to be core attributes, it MAY collect attributes that are self-asserted by the applicant.
4.1.4 Evidence Validation

Each piece of evidence presented SHALL be validated using one of the following methods:

Confirming the authenticity of digital evidence by interrogating the digital security features (e.g., signatures on assertions or data)
Confirming the authenticity of physical evidence using automated scanning technology that can detect physical security features, as described in Sec. 3.14
Confirming the integrity of physical security features on presented evidence through visual inspection by a proofing agent using real-time or asynchronous processes (e.g., offline manual review)
Confirming the integrity of physical security features through physical and tactile inspection by a proofing agent at an on-site location
4.1.5 Attribute Validation
The CSP SHALL validate all core attributes and the government identifier against an authoritative or credible source to determine accuracy.
CSPs SHOULD evaluate attributes obtained from different sources (e.g., presented evidence, self-asserted, authoritative or credible sources) for consistency.
CSPs SHOULD validate any reference numbers on the presented identity evidence, if available.
4.1.6 Verification Requirements

The CSP SHALL verify the applicant’s ownership of one piece of evidence using one of the following methods:

Confirming the applicant’s ability to return a confirmation code delivered to a validated address associated with the evidence
Confirming the applicant’s ability to return a microtransaction value delivered to a validated financial or similar account
Confirming the applicant’s ability to successfully complete an authentication and federation protocol equivalent to AAL2/FAL2 or higher to access an account related to the identity evidence
Comparing the applicant’s facial image to a facial portrait on evidence via an automated comparison
Visually comparing the applicant’s facial image to a facial portrait on evidence or in records associated with the evidence during an on-site attended session (i.e., in-person with a proofing agent), a remote attended session (i.e., live video with a proofing agent), or an asynchronous process (i.e., visual comparison made by a proofing agent at a different time). If the comparison is performed asynchronously at a later time, the CSP SHALL implement PAD and passive or active document presence checks to increase confidence that both the live applicant and physical documents are present during the submission or capture event.
Using automated means to compare a facial image represented on or stored in the identity evidence or in records associated with the evidence to a live sample provided by the applicant
4.1.7 Remote Unattended Requirements

There are no additional requirements for remote unattended identity proofing beyond the requirements specified in Sec. 2, 3, and 4.
4.1.8 Remote Attended Requirements
During the video session, the applicant SHALL remain in view of the proofing agent during each step of the proofing process.
The video quality SHALL be sufficient to support the necessary steps in the validation and verification processes, such as inspecting evidence and comparing the applicant to the evidence.
The proofing agent SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the session.
CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following further requirements apply:
The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.
The CSP SHALL gain consent from the applicant prior to initiating a recorded session.
The CSP SHALL publish their retention schedule and deletion processes for all video records.
The CSP SHALL implement injection protection and modified media controls, as defined in Sec. 3.14.
The CSP SHALL provide proofing agents with a method or mechanism to flag events for potential fraud.
4.1.9 On-Site Attended Requirements
The CSP SHALL provide a physical setting in which on-site identity proofing sessions are conducted.
All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.
CSP proofing agents SHALL be trained to identify signs of manipulation, coercion, or social engineering occurring during the on-site session.
CSPs MAY record and maintain video sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:
The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.
The CSP SHALL gain consent from the applicant prior to initiating a recorded session.
The CSP SHALL publish their retention schedule and deletion processes for all video records.
The CSP SHALL provide proofing agents with a method or mechanism to covertly flag events for potential fraud.
4.1.10 On-Site Unattended Requirements
All devices SHALL be safeguarded from tampering through observation by CSP representatives and/or physical and digital tamper prevention features.
All devices SHALL be protected by appropriate baseline security features comparable to FISMA moderate controls, including malware protection, administrator-specific access controls, and software update processes.
All devices SHALL be inspected periodically by trained technicians to deter tampering, modification, or damage.
CSPs MAY record and maintain video recordings of on-site unattended identity proofing sessions for fraud prevention and prosecution purposes pursuant to a privacy risk assessment, as defined in Sec. 3.3.1. If the CSP records a video session, the following additional requirements apply:
The CSP SHALL notify the applicant of the recording prior to initiating a recorded session.
The CSP SHALL gain consent from the applicant prior to initiating a recorded session.
The CSP SHALL publish their retention schedule and deletion processes for all video records.
4.1.11 Notification of Proofing

Upon the successful completion of identity proofing at IAL1, the CSP SHALL send a notification of proofing to a validated address for the applicant, as specified in Sec. 3.10.
4.1.12 Initial Authenticator Binding

Once a unique subscriber account is established for the applicant (now subscriber) in the CSP’s identity system, one or more authenticators can be associated (i.e., bound) to the subscriber’s account. To minimize the need for account recovery, CSPs SHOULD encourage subscribers to bind at least two separate means of authentication. See Sec. 5 for more information about subscriber accounts and Sec. 4.1.2.1 of [SP800-63B] for more information on binding authenticators.

The CSP SHALL provide the ability for the applicant to bind an authenticator using one of the following methods:
Remote enrollment of a subscriber-provided authenticator consistent with the requirements for the authenticator type, as defined in Sec. 4.1.3 of [SP800-63B]
Distribution of a physical authenticator to a validated address
Distribution or on-site enrollment of an authenticator
If authenticators are bound outside of a single protected session with the user, the CSP SHALL confirm the presence of the intended subscriber through one of the following methods:
Return of a continuation code
Comparison against a biometric collected at the time of proofing

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.