{"id":3408,"date":"2022-06-15T12:36:57","date_gmt":"2022-06-15T12:36:57","guid":{"rendered":"https:\/\/kuma.pro\/?p=3408"},"modified":"2023-04-21T20:01:04","modified_gmt":"2023-04-21T20:01:04","slug":"digital-identity-certifications-trustmarks-are-not-just-for-government-business-anymore-why-risk-future-business-without-them","status":"publish","type":"post","link":"https:\/\/kuma.pro\/digital-identity-certifications-trustmarks-are-not-just-for-government-business-anymore-why-risk-future-business-without-them\/","title":{"rendered":"Digital Identity Certifications &amp; Trustmarks are Not Just for Government Business Anymore: Why Risk Future Business Without Them?"},"content":{"rendered":"<p>As one peruses various vendor websites in the global identity and access management industry, words like &#8220;security&#8221;, &#8220;trust&#8221;, &#8220;privacy&#8221;, and &#8220;secure&#8221; leap off the home pages. While each vendor does its best to differentiate itself from the pack, buyers are challenged to identify the \u201chaves\u201d from the \u201chave nots\u201d when it comes to meeting their unique internal or customer requirements, or complying with regulations in the jurisdictions they do business in.<\/p>\n<h4>Governments have addressed this issue via technical guidance documents. A few examples are:<\/h4>\n<ul>\n<li>The UK government\u2019s Cabinet Office and Government Digital Service Good Practice Guides (GPGs) for identity proofing (GPG45) and authentication (GPG44).<\/li>\n<li>The UK Government released an alpha version 2 of a Digital Identity and Attributes Trust Framework with version 3 expected over the summer. \u00b7 Effective April 6 the UK government permits employers and landlords to use certified digital identity service providers to carry out identity checks on their behalf for many who are not in scope to use the Home Office online services, including British and Irish citizens. This in in alignment with the government\u2019s Disclosure and Barring Service\u2019s (DBS) proposal to enable digital identity checking within their criminal record checking process, through the introduction of its Identity Trust Scheme.<\/li>\n<li>The Pan-Canadian Trust Framework (PCTF) developed by the Digital Identity and Authentication Council of Canada (DIACC) who members include government agencies, relying parties, security vendors, identity and authentication vendors, is \u201cdesigned to meet current and future Canadian digital identity ecosystem innovation needs by verifying trust of services and networks.\u201d The PCTF is comprised of several components including Privacy, Verified Person, Credentials, and Authentication. Organizations participating in the PCTF can be awarded a trustmark for each component via the Voil\u00e0 Verified program, DIACC\u2019s third-party conformity assessment verification program showing compliance with the PCTF.<\/li>\n<li>The U.S.\u2019s National Institute of Standards and Technology\u2019s (NIST) Digital Identity Guidelines (Special Publication 800-63-3) requiring federal agencies to grant user access to networks using a risk-based approach for identity proofing, authentication and federation at three distinct levels of assurance while providing details as to what constitutes specific levels. NIST is currently working on version 4 of the guidance with a draft expected very soon.<\/li>\n<\/ul>\n<p>To streamline the buying process, a benefit to procurement officials, vendors, and the public, NIST SP 800-63-3 certification is required by the U.S. Government and has become common in RFPs in federally regulated industries including financial services, healthcare, and automotive. Times have changed, and it is often no longer acceptable for vendors to state they comply &#8211; they need to prove it. <em>They need to be certified.<\/em> Digital identity vendors who are certified \u201ccheck the box\u201d and include their certification with their proposal, while uncertified vendors are often disqualified.<\/p>\n<p>To obtain NIST SP 800-63-3 certification, vendors turn to the non-profit Kantara Initiative to be vetted to ensure conformant technical provision of the vendor\u2019s service. The Kantara Initiative is the global trust community that promotes adherence to data and privacy standards by identity system providers. The objective: to obtain Kantara\u2019s coveted Trust Mark, which recognizes trustworthy use of identity and personal data solutions characterized by three different elements: innovation, standardization, and good practice.<\/p>\n<h4>Below are a few examples of where NIST SP 800-63-3 certification is necessary:<\/h4>\n<ul>\n<li>U.S. Health and Human Services Trusted Exchange Framework and Common Agreement (TEFCA. Per HHS, TEFCA\u2019s goal \u201cis to establish a universal floor of interoperability across the country. The Common Agreement will establish the infrastructure model and governing approach for users in different networks to securely share basic clinical information with each other\u2014all under commonly agreed-to expectations and rules, and regardless of which network they happen to be in\u201d. TEFCA brings together healthcare organizations, identity and authentication service providers, and the relying parties who, ultimately, provide services to patients. At the root of trusted exchange is having high confidence that the person accessing protected health information (PHI) is who they claim to be and to protect patient privacy and security, TEFCA mandates in healthcare for the assurance and accreditation of ID, and the providers of ID systems. (<a href=\"https:\/\/kantarainitiative.org\/trustoperations\/service-provider-approval\/\" target=\"_blank\" rel=\"noopener\">See Section 6, Identity Proofing mandated assurance levels, TEFCA.<\/a>) Increasing adoption of NIST-800-63 standards across the healthcare sector will undoubtedly make for more robust EHI sharing, which will lead to greater trust in the whole sector. The challenges seen around the rollout of the COVID-19 vaccination program can be viewed now as a valuable lesson, as they&#8217;ve illuminated weak spots and shown that there is still a long way to go.<\/li>\n<li>The U.S. Department of Transportation\u2019s (DOT) <a href=\"https:\/\/www.nhtsa.gov\/\" target=\"_blank\" rel=\"noopener\">National Highway Traffic Safety Administration (NHTSA)<\/a>, published its <a href=\"https:\/\/www.nhtsa.gov\/sites\/nhtsa.gov\/files\/documents\/ofrrev-ibr-2019-00035-draft-rule.pdf\" target=\"_blank\" rel=\"noopener\">Final Rule for Odometer Disclosure Requirement<\/a>, which would enable states to allow electronic odometer disclosure statements in conjunction with electronic titling systems \u201ce-titling\u201d &#8211; leveraging electronic signature technology. Of all the benefits electronic signature technology offers, the technology cannot verify the identity of the person signing without prior enrollment and identity verification process. NHTSA realized that and has mandated that <a href=\"https:\/\/www.onespan.com\/products\/identity-verification?ad=blog-text\" target=\"_blank\" rel=\"noopener\">identity verification<\/a> must be performed at NIST\u2019s Identity Assurance Level 2 (IAL2), which requires evidence to support the real-world existence of the claimed identity, either remote or physically present identity proofing.<\/li>\n<li>Leveraging the precedent established by NHTSA, the American Association of Motor Vehicle Administrators (AAMVA) published its <a href=\"https:\/\/www.aamva.org\/getmedia\/855615a8-b71d-4641-a422-f7706716faf2\/Electronic-Titling-Framework_final.pdf\" target=\"_blank\" rel=\"noopener\">Electronic Titling Framework<\/a>. This framework \u201cadopts the minimum standard for identity proofing and authentication level for odometer disclosures, and all electronic titling transactions, to adopt and satisfy the requirements set by the National Institute of Standards and Technology (NIST) at a moderate level (IAL2 and AAL2).\u201d<\/li>\n<\/ul>\n<p>These few examples are just the beginning of an anticipated wave of National digital identity standards and certification requirements at the state and local levels, and within the private sector, especially in the mostly private sector owned and managed <a href=\"https:\/\/www.cisa.gov\/critical-infrastructure-sectors\" target=\"_blank\" rel=\"noopener\">16 critical infrastructure sectors<\/a> as defined by DHS\u2019 Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n<h5><strong>If you\u2019re a vendor in the digital identity and access management space without certification, the time has come to ask yourself, &#8220;Why?&#8221;<\/strong><\/h5>\n<p>To support multi-national vendors, Kuma is one of the only accredited assessors in the United States for NIST 800-63-3, Canada (DIACC\u2019s Pan-Canadian Trust Framework), and soon the United Kingdom (UK Government\u2019s Digital Identity and Attributes Trust Framework). Please <a href=\"https:\/\/www.linkedin.com\/company\/kuma-llc\" target=\"_blank\" rel=\"noopener\">follow Kuma on social media<\/a> for our latest news. Want to talk about how certification can help your business thrive? <a href=\"https:\/\/kuma.pro\/contact\/\">Contact us today.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>As one peruses various vendor websites in the global identity and access management industry, words like &#8220;security&#8221;, &#8220;trust&#8221;, &#8220;privacy&#8221;, and &#8220;secure&#8221; leap off the home pages. While each vendor does its best to differentiate itself from the pack, buyers are challenged to identify the \u201chaves\u201d from the \u201chave nots\u201d when it comes to meeting their [&hellip;]<\/p>\n","protected":false},"author":11,"featured_media":3415,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[1,10],"tags":[25,115,116,32,11,117],"_links":{"self":[{"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/posts\/3408"}],"collection":[{"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/comments?post=3408"}],"version-history":[{"count":1,"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/posts\/3408\/revisions"}],"predecessor-version":[{"id":5879,"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/posts\/3408\/revisions\/5879"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/media\/3415"}],"wp:attachment":[{"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/media?parent=3408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/categories?post=3408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kuma.pro\/wp-json\/wp\/v2\/tags?post=3408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}