Overview Policy context Trust between government and users is a key foundation for online service delivery. For users to have access to government services through web and mobile media, they must be able to confirm their identity online as required. For this reason, the enabling of citizen identity and access management was identified as a priority in the 2013 Victorian Government ICT Strategy. This policy aims to simplify user engagement with Victorian Government online services by enabling the use of a simplified sign-on when accessing services across multiple agencies. Policy statement Where identity credentials are required for external users of Victorian Government online services, agencies will provide use of the Victorian Government federated identity service as an option for sign- on. Rationale The identity management framework will enable the delivery of Victorian Government services to users across multiple agencies using a simplified sign-on (SSO). This will be based on federated identity services where agencies accept the registration (including identification) completed by, and authentication mechanism issued by, other organisations including the Australian Government Reliance Framework and approved Third Party Identity Services Assurance Framework, including social media web sites. Scope All agencies with existing or planned citizen online service delivery requiring user identification. Requirements Service requirements The federated identity service must comply with: Victorian Government security standards including SEC POL 01 Information Security Management Policy which requires compliance with the Australian Government Protective (PSPF), (ISM) and Security Policy Framework Information Security Manual National eAuthentication Framework (NeAF), VG IDAM standards (IDAM STD 01 Identity and Access Management, IDAM STD 02-2 Strength of Registration for Citizens and Organisations and IDAM STD 03 Strength of Authentication Mechanism), the VG Information Privacy Act (2000) and Health Records Act (2001) appropriate identity management frameworks and agreements for facilities integrated into the federated identity service including the national Document Verification Service, the Australian Government Reliance Framework and Third Party Identity Services Assurance Framework, etc.,
Overview Policy context Trust between government and users is a key foundation for online service delivery. For users to have access to government services through web and mobile media, they must be able to confirm their identity online as required. For this reason, the enabling of citizen identity and access management was identified as a priority in the 2013 Victorian Government ICT Strategy. This policy aims to simplify user engagement with Victorian Government online services by enabling the use of a simplified sign-on when accessing services across multiple agencies. Policy statement Where identity credentials are required for external users of Victorian Government online services, agencies will provide use of the Victorian Government federated identity service as an option for sign- on. Rationale The identity management framework will enable the delivery of Victorian Government services to users across multiple agencies using a simplified sign-on (SSO). This will be based on federated identity services where agencies accept the registration (including identification) completed by, and authentication mechanism issued by, other organisations including the Australian Government Reliance Framework and approved Third Party Identity Services Assurance Framework, including social media web sites. Scope All agencies with existing or planned citizen online service delivery requiring user identification. Requirements Service requirements The federated identity service must comply with: Victorian Government security standards including SEC POL 01 Information Security Management Policy which requires compliance with the Australian Government Protective Security Policy Framework (PSPF), Information Security Manual (ISM) and National eAuthentication Framework (NeAF), VG IDAM standards (IDAM STD 01 Identity and Access Management, IDAM STD 02-2 Strength of Registration for Citizens and Organisations and IDAM STD 03 Strength of Authentication Mechanism), the VG Information Privacy Act (2000) and Health Records Act (2001) appropriate identity management frameworks and agreements for facilities integrated into the federated identity service including the national Document Verification Service, the Australian Government Reliance Framework and Third Party Identity Services Assurance Framework, etc.,
IDAM-POL-02-Citizen-Identity-Management.docx