Minimal confidence Low confidence in Moderate High confidence in in the identity the identity confidence in the the identity assertion / assertion / identity assertion / assertion / credential. credential. credential. credential. Important Achieving LoA 4 Assurance requires completion of the requirements for LOA1 LoA 3. – Note Given the sensitivity of the personal information collected and stored, Providers of authentication services at LOA 2 and above must satisfy the security and privacy requirements for mailbox/data vault Providers (above) to a minimum of LOA 3. REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 Identity Ensure that each Perform all Electronic Only face-to-face Proofing applicant‘s identity identity proofing verification where identity proofing. (Providers to record is unique strictly in accordance possible (DVS or other GSEF processes demonstrate within the service‘s with its published authorised data apply completion of community of Identity Proofing verification service Applicant presents: NeAF subjects and uniquely Policy provider see below) secondary – assessment associable with Applicant provides of presented Government Picture [reflected in tokens and/or name, DOB, address, documents with the ID (not the same as Identity and credentials issued to email/phone (to be specified issuing the primary Credential that identity verified with issuing authority to document) or Accept a institutions as corroborate date of credential issued by a Policies] and implementation of identity appropriate) birth, current address regulated financial of provisions of Accept Maintain of record, and other institution ISO/IEC 29115) attestation of appropriate Identity personal information. OR evidence. and Verification The Primary two items Accept Records in document must be a confirming name, and pseudonyms self accordance with the Government issued address or email – asserted, socially Archives Act credential with a address, such as: validated biometric utility bill, Optional ID proofing: GSEF processes professional license Known customer may be considered on or membership, or (see Gatekeeper EOI a risk basis other evidence of Policy and equivalent standing 2007. Optional ID Proofing: (see Gatekeeper EOI identity Customer Policy) All presented Known. credentials and Customers) information are 3rd party where possible verification electronically verified (authorised referee) with relevant issuing authority LOA 1 LOA 2 LOA 3 LOA 4 REQUIREMENT
Minimal confidence in the identity assertion / credential. Low confidence in the identity assertion / credential. Moderate confidence in the identity assertion / credential. High confidence in the identity assertion / credential. Important Achieving LoA 4 Assurance requires completion of the requirements for LOA1 – LoA 3. Note Given the sensitivity of the personal information collected and stored, Providers of authentication services at LOA 2 and above must satisfy the security and privacy requirements for mailbox/data vault Providers (above) to a minimum of LOA 3. REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 Identity Proofing (Providers to demonstrate completion of NeAF assessment [reflected in Identity and Credential Policies] and implementation of provisions of ISO/IEC 29115) Ensure that each applicant‘s identity record is unique within the service‘s community of subjects and uniquely associable with tokens and/or credentials issued to that identity Accept a of identity Accept of evidence. Accept pseudonyms – self asserted, socially validated Perform all identity proofing strictly in accordance with its published Identity Proofing Policy Applicant provides name, DOB, address, email/phone (to be verified with issuing institutions as appropriate) Maintain appropriate Identity and Verification Records in accordance with the Archives Act Optional ID proofing: Known customer (see Gatekeeper EOI Policy and identity Known. Customers) 3rd party verification (authorised referee) Electronic verification where possible (DVS or other authorised data verification service provider – see below) of presented documents with the specified issuing authority to corroborate date of birth, current address of record, and other personal information. The Primary document must be a Government issued credential with a biometric GSEF processes may be considered on a risk basis Optional ID Proofing: Customer Only face-to-face identity proofing. GSEF processes apply Applicant presents: secondary Government Picture ID (not the same as the primary document) or credential issued by a regulated financial institution OR two items confirming name, and address or email address, such as: utility bill, professional license or membership, or other evidence of equivalent standing (see Gatekeeper EOI Policy) All presented credentials and information are where possible electronically verified with relevant issuing authority REQUIREMENT LOA 1 LOA 2 LOA 3 LOA 4 attestation 2007.
draft-commercial-service-provider.docx