Demo TPAT | TD: Identity Evidence

Identity Evidence - Evidence Strength, v3.0

Requirements for types of evidence collected as part of identity proofing.

1 Evidence Collected (EvidenceCollected) Does the CSP collect satisfactory evidence confirming the applicant's identity? It must collect: One piece of STRONG evidence IF the evidence's issuing source, during its identity proofing event, confirmed the claimed identity by collecting two or more forms of SUPERIOR or STRONG evidence AND the CSP validates the evidence directly with the issuing source; OR Two pieces of STRONG evidence; OR One piece of STRONG evidence plus two pieces of FAIR evidence. . Provide documentation of which ones of the above the CSP uses (they can use any or all of them). Artifact Documentation Provide policies and practices indicating conformance.
2 Evidence Justification (EvidenceJustification) Does the CSP's Credential Policy document the strength of each form of evidence it collects when collecting evidence from applicants? The strengths assigned must align with NIST 800-63-3 Section 5-1. Provide the details for each type of evidence the CSP uses. Artifact Documentation Provide policies and practices indicating conformance.

Evidence Collected The CSP SHALL collect from the Applicant / Service Consumer identity evidence of appropriate strength, as determined by the further requirements in NIST 800-63-3 Section 5-1. The CSP SHALL collect: One piece of STRONG evidence IF the evidence's issuing source, during its identity proofing event, confirmed the claimed identity by collecting two or more forms of SUPERIOR or STRONG evidence AND the CSP validates the evidence directly with the issuing source; OR Two pieces of STRONG evidence; OR One piece of STRONG evidence plus two pieces of FAIR evidence. . Citation SP800-63A Section 4.4.1.2 (IAL2) P1-3
Evidence Justification The CSP SHALL document its justification, for each form of evidence it recognises and collects in fulfilling its CrP and these criteria, of how the strength of the evidence it collects satisfies the qualities identified in NIST 800-63-3 Section 5-1. Citation SP800-63A Section 4.4.1.2 (IAL2)