Demo TPAT | TD: Identity Proofing

Identity Proofing - Audit Logs, v3.0

Requirements for maintaining and reviewing audit logs.

1 Audit Logs (AuditLogs) Does the CSP maintain audit logs? Artifact Documentation Provide sample (anonymized) logs and/or documentation about log contents.
2 Type of Proofing (TypeofProofing) Do CSP audit logs include the type of identity proofing performed? Artifact Documentation Provide sample (anonymized) logs and/or documentation about log contents.
3 Evidence (Evidence) Does the CSP uniquely correlate identity evidence in the audit logs? Artifact Documentation Provide sample (anonymized) logs and/or documentation about log contents.
4 PII Collected (PIICollected) Does the CSP's audit logs include collected PII? Artifact Documentation Provide sample (anonymized) logs and/or documentation about log contents.
5 Validation (Validation) Does the CSP's audit logs include all steps taken to validate identity evidence? Artifact Documentation Provide sample (anonymized) logs and/or documentation about log contents.
6 Verify Identity (VerifyIdentity) Does the CSP's audit logs include all steps taken to verify the identity of the applicant? Artifact Documentation Provide sample (anonymized) logs and/or documentation about log contents.
7 Outcome (Outcome) Does the CSP's audit logs record each step and the final outcome of the identity proofing? Artifact Documentation Provide sample (anonymized) logs and/or documentation about log contents.

Audit Logs The CSP SHALL maintain a record, including audit logs, of: Citation SP800-63A Section 4.2 P7
Type of Proofing The CSP's audit logs SHALL include the type of identity proofing performed. Citation SP800-63A Section 4.2 P7
Evidence The CSP's audit logs SHALL include the types of and a unique reference to identity evidence collected from the Applicant / Service Consumer in the proofing process. Citation SP800-63A Section 4.2 P7
PII Collected The CSP's audit logs SHALL include PII or other responses collected from authoritative and/or issuing sources. Citation SP800-63A Section 4.2 P7
Validation The CSP's audit logs SHALL include all steps taken to validate the identity evidence. Citation SP800-63A Section 4.2 P7
Verify Identity The CSP's audit logs SHALL include all steps taken to verify the identity of the Applicant. Citation SP800-63A Section 4.2 P7
Outcome The CSP's audit logs SHALL include the outcome of each step, culminating in the final proofing result. Citation SP800-63A Section 4.2 P7