Conforming with the Identification Standards
Use this guidance to learn the types of conformance and the process for getting assessed. Use the tools to gather the evidence needed for assessment.
Conformance and mandates
To conform with each of the Identification Standards, ALL the controls will be met.
Voluntary conformance by any party wishing to follow good practice for contributing to the prevention of identity theft and fraud, will be against the levels indicated by undertaking a risk assessment.
Mandated conformance with the Identification Standards is specified through mechanisms such as contracts, cabinet mandates and legislation. The following mandate currently applies:
Conformance with one or more of the Identification Standards is a requirement for Digital Identity Services Trust Framework (DISTF) accreditation.
Accreditation of digital identity providers and services — Public Service Commission
Types of conformance
Conformance with standards brings consistency and good practice to products and services. It’s a key element to building consumers’ trust in the use of products and services.
There are 3 types of conformance:
Self-assessment
An accountable party, such as a Relying Party, Credential Provider, or Facilitation Provider, can assess themselves against the relevant Identification Standard controls to see if they can meet the requirements. This can be completed without having to commit to a full conformance process.
Qualified assessment
A qualified assessment is useful where there’s no obligation to conform with the Identification Standards or the accountable party is on a journey to conforming and would like to know how close they are.
Qualified assessment is a lighter process than an audited assessment and does not result in a conformance certificate being issued. The assessor will provide advice about the degree to which conformance may be achieved and to what Levels of Assurance.
Audited assessment
An audited assessment is a robust process where evidence, such as documentation and demonstration shows how each of the relevant controls is being complied with.
The length of this assessment process will depend on the degree to which the Identification Standards have already been embedded into the processes being undertaken.
Deciding on a conformance type
The type of assessment being undertaken impacts who is involved and what’s produced at the end of it. The options are:
- self-assessment — can be done at any time and does not involve an assessor or the formal conformance process
- qualified assessment — light conformance process that results in informal advice provided by an assessor about the degree to which conformance may be achieved and to what Levels of Assurance
- audited assessment — robust conformance process that results in an Identification Standards Conformance Certificate being issued.
Schedule an assessment
Contact the Identification Team at idmstandards@gdda.govt.nz to schedule qualified or audited assessments.
The conformance process
The formal conformance process occurs in 3 key stages:
- Stage 1 — Introduction and scoping
- Stage 2 — Providing evidence and being assessed
- Stage 3 — Demonstration and assessment outcome
For help at any point throughout these stages contact the Identification Team at idmstandards@gdda.govt.nz.
Stage 1 — Introduction and scoping
The first stage of applying the Identification Standards or seeking conformance is to understand which role and standards are relevant.
Understanding identification roles
There are 3 roles when applying the Identification Standards – Relying Party (RP), Credential Provider (CP) and Facilitation Provider (FP).
Most organisations will be a Relying Party at some point in what they do.
Anyone who enrols Entities (people or otherwise) and creates records or accounts for them is a Relying Party.
Detailed description of diagram
This diagram depicts how the elements in identification management work together.
An Entity (for example, a person) wants to get a Credential that they can use to get a service from a Relying Party (for example, an organisation). The Entity goes to a Credential Provider to get an applicable Credential and then either presents their Credential directly to the Relying Party or uses a Facilitation Provider to assist in the presentation.
Descriptions of the roles, artefacts and their relationships
- Entity
- An Entity can be a person or machine that presents a Credential to a Relying Party, during enrolment, providing them with assurance that certain identification management processes have been previously carried out.
- Credential
- A Credential is an artefact that’s established for an Entity. It contains an Authenticator and may also have specific information that’s bound to the Entity.
- Relying Party
- A Relying Party provides services to an Entity and requires 1 or more of the Entity’s credentials to establish information about the Entity, to enable provision of the service.
- Credential Provider
- A Credential Provider establishes Credentials for an Entity to present when enrolling with a Relying Party.
- Facilitation Provider
- A Facilitation Provider provides mechanisms for facilitating the presentation of 1 or more Credentials to Relying Parties.
It’s common to hold more than 1 identification role.
- A Credential Provider will also be a Relying Party when they’re enrolling Entities before issuing their own Credential.
- A Credential Provider will also be a Facilitation Provider if they’re involved in the presentation of their Credentials.
- A Facilitation Provider can become a Credential Provider if they create their own Credential.
Understand which standards apply
The identification role and the processes being carried out indicate which of the 5 Identification Standards should be applied.
Table 1 describes the broad identification processes undertaken by each accountable party and the applicable Identification Standards.
| Accountable parties and processes | Applicable standard |
|---|---|
|
Relying Parties enrol Entities by:
|
|
|
Credential Providers:
|
|
|
Facilitation Providers present credentials by:
|
|
|
Authentication Providers:
|
Stage 2 — Providing evidence and being assessed
The second stage involves gathering evidence about how the individual controls in each relevant standard are being applied, and having that evidence assessed to see that all controls are met.
This process is the bulk of work and time, and is an iterative process involving information and communication back and forth with the assessor.
Risk Assessment
Assessing risk is integral to being able to apply the Identification Standards correctly. Risk assessment determines which Levels of Assurance to apply for certain controls.
While any risk assessment process can be used, more information is available in the following guidance:
Identification risk assessment should be done as early as possible and provided to the assessor. The feedback on these will help to ensure that the conformance process is on the right track.
Privacy impact assessment
Products or services using information will need to manage information privacy risks when the information is processed.
The information in scope may be personal information relating to people, or information relating to non-person Entities that is commercially sensitive or require specific security measures (for example, business details of a company, security information of computer infrastructure, the physical location of protected animals).
Documenting information privacy risks and how they will be controlled is a crucial step to build security and privacy by design into the product or service. Doing this early will help design the product or service correctly, prevent expensive rework later in development and contribute to conformance with several identification controls.
Completing information privacy risk assessments early, such as a Privacy Impact Assessment, helps to guide the development of a product or service. These assessments should also be provided to the assessor as soon as available.
For Privacy Impact Assessments regarding people, the Office of the Privacy Commissioner has guidance on how to complete these and a template to work through the privacy impacts for the product or service being assessed.
Privacy Impact Assessments — Office of the Privacy Commissioner
For non-person Entities, a similar document should be created. It could use many of the same Information Privacy Principles as these are still relevant to non-person Entities.
Applying the relevant standard controls
Applying the controls in each of the relevant standards is the main part of the journey to conformance.
Meeting certain Levels of Assurance can mean changes need to be made to some systems and processes. These may not be easy or fast to implement. If the planned Levels of Assurance cannot be met, decisions will need to be made about the impact of meeting a lower level of assurance.
If the target Levels of Assurance are unable to be met, options include:
- carrying out additional work to reach the target Levels of Assurance; or
- electing to operate at lower Levels of Assurance.
The latter option does not prevent continuing to work on the aspects that need improvement and seeking reassessment later.
Contact the Identification Team for advice at idmstandards@gdda.govt.nz on different options.
Each of the Identification Standards has an implementation guide which provides more information about how to apply the controls and examples.
Documenting evidence for assessment
There are 3 options for documenting evidence for assessment.
1. Notating existing documents
Where the evidence for assessment is in existing documentation, clear cross-referencing to the controls in the Identification Standards is essential. Examples of clear cross-referencing include:
- annotating text with comments that reference the control number being met
- combining information together under headers or sub-headers that reference the control number
- providing a table listing each relevant control and a reference to the section and page number where the evidence of the control being met is documented.
Any information that’s not to be disclosed for the conformance process can be redacted or removed.
2. Creating new bespoke documents
Organisations may wish to extract the relevant information into new documents. If a new document is created, the new document can use the cross-referencing techniques in the section above to evidence how controls are being met.
3. Using our checklists
A series of checklists are available to help with collating evidence. They outline the types of evidence that is needed, list each of the controls and provide space to write how each control is being met.
- Information and Binding Assurance conformance checklist (DOCX, 60KB)
- Information and Binding Levels of Assurance Table template (DOCX, 61KB)
- Authentication Assurance conformance checklist (DOCX, 61KB)
- Credential Establishment conformance checklist (DOCX, 61KB)
- Facilitation Mechanisms conformance checklist (DOCX, 60KB)
Where a qualified assessment was requested, the assessor will not need the detailed documentation used for a full audit. The level of documentation needed for the lighter assessment will be discussed when scheduling an assessment.
You do not need to have all documentation complete for assessment to commence. Documents can be sent progressively, for early feedback on progress.
Being assessed
The assessment process begins when a document or evidence is submitted to the assessor for assessment. An early draft of a document can be sent for feedback before formal assessment begins, if this is made clear to the assessor beforehand.
Documents and evidence will include risk assessments, privacy impact assessments, functional and design documents, checklists or any other documents that describe how the controls are being met.
The assessor will review the evidence as it is submitted and provide progress updates and feedback.
The assessor may require additional information about the service or product being assessed, such as further evidence about how the controls are being met or levels of assurance. Swift responses to requests for more information will ensure that the assessment continues to progress.
Stage 3 — Demonstration and assessment outcome
The third stage involves a demonstration of the service to the assessor and the outcomes from the assessment and demonstration.
If a self-assessment is being undertaken, this stage is not needed.
Doing a demonstration
To confirm that the identification processes within a product or service operate according to the documentation provided, the assessor will request a physical demonstration.
The demonstration will show the lifecycle of the product or service from beginning to end. The assessor will ask for specific aspects of the product and service to be demonstrated.
Examples of what a demonstration will show include:
- the information collection and binding processes
- if the product is a credential, how the credential is issued, revoked and cancelled
- metadata generated by the product or service the collateral and location of where levels of assurance are declared.
Assessment outcome
At the end of the assessment process the organisation being assessed will have an opportunity to discuss the assessment before one of the following final documents is issued.
Advice
For a Qualified assessment, the Identification Team will provide written advice. The advice is not evidence that the identification service or services conform with the standards, but it will indicate how close they’re to conforming, and to what Level of Assurance.
Certificate
Following a successful Audited assessment, an Identification Standards Conformance Certificate will be issued. The conformance certificate will describe:
- the organisation
- the identification service or services provided
- the standards conformed with
- the Levels of Assurance expressions for any assured information or authenticators
- the expiry date of the certificate.
With permission, aspects of the certificate may be published on a public register for others seeking to verify the certificate.
Re-conformance
Both advice and conformance certificate are issued at a point in time. There are several things that may make it necessary to apply for re-conformance:
Certificate expiry
Certificates are only issued for a maximum of 3 years. The Identification Team will advise when expiry is due and arrange for re-conformance. The size of the assessment will depend on whether any changes have been made since the original certificate was issued.
Change made to a product or service
If a change is made to the product or service that was assessed, it may no longer be conformant. A new assessment can be carried out on the aspects that have changed.
Changes to the Identification Standards
The Identification Standards will change from time to time to remain relevant. In some cases, a change may result in the need for re-conformation before the expiry of a certificate. Conforming parties will be consulted well in advance should this occur.
Outcome of a complaint
If the Identification Team receives a complaint about a service or product that brings into question whether it’s conformant, an investigation will be carried out. Should the outcome of the investigation impact the status of a certificate, re-conformance may be required to retain a valid certificate.
We’re here to help
For all enquiries, requests, and assessment booking, please contact the Identification Team at the Government Digital Delivery Agency (GDDA) at idmstandards@gdda.govt.nz.
In addition to advice on conformance, we can also help with the following aspects:
- Reviewing identification risk assessments and suggesting improvements
- Interpreting and applying the Identification Standard controls
- Suggesting alternative ways to design processes
- Advising on options if controls cannot be met.
The Identification Team also provides training and clinics to help develop identification capability. It’s strongly recommended that people seeking conformance undertake the training.
