This webinar discussed the process for becoming approved as conformant with NIST 800-63-3 under Kantara Initiative. It covered an overview of Kantara's Identity Assurance Framework and approval process, which involves an independent third-party assessment, ARB review, and board ratification. Representatives from assessment companies and identity providers discussed their roles in assessments and how approval helps organizations. The webinar provided information on what is assessed under each part of NIST 800-63-3 and best practices for the assessment process.

1. What does it take to be Approved as
NIST 800-63-3 conformant?
WEBINAR 2020-07-15
Ethics & Conformance TrustMarked

2. Agenda
1. Welcome – Colin Wallis, Kantara’s Executive Director
2. Identity Assurance Trust Framework Overview and Approval
process - Ruth Puente, Kantara's Assurance Operations Director
3. Kantara Assessment - Ray Kimble, Kuma's Founder & CEO
4. Role of the Assurance Review Board in the Approval process
- Leif Johansson, ARB Chair
5. How do you see Kantara's approval helping your organization
and its impact in the market? - Blake Hall, ID.me's Founder & CEO
6. Q&A session moderated by Colin Wallis
7. Wrap-up by Colin Wallis

3. Identity Assurance Trust Framework and Approval process
Ruth Puente, Kantara's Assurance Operations Director
Ethics & Conformance TrustMarked

4. Kantara’s Identity Assurance Framework (IAF)
• Kantara Initiative is a Trust Framework Provider since 2010, which accredits Assessors and Approves Service
Providers based on the agreed Service Assessment Criteria.
• Approval is based on independent third-party assessments, performed by Kantara-Accredited Assessors, of the
subject services, to determine those services’ conformity to the applicable criteria.
Kantara is the only organization that provides Third Party Assessment against the primary NIST
standard for identity.

5. Kantara Approval Processes
Initial
Application
• Scope
• Application package: Statement of Criteria Applicability; Specification of a Service Subject to Assessment (S3A);
Application form.
• ARB Review
3rd
Party
Assessment
• Accredited Assessor conducts triennial assessment relative to appropriate Service Assessment Criteria and
produces a Kantara Assessor Report (KAR).
• Applicant works with the Assessor to address non-conforming service areas.
Approval
Application
•Application package following assessment and a finding of conformity: Kantara Assessor’s Report (KAR), Statement of
Conformity (SoC), detailed Service Subject to Assessment (S3A) and updated application form.
•ARB Review
Decision
• ARB Recommendation
• Board of Directors ratification of approval
• Issuance of 3-year cycle Trust Mark; Trust Mark License Agreement
Surveillance
• Annual Conformity Reviews
• Unscheduled assessments
• Changes that may affect approval
https://kantarainitiative.org/trustoperations/service-provider-approval/

6. Kantara Assessment
Ray Kimble, Kuma's Founder & CEO
Ethics & Conformance TrustMarked

7. KANTARA NIST 800-63-3 ASSESSMENT

8. What is assessed?
• NIST Special Publication 800-63-3A (Enrollment and Identity Proofing)
• NIST Special Publication 800-63-3B (Authentication and Lifecycle Management)
• NIST Special Publication 800-63-3C (Federation and Assertions)
2

9. 800-63-3A – Enrollment and Identity Proofing
• IAL 1
• CSP shall not validate and verify attributes
• IAL 2 (remote or in-person)
• Allows for remote and in-person proofing
• Once piece of SUPERIOR or STRONG evidence OR
• Two pieces of STRONG evidence OR
• One piece of STRONG evidence plus two pieces of FAIR evidence
• IAL3 (in-person or supervised remote)
• Two pieces of SUPERIOR evidence OR
• One piece of SUPERIOR evidence and one piece of STRONG OR
• Two pieces of STRONG and one piece of FAIR evidence
3

10. 800-63-3A – Enrollment and Identity Proofing
• Strengths of Evidence (Driver’s License, SSN, Phone number, etc)
• Fair
• Unique identifier or Photo/biometric
• Strong
• Issuing source of evidence confirmed the claimed identity through written procedures
• Has it’s written procedures subjected to recurring oversight by regulatory or publicly
accountable institutions
• Unique identifier
• Full name match
• Photo, Biometric or existing AAL2/IAL2 service
• Superior
• Written procedures, recurring oversight, visually identified
• Unique identifier, full name match
• Photo and Biometric and protected digital information
4

11. 800-63-3A – Enrollment and Identity Proofing
• Validating Identity Evidence
• Fair
• Attributes confirmed as valid by comparison to held or published issuing or authoritative
source Or
• Has confirmed as genuine using appropriate technologies Or
• Confirmed as genuine by trained personnel Or
• Confirmed as genuine by confirmation of the integrity of crypto security features.
• Strong
• One of the above plus comparison with held or published information
• Superior
• All of the above.
5

12. 800-63-3A – Enrollment and Identity Proofing
• Verifying Identity Evidence
• Strong
• CSP shall confirm applicant’s ownership of claimed identity by
• Physical comparison to the strongest piece of evidence Or
• Biometric comparison
• Superior
• Both
6

13. NIST 800-63-3B (Authentication and Lifecycle
Management)
• AAL 1
• Either single-factor or multi-factor authentication
• Requires claimant prove possession and control of the Authenticator
• AAL 2 (remote or in-person)
• Proof of possession and control
• Two distinct authentication factors are required
• Approved crypto techniques are required
• AAL3 (in-person or supervised remote)
• Requires proof of possession of a key through a crypto protocol
• Hardware-based authenticator and an authenticator that provides verifier impersonation
resistance
• Proof of possession and control
• Two distinct authentication factors are required
• Approved crypto techniques are required
7

14. NIST 800-63-3B (Authentication and Lifecycle
Management)
• Consistent identifier for subject and identifier
• MFA or 2 Single Factors
• Multi factor OTP device
• Multi factor Crypto device or software
• 2 single factors
• Memorized secret authenticator plus one of
• Look-up secret
• Out of band device
• Single-factor OTP device, Crypto software (FIPS 140-1) or device
• Data Retention schedule, privacy controls, etc
8

15. Assessment Process
ØEngage with one of the certified third-party assessors
ØAssessment typically begins with evidence collection and then quickly moves into analysis
ØTypical assessments take any where from 4-6 weeks
ØAssessment cycle is the initial full certification; followed by annual conformity reviews
9

16. Best Practices
• Understand your need for conducting the assessment
• Customer requirement
• Competitive Advantage
• Maturity Assessment
• Review the NIST 800-63-3 guidelines and Kantara materials to gauge your readiness or talk to an
assessor
• Have your documentation ready to go for the assessment
10

17. Contact Information
Raymond Kimble
Founder and CEO
Ray.Kimble@kuma.pro
11

18. Role of the Assurance Review Board in the Approval
Leif Johansson, ARB Chair
Ethics & Conformance TrustMarked

19. The Assurance Review Board (ARB)
● Tom Barton (InCommon/Internet2)
● Jamie Clark (OASIS)
● Nathan Faut (KPMG)
● Leif Johansson (SUNET - ARB Chair)
● David Temoshok (NIST)
● Richard Trevorah (T-Scheme)
● Ken Dagg (independent, IAWG liason - non-voting)
● Richard Wiltshire (Zygma, technical advisor - non-voting)

20. The ARB scope & composition
1. Review applications and make recommendations to the Board of Directors
2. Provide oversight over the Kantara Trust Program Operations
https://kantarainitiative.org/trustoperations/arb/arb-charter/

21. The ARB day-to-day operations
● Meets every Monday
● Oversight and process issues are discussed by the full ARB
● Reviews are conducted by voting members in recused sessions

22. A typical ARB review (service)
● Service organization provides supporting documentation and review letter (KAR) produced by the designated
auditor
● ARB review normally takes 1-2 meetings - anything longer indicates a problem or clarification that needs
addressing.
● Secretariat communicates ARB questions with Service
● Issues that require more than 3-4 round-trips are typically dealt with by direct calls with Service representatives.
● ARB does an internal retrospect of reviews that have resulted in many issues and will occasionally ask the IAWG
to consider claritifications or amendments to the current SACs

23. A typical ARB review (assessor)
● Assessor organization provides supporting documentation and review letter
● ARB assessor review normally takes 4-5 meetings
● It is normal and expected for ARB to ask both new and returning assessors lots of clarifying questions to ensure
trust in the assessor.

24. How do you see Kantara's approval helping
your organization and its impact in the market?
Blake Hall, ID.me's Founder & CEO
Ethics & Conformance TrustMarked

25. Secure & Frictionless Authentication
July 2020 | Kantara

26. 2
NetworkedSites
CredentialPortability
Credential Identity & Authentication
Login with Facebook
Login with Google
Login with Amazon
ID.me fills the trusted
and portable role
Digital Identity is Broken
Portable logins aren’t trusted and trusted logins aren’t portable
Confidential & Proprietary Information of ID.me

27. At the same time,
identity underpins
literally every
transaction in society
3
Civic Benefits
Employment
Legal Rights
Education
Healthcare
Financial Services
Commerce
Streaming Subscriptions
Transportation
Licensing
Property
Signatures/Notarization

28. Advertising
companies run
portable logins
and our thesis is
users don’t, and
won’t, trust them – will
Facebook be the
identity utility for
voting?
No. They are blocked
by their positioning
and business model.
4
CONSUMERTRUST
H E A LT H C A R E
A P P S
O N L I N E
V O T I N G A P P S
F I N A N C I A L
S E R V I C E S
A P P S
Confidential & Proprietary Information of ID.me

29. Kantara’s Trust Mark Enables Organizations to Rely Upon ID.me:
Enabling a standardized network for portable digital credentials
5
Payments Pre-Visa & MC (1958) Payments Post-Visa & MC
DRIVEN BY NEED FOR:
Trust
Branding
Ubiquity
Network
Competition
Standards
Liability Rules
Confidential & Proprietary Information of ID.me

30. 6
FEDERAL GOVERNMENT
RETAIL & CONSUMER TECHNOLOGY
STATE AND LOCAL GOVERNMENT
HEALTHCARE & FINANCIAL SERVICES
Leading brands trust ID.me to streamline user authentication
and remove friction and fraud from their business
Confidential & Proprietary Information of ID.me

31. ID.me is the only authentication provider in the American market
that has the ability to identity proof all users via all channels
ONLINE, SELF-SERVE
IN-PERSON PROOFING
WITH TRUSTED REFEREE
Trained agent proofs user to
NIST IAL2 via video chat
User visits a healthcare facility
or tax preparer and binds the
in-person visit to a digital ID
MOST COMMON
If user hits a roadblock
verifying their identity online.
VIRTUAL IN-PERSON PROOFING VIA
VIDEO CONFERENCE CHAT WITH AN ID.ME
TRAINED CALL CENTER AGENT
RELIEF VALVE
Confidential & Proprietary Information of ID.me
EXCEPTIONS OPPORTUNISTIC
7

32. 8
Enabling all users to prove their identity online significantly reduces public
sector agencies’ total cost of ownership when online authentication fails
$54Call Center Proofing
$89In-Person Proofing
Source: GAO Report on Taxpayer Authentication https://www.gao.gov/assets/700/692712.pdf
Confidential & Proprietary Information of ID.me

33. Enabling Secure & Efficient
Transactions for Everyone
Goal is to increase access for
legitimate users and to reduce fraud:
Define an appropriate authentication policy based
on the transaction’s risk and regulatory requirements
Enable users to choose between a custom branded
verification path and ID.me’s interoperable network
Increase revenue and reduce fraud and operational
cost by eliminating friction
9Confidential & Proprietary Information of ID.me

34. Thank You!
Blake Hall
About ID.me
ID.me is the next-generation digital identity platform that enables trusted and
convenient interactions between individuals and organizations. ID.me
provides seamless online identity verification for government, financial
services, and healthcare to facilitate access to high value services online and
keep them safe from fraud. The platform brings together best-in-class identity
and fraud vendors into a comprehensive, easy-to-deploy solution for
partners. For more information, visit www.ID.me.
Founder & CEO
O: 703-639-0052
blake@ID.me
Twitter: @blake_hall

35. Questions & Answers
moderated by Colin Wallis, Kantara’s Executive Director
Ethics & Conformance TrustMarked

36. Wrap-up
Colin Wallis, Kantara’s Executive Director
Ethics & Conformance TrustMarked

37. Nurture. Develop. Operate.
– that’s what we do!
Contact: Ruth Puente, Assurance Operations Director ruth@kantarainitiative.org
Website: www.kantarainitiative.org
Twitter: @KantaraNews
Newsletter sign-up: website header and footer
Ethics & Conformance TrustMarked