A Department for Digital, Culture, Media and Sport (DCMS) team is working to enable the use of trusted digital identity products across the UK economy. This means ensuring there are secure digital ways to prove that people are who they say they are, or are entitled to do particular things, without repeatedly having to present a mish-mash of documents and bills.
Right from the start, they have been asking people what they want from these products. They heard time and time again that people want to be able to trust the services they use.
People have to input personal data about themselves and they don’t want to have to wade through pages of incomprehensible terms and conditions to assure themselves it is safe to do so. They want to know rules are in place, that they’re being followed and that there is a way to complain if things go wrong.
Use of digital identities
The use of digital identities can unlock huge economic wins – more than £800 million a year
The use of digital identities can unlock huge economic wins – more than £800 million a year, if they get it right – but they need to be sure that they’re not opening up new risks too. How can they be sure fraud, privacy and cyber security are preserved?
And how can they ensure that the UK gets a range of digital identity products and services, so that everyone who wants to prove their identity digitally can do so, not just people with a smartphone?
UK Digital Identity and Attributes Trust Framework
In answer to these questions, they developed and tested a set of standards and rules, the UK Digital Identity and Attributes Trust Framework.
The framework places rigorous fraud management, privacy, cyber-security and inclusion requirements on organizations, based on robust international standards. It’s been developed in conjunction with the National Cyber Security Centre, as well as other expert stakeholders, such as the ICO.
Their work in this area became reality when they collaborated with the Home Office and Disclosure and Barring Service to allow digital identity services to be used for right to work, right to rent and DBS checks.
The right rules are important
The right rules are important, but only helpful if they know they’re being followed
The right rules are important, but only helpful if they know they’re being followed. They needed a way of making sure providers met the robust standards of the trust framework and knew certification could be used to do this.
They all rely on certification processes to give them peace of mind. Knowing the person fitting the new boiler has a ‘Gas Safe’ certificate means they know they have the knowledge, skills and processes in place to enter the home and install a potentially dangerous appliance.
Knowing that their digital identity product has been certified under the trust framework provides similar reassurance. They don’t need to understand every detail of the standards in place, but they can be sure that an expert has asked all the right questions, and that these experts are subject to checks too.
UK Digital Identity and Attributes Trust Framework
They’ve worked with the UK’s national accreditation body, UKAS, to make sure all identity service providers included in their Digital Verification Services register, which will list organizations with trusted digital identity services, will be formally assessed against the UK Digital Identity and Attributes Trust Framework by Certification Bodies who are all currently undergoing accreditation with UKAS.
They can then be checked again, at any time, through spot audits, fraud audits, exception or surveillance audits, including when any risks are identified in the system.
Certification Bodies doing audits undergo DCMS certification
The Certification Bodies doing the audits have undergone DCMS certification and assurance
The Certification Bodies doing the audits have undergone DCMS certification and assurance, and will be regularly assessed in the future as part of UKAS’s normal processes to ensure they are upholding the standards that they have set out in the trust framework.
UKAS itself is also subject to an internationally-recognized set of checks and balances to ensure it is upholding the highest standards in conducting its work. This international certification and accreditation ecosystem is robust and already underpins almost everything we buy and use in our daily lives.
People assured of secure digital identity products
People can be confident these checks and balances will deliver secure digital identity products that people and businesses can trust and use to make their lives easier.
The well-established system of accreditation and certification to which UKAS is so central, will underpin this trust, ensuring that the digital identity products used comply with the standards they’ve created to be as secure as can be.
