Identity risk and authentication strength
The recommended approach for starting business process design is to undertake an identity related risk assessment. This is used to determine which evidence of identity (EOI) process, if any, is required for the customers of the agency online service.
The Department of Internal Affairs has produced Identification Management Standards (external link) and are able to work with agencies to determine the identity related risks through a risk assessment. This is a free service for agencies. The final outcome of the formal identity related risk assessment will be the identification of an identity risk category.
When implementing an online service agencies are also required to examine possible threats from sources such as malicious software (e.g. viruses), hackers, politically motivated groups, criminals, users (accidental and intentional), system administrators (accidental and intentional), natural disasters and local environment problems and hardware failures.
The risk assessment indicates the appropriate corresponding login strength.
|Low risk||Low strength||Username and password|
|Medium risk||Medium strength||Username, password, and RealMe code by TXT, or by Authenticator app|
|High risk||High strength||This type is currently not supported|