Area

Feedback

Roles

Need to be more granular to reflect actual marketplace roles

Proofing

Transparency of validation and verification techniques is required to allow relying parties to be confident in IDs provided and to filter out techniques that to not meet their risk appetites (e.g., KBVs). How often reusable IDs need to be revalidated should be addressed.

Level of Assurance

A risk matrix tool should be introduced to allow relying parties and schemes to assess select the right combinations of levels of confidence and levels of protection to meet their use cases.

Schemes

The obligations of commercial schemes under the framework should be explored. The framework should remain light touch in these areas but may want to ensure some areas such as inclusion, fraud and security are addressed.

Inclusion

The framework needs a strategy for achieving inclusion. Separation of roles to allow for inclusion specialists and an obligation on commercial schemes to drive inclusion are proposed. Access to government data should be focussed on non-document bases sources (HMRC, DWP, Councils, NHS) from an inclusion point of view. Vouching must be extended to incorporate Verification of the user, not just Validation.

Fraud Management

More detail is needed on the shared signals approach. OIX has suggests a set of collaborating fraud management suites that share signals should be introduced, along with an order of attack for signals introduction.

Trust Register

These needs including in the framework and careful scoping. The framework should not attempt to govern relying party trust through the trust registry, this should be left to schemes.