Introduction

Information Assurance is about the quantity and quality of information collected in relation to an Entity. It applies whether the information is being collected during the initial enrolment of the Entity or updated during subsequent interactions. Information Assurance does not make any judgement as to whether the Entity is using their own information or not, this is covered as part of Binding Assurance.

Definitions for key terms used in this guidance can be found in Identification terminology.

This is living guidance and will be evolved and expanded over time to meet the needs of users.

Guidance

Objective 1: Information risk is understood

Applying a risk-based approach to information assurance (IA) helps to identify the aspects of information that drive the level of risk. Understanding this enables the development of a wide range of mitigation strategies.

IA1.01 Guidance — risk assessment

Any robust risk assessment process may be used to identify the information risk posed. The guidance provided in Assessing identification risk has been developed to improve the quality of this assessment.

Assessing identification risk

A workbook has also been developed to help with undertaking an identification risk assessment and to provide the optimum level of assurance as an output. For a copy email identity@dia.govt.nz.

If the assessment is being used for assessing the risk of providing a credential, consideration needs to be given to the accumulated risk posed by the reuse of the credential.

Objective 2: Information is protected

Some information collected has little or no purpose for the service or transaction being provided. This is often due to the evolution of the service or transaction over time, where information becomes redundant, or through a lack of detailed scrutiny of the information being collected.

There are instances where information collection has been legislated.

The over-collection of information, especially identifying attributes, increases the likelihood of privacy breach or identity theft when that information is exposed.

For every piece of information collected, identify the purpose it serves. Also think about whether the full value is needed, or a derived value is enough. For instance:

• collecting date of birth when only confirmation of being over 18 is required
• collecting full address when just the town/city or postal code is enough
• collecting officially registered name when preferred (legal) name is enough.

Credential Providers may collect and/or link to a broad range of information to enable holders to use their credentials for a wide range of interactions. However, the establishment of these types of credentials creates large sets of information that will become targets for criminals. Even if these are in distributed systems, access is still available through the Entity’s Authenticator and any Credential management interface.

IA2.01 Guidance — distinctive information

It’s desirable that there’s enough distinct information in an Entity’s Information for it to be determined as separate from another’s, without the need to rely on an assigned reference. This means that should anyone need to identify a specific set of Entity Information it can be done without the need to know the assigned reference.

Collecting information for distinction does not mean gathering additional identifying attributes other than those that serve a specific purpose.

Distinct Entity Information does not ensure that an Entity is only enrolled once.

IA2.02 Guidance — justifiable need

This is the application of Information privacy principle 1 of the Privacy Act 2020.

The collection of information, especially identifying or otherwise sensitive information, without a purpose is both intrusive and poses risks to privacy, security and identity theft.

When collecting information ensure that there’s an identified need for the information. This also includes considering if the full value of a piece of information is needed or just a value derived from the information.

IA2.03 Guidance — retention

This is the application of Information privacy principle 9 of the Privacy Act 2020.

Information is often collected for decision making purposes. Once the decision has been made, is the information still required or can a record or reference be kept instead?

This is an extension of the previous control, consider if the information collected needs to be retained once enrolment is complete.

IA2.04 Guidance — discarding

This a further application of Information privacy principle 9 of the Privacy Act 2020.

It’s important that any information collected where the sole purpose is to provide a link to another source in order to verify something is discarded once this has occurred. If there’s a reason it needs to be retained, then IA2.03 applies.

Objective 3: Information is accurate

Information accuracy is essential for effective information exchange and decision making. This is distinct from whether the information belongs to the Entity who claims it is theirs. This is covered in Binding Assurance.

Currently, there are limited resources to support standards in information accuracy. Planning is underway for a resource that defines information and data, their formats and the various authorities for the values associated with them. A link to that resource will be added when it becomes available.

IA3.01 Guidance — data formats

Using recognised and consistent data format standards makes the exchange of information easier, increases the likelihood of matching and the quality of information in systems.

For lists of standards that could contain data formats, see:

• Register of government data content requirements
• Government digital standards catalogue.

IA3.02 Guidance — determine level of information assurance

The Identification risk assessment process can be used to determine the level of information assurance (IA) required for information collected.

Alternatively, use an analytical assessment considering the following:

• the key business drivers and outcomes
• risk of financial loss or liability
• risk to the privacy, standing, reputation or safety of people
• harm to agency programmes or the public interest
• any direct downstream effects — this could include other parties that will rely on the outcome (for example, a credential).

IA3.03 Guidance — information verification

Evidence for the purposes of information accuracy typically includes 1 or more of the following:

• evidence containing or linking to Entity Information from another context (for example, credentials)
• databases and registers containing Entity Information
• information or statement provided by the Entity
• information or statement provided by a trusted 3^rd party (for example, another Entity like someone acting on behalf of another).

The more critical the information for decision making and the risks associated with it, the higher the level needed and therefore the quality of the source.

At level 1 the information is collected from the Entity and is accepted without any attempt to seek assurance. However, there are several instances where the Entity is the authority for their information which makes these instances also qualify as level 4. This is important to note if there’s an intention to become a Credential Provider, in which case Federation Assurance also applies. 

At levels 2 and 3 information is copies taken at a moment in time. The criticality of the information for decision making and the likelihood the information will change over time will be considerations at these levels.

Level 4 represents the most up-to-date and accurate source of information.

A resource including authorities and evidence levels is planned.

Refer to the guide Using documents as evidence for more information.

If the information is not verified against any evidence, then the level achieved is usually 1. Where the Entity is the authority, it may be acceptable to consider the level to be 4.

IA3.04 Guidance — level assumptions

If the Credential Provider has not indicated the level(s) of assurance of their credential, it can be risky to assume what these might be. Ideally, they should be treated as level 1. However, until declaration of levels of assurance becomes embedded, a pragmatic approach to accepting Credentials as having higher levels will need to be taken.

Estimation of levels of assurance, where not declared, need to be done in conjunction with the Credential Provider and expertise in the application of the Identification standards.

Objective 4: Quality of evidence

The quality of the evidence determines an aspect of the level that cannot be achieved by the assessment of accuracy alone. A Credential Provider can issue Credentials and provide services for directly accessing their databases and registers but if there’s no check that they are using the genuine evidence, the levels declared will not be achievable.

IA4.01a Guidance — quality of Credentials or databases

The quality of the evidence needs to be consistent with the level of information assurance (IA) required.

IA4.01b Guidance — quality of statements made by the subject or a 3^rd party

The quality of statements made by subjects or 3rd parties are based on the pressure to not be false. There are various ways to apply this pressure, including penalties such as fines or imprisonment.

The Criminal Procedure Act 2011 provides an example of levels that can be applied to penalties.

Criminal Procedure Act 2011 — legislation.govt.nz

However, the context in which the levels need to be applied and what other penalties are available will need to be considered for the context.

IA4.02a Guidance — status of Credentials and databases

Establishing if evidence has a status of suspended or revoked can be difficult if it’s not online and in real time. There are various services that provide catalogues of compromised evidence and Credential Providers also may provide a service for checking a credential (often a document) is still valid.

An expiry date on a document does not necessarily mean it has been revoked or suspended for all the aspects for which it may provide evidence.

IA4.02b Guidance — status of statements

Unlike Credentials and databases there are unlikely to be registers for checking the status of statements. The only equivalent will be to look for other statements or evidence that might contradict the statement that has been made.

When a contradiction is noted, further investigation is required.

Objective 5: Verification integrity is maintained

Trust in processes, especially when they are relied on by others, is enhanced by other activities. Undertaking counter fraud steps, when appropriate, and investigating complaints and anomalies also help to build trust. 

IA5.01 Guidance — counter fraud

Counter fraud techniques are those activities that contribute to information assurance after the decision to accept evidence and the enrolment of the Entity.

For more information refer to guidance on Counter fraud techniques.

IA5.02 Guidance — investigation

Regardless of the way in which information assurance is carried out, it’s important to keep good records. The ability to investigate the processes is a contributing element to building trust in those processes.

What and how much information is recorded about the processes undertaken will depend on the risk behind the need for enrolling the Entity plus any requirements under legislation, such as the Public Records Act 2005.

Related advice

If there’s an intention to provide information assurance or other identification services to other parties, the requirements for Federation Assurance should also be applied.

The following resources are also related to this topic:

• Using documents as evidence
• Good practice guidance for the recording and use of personal names
• Counter fraud techniques.

Contact

Te Tari Taiwhenua Department of Internal Affairs
Email: identity@dia.govt.nz