Trusted Referee
A trusted referee is a person vetted and trained to make risk-based decisions about an applicant's identity proofing case when that applicant cannot meet the normal requirements of an Identity Assurance Level (IAL). NIST SP 800-63A-4 defines the role as an agent of the credential service provider (CSP), a third-party service, or a relying party, and lets CSPs offer referees in on-site or remote attended sessions.
Referees are the exception path for people the automated flow rejects: no accepted ID document, a recent name change that breaks attribute matching, a failed face comparison, or a failed fraud check in an unattended remote session. NIST says CSPs SHOULD offer them for IAL1 and IAL2, and when they do, the CSP must tell the public the service exists, document which failures qualify, train referees in document inspection, facial comparison and social engineering, reassess them annually, and record every decision. A referee is not an applicant reference, who vouches for the applicant rather than deciding for the CSP. The design tension is plain: the path that keeps proofing accessible is also the one a fraudster will aim for, so the training and logging requirements are the control.
See also: IAL, identity verification, NIST 800-63, identity verification vendors
Related on Start with Identity
- GlossaryCJIS Security Policy
The CJIS Security Policy is the FBI's set of minimum security requirements for anyone who accesses, processes, stores or transmits criminal justice information
- GlossaryFederation Assurance Level (FAL)
NIST 800-63C levels describing how strongly a federated login protects the assertion an identity provider (IdP) sends to a relying party (RP). FAL1: the IdP sig
- GlossaryOSCAL (Open Security Controls Assessment Language)
OSCAL (Open Security Controls Assessment Language) is a NIST-led set of machine-readable formats, in XML, JSON and YAML, for writing down security controls and
- BlogSlugFest: npm trusted publishing trusted repository names, so reclaimed names could publish
Bloom Security found npm trusted publishing matched GitHub repositories by owner/name until first publish, letting anyone who reclaimed a renamed or deleted slu
- VendorThales SafeNet Trusted Access
strong