We’re Tracking the Future of Security

Tag: Digital Identity

  • UK Opens Testing for Machine-Readable Digital Verification Services Register

    UK Opens Testing for Machine-Readable Digital Verification Services Register

    The UK’s Office for Digital Identities and Attributes has invited digital verification service providers to help test infrastructure that will make the government register of approved services machine-readable. The initiative is intended to let businesses and public authorities check registration status securely and at scale instead of relying only on manual lookups.

    Testing covers two technical models

    OfDIA described an API model for direct connections and secure data exchange, along with a credential model that would allow a service to present verifiable evidence from a digital wallet. The office plans to test provider onboarding in October 2026 and interview participants about readiness for integration testing.

    The government has also published technical integration material. OfDIA said testing of both models will continue later in the year; the announcement is an invitation to participate, not a declaration that production integration is complete.

    Automated trust checks need controlled evidence

    Machine-readable registers can reduce manual verification, but relying organizations still need versioning, availability monitoring and an auditable response when a provider’s status changes. Identity teams should treat register data as one control within a broader assurance process. SectechMedia follows related developments in its access control and identity coverage.

    Sources

  • Sri Lanka Plans In-House Digital ID Pilot While Full Procurement Remains Delayed

    Sri Lanka Plans In-House Digital ID Pilot While Full Procurement Remains Delayed

    Sri Lanka is preparing a limited in-house pilot of its digital identity program while procurement for the full national system remains unresolved. Reporting on the government plan says bids for the master systems integrator role exceeded the Indian grant allocated to support the broader deployment.

    The pilot separates early testing from full procurement

    The planned Sri Lanka Unique Digital Identity system is based on the open-source MOSIP architecture. Officials are pursuing a phased approach so that identity issuance and operational testing can begin while financing and procurement discussions continue. Earlier public statements placed initial issuance before the end of 2026.

    The larger program involves biometric enrollment, identity lifecycle management and integration with government services. A limited pilot can test registration workflows and service interoperability, but it does not by itself resolve national-scale capacity, privacy governance, procurement or long-term support requirements.

    Identity infrastructure needs transparent acceptance criteria

    Before expansion, program owners should publish measurable controls for biometric quality, duplicate detection, consent, audit logging, credential recovery and data access. Independent security testing and clear retention rules are important when a pilot becomes a production identity platform. SectechMedia follows related systems in its access control and identity coverage.

    Sources

  • UK CertifID Trust Mark Goes Live With Five Digital Verification Providers

    UK CertifID Trust Mark Goes Live With Five Digital Verification Providers

    The United Kingdom has put its UK CertifID trust mark into operational use, with five digital verification service providers becoming the first organizations authorized to display it for registered services. The mark is intended to help users identify providers assessed against the national digital verification services trust framework.

    The mark is tied to registered services

    A government digital identity update names Orchestrating Identity, TrustID, CDD Services, Mistho and GBG as the first providers. Eligibility is linked to certification against version 1.0 of the trust framework and registration under the country’s digital identity governance system; it is not a general endorsement for every product offered by a company.

    Government usage guidance sets conditions for how the mark may appear and is designed to prevent presentation that could mislead customers about the scope of certification. The launch follows the broader move toward reusable digital verification services in regulated and public-facing transactions.

    Relying parties still need technical due diligence

    A visible trust mark can support procurement and user confidence, but organizations must still assess authentication strength, privacy controls, recovery processes, fraud monitoring and interoperability for each deployment. Contracts should identify exactly which registered service is being used. SectechMedia follows related developments in its access control and identity coverage.

    Sources

  • OpenID Foundation Announces First Certified OpenID4VP and OpenID4VCI Implementations

    OpenID Foundation Announces First Certified OpenID4VP and OpenID4VCI Implementations

    The OpenID Foundation has announced the first organizations to self-certify implementations of OpenID for Verifiable Presentations and OpenID for Verifiable Credential Issuance with the High Assurance Interoperability Profile. The milestone gives wallet, issuer and verifier suppliers a public conformance record for protocols increasingly used in digital identity programs.

    Certification covers several ecosystem roles

    OpenID4VCI defines how verifiable credentials are issued, while OpenID4VP supports presenting selected claims to a verifier. The HAIP profile narrows implementation choices for higher-assurance interoperability. The Foundation said the first implementations passed its conformance tests, with results available on public record.

    Initial certifications cover wallet, issuer and verifier roles across multiple providers. Independent reporting noted that the specifications are already being adopted in national and regional digital identity initiatives, increasing the need for repeatable testing rather than one-off bilateral demonstrations.

    Conformance does not replace deployment assurance

    Buyers should verify which protocol role, profile and software version a certificate covers. Production programs still need privacy review, key management, lifecycle controls and testing across the complete credential chain. SectechMedia follows related developments in its access control and identity coverage.

    Sources

  • IRS Considers AI Triage for Identity-Theft Backlog Nearing 257,000 Cases

    IRS Considers AI Triage for Identity-Theft Backlog Nearing 257,000 Cases

    The US Internal Revenue Service is considering whether artificial intelligence could help assess the complexity of identity-theft cases and route them to appropriately trained employees. The proposal appears in the agency’s response to a Treasury Inspector General for Tax Administration audit; the report does not say that an AI triage system has already been deployed.

    Most delay occurs before assignment

    The audit found that identity-theft victims waited an average of roughly 20 months for resolution across fiscal years 2023 through 2025, compared with the agency’s 120-day objective. Cases in the audit sample spent most of that time in unassigned inventory. The unresolved workload had fallen from earlier levels but still stood near 257,000 cases in May 2026.

    TIGTA recommended evaluating case complexity before assignment and moving claims into active processing more quickly. The IRS agreed to study whether AI could support that work rather than divert experienced identity-theft staff to screen incoming cases.

    Automation needs auditable safeguards

    Any triage model used for identity-fraud cases would need documented routing criteria, human review, bias testing and an appeal path for misclassified claims. Performance should be measured against resolution time and error rates, not only throughput. SectechMedia follows related controls in its identity and access coverage.

    Sources

  • NIST Finalizes Guidance for Protecting Online Identity and Access Tokens

    NIST Finalizes Guidance for Protecting Online Identity and Access Tokens

    NIST has finalized implementation guidance for protecting online identity and access tokens from theft, forgery and misuse. Tokens allow applications and services to recognize authenticated users without repeatedly asking for credentials, but stolen or forged tokens can let an attacker impersonate a legitimate account while bypassing normal sign-in checks.

    The guidance uses a reference cloud implementation

    The publication describes a zero-trust architecture built around commercial and open-source technologies. It covers token discovery, visibility, validation and enforcement across identity providers, applications and cloud services. NIST developed the practice guide with CISA and industry collaborators through the National Cybersecurity Center of Excellence.

    The final material emphasizes that token protection is not limited to one product. Organizations need coordinated telemetry and policy enforcement across the systems that issue, receive and validate tokens.

    Operations should test revocation and misuse detection

    Identity teams should inventory token types, document trust relationships, reduce unnecessary token lifetime and confirm that revocation works during an incident. Monitoring should identify unusual issuance, replay and use from unexpected devices or locations. Those controls complement phishing-resistant authentication rather than replacing it. SectechMedia follows related developments in its identity and access-control coverage.

    Sources

  • ID4Africa Sets Connected Digital Identity Ecosystems as 2027 AGM Theme

    ID4Africa Sets Connected Digital Identity Ecosystems as 2027 AGM Theme

    ID4Africa has selected connected digital identity ecosystems as the theme of its 2027 Annual General Meeting. The program is expected to examine how foundational identity, credentials, payment systems and public or private services can work together without turning interoperability into uncontrolled data sharing.

    The focus moves from enrollment to practical use

    Many identity programs have concentrated on registration and credential issuance. The 2027 theme emphasizes what happens after enrollment: how a verified identity supports healthcare, finance, social protection, travel and other services through trusted connections.

    Useful integration requires more than a shared identifier. Relying parties need common assurance language, secure interfaces, governance rules and a method for handling corrections or revocation. Systems also need to work for people with limited connectivity or devices.

    Connections increase both utility and dependency

    A connected ecosystem can reduce repeated proofing and make services easier to access, but failures can propagate across multiple organizations. Programs should test degraded operation, recovery, privacy boundaries and alternatives for users who cannot complete a digital transaction.

    The agenda extends the interoperability questions covered by SectechMedia’s Access Control & Identity section. Successful identity infrastructure should make trust decisions understandable, preserve an audit trail and avoid treating every service as entitled to the same data. The 2027 meeting is scheduled to bring government, industry and civil-society stakeholders into that design discussion.

    Sources

  • Ireland Expands Public Services Card Role Amid National ID Debate

    Ireland Expands Public Services Card Role Amid National ID Debate

    Planned changes to Ireland’s Public Services Card have reopened debate about whether the credential is becoming a national identity system. Parliamentary discussion on September 22 addressed broader acceptance of the card and the governance implications of using one credential across more services.

    Expansion changes the assurance and governance questions

    A credential originally designed for access to public services can take on a different role when more organizations rely on it for identity evidence. That expansion raises questions about purpose limitation, eligibility, alternatives, data sharing and the consequences of a failed or revoked credential.

    Supporters argue that a reusable card can reduce repeated identity checks and simplify service access. Critics focus on whether the legal basis, transparency and oversight are sufficient when the same identity infrastructure reaches beyond its original administrative context.

    Identity programs need clear boundaries and fallback paths

    Operators should document which attributes are verified, which organizations may rely on them and what data is exchanged during a transaction. A card presented as proof should not automatically expose unrelated information. Citizens also need a workable route when a card is lost, disputed or unavailable.

    The debate is relevant to broader Access Control & Identity programs. Reuse can improve convenience, but only when assurance, consent, auditability and redress remain visible. Technical interoperability should follow a defined policy model rather than quietly expanding the credential’s function through individual service decisions.

    Sources

  • GSMA Roadmap Links Africa’s Digital ID Growth to Closing the Mobile Usage Gap

    GSMA Roadmap Links Africa’s Digital ID Growth to Closing the Mobile Usage Gap

    A new connectivity roadmap from the GSMA and the Partnership for Digital Access in Africa argues that network coverage alone will not deliver inclusive digital identity and public services. The analysis says hundreds of millions of people live within mobile-broadband coverage but do not use mobile internet.

    The usage gap is larger than the coverage gap

    The roadmap reports that roughly 906 million people, about 60 percent of Africa’s population, were within mobile-broadband coverage but remained offline in 2025. It draws on 11 countries and shows that the main barriers differ by market. In some places infrastructure is still the constraint; elsewhere device cost, electricity, skills, trust or the usefulness of available services matters more.

    That distinction is important for digital identity programs. A credential or government portal may be technically available, yet remain inaccessible to a person who cannot afford a smartphone, maintain connectivity or use the service confidently. Expanding online identity without addressing those conditions can reproduce offline exclusion.

    Digital participation requires coordinated investment

    The roadmap calls for affordable devices, migration from legacy networks, reliable energy, shared rural infrastructure and services that provide practical value. Governments planning digital-ID access should also retain assisted and offline channels, test accessibility and avoid making essential services dependent on one device or network. SectechMedia follows identity infrastructure in its access control and identity coverage.

    Sources

  • EU Sets Digital ID Rules for Cross-Border Health Data Exchange

    EU Sets Digital ID Rules for Cross-Border Health Data Exchange

    The European Union has adopted implementing rules for identity, authentication and interoperability in cross-border electronic health-data exchange. Commission Implementing Regulation (EU) 2026/2099 establishes technical and organizational requirements intended to support trusted access across national systems.

    Identity assurance becomes part of the exchange architecture

    Cross-border health services must determine who is requesting or providing data, which role the person holds and whether the relying system can trust the asserted identity. The regulation connects those checks with common interoperability and security requirements rather than treating authentication as an isolated login feature.

    The rules sit within the European Health Data Space framework and are designed to support consistent exchange while national identity and healthcare infrastructures remain different. Implementers must therefore map local credentials and professional roles into a shared trust model without weakening national safeguards.

    Deployment requires governance beyond technical connectivity

    Operators should document identity proofing, credential lifecycle, role assignment, consent and audit responsibilities across organizational boundaries. A successful connection does not by itself prove that the correct person received the correct level of access. Exception handling and revocation must work across the same chain.

    The regulation is relevant to broader Access Control & Identity programs because it demonstrates how identity assurance, authorization and interoperability meet in a regulated environment. Health-data exchange teams should test both normal and degraded workflows, preserve decision records and verify how trust changes when a credential or professional role expires.

    Sources