https://dataingovernment.blog.gov.uk/gov-uk-verify-service-assessment/
GOV.UK Verify - Service Assessment
The GOV.UK Verify service allows users to prove their identity when accessing digital services, without having to send items in the post or attend a counter service in person. This means people can safely access their data and perform transactions when using digital public services, and government services can be confident to a defined level of assurance that a user is who they say they are. It helps government digital service providers reduce the risk of user’s data and services being exposed to the wrong people.
The users are users of the digital government services that require verification of identity. The user need is to be able to securely access their personal data and services online, be confident that others can’t pretend to be them in order to access their personal data and services, and know their privacy will be protected.
https://identityassurance.blog.gov.uk/
Department / Agency:
CO
Date of Assessment:
16/9/2014
Assessment stage:
Beta
Result of Assessment:
Pass
Lead Assessor:
N. Williams
Service Manager:
S. Dunn
Digital Leader:
P. Maltby
Assessment Report
After consideration the assessment panel have concluded GOV.UK Verify (the new name for the identity verification service from the Identity Assurance Programme) has shown sufficient progress and evidence of meeting the Digital by Default Service Standard criteria and should proceed to launch in Beta.
Reasons
The assessment panel were impressed in particular by the team’s iterative research and design process and commitment to finding more challenging groups of users with which to test the service. This work has paid dividends in making this very complex service appear simple and clear, not least by adopting its new name. The presentation of research outputs was excellent.
It was also very good to see that there are security analysts and operations specialists in-team, ensuring the service is secure and putting the right governance in place to ensure identity providers (IDPs) comply with data security.
Recommendations
The assessment panel have a few observations which, though not serious enough to prevent the service moving into Beta, will be important to address as soon as possible during the beta (and before the service comes to Live assessment).
- Demographic coverage. The service team said that the twoIDPs currently available cover around 75% of the UK population in terms of the evidence users are required to provide (users need to have a UK credit history or a passport/driving licence to verify their identity through GOV.UK Verify). While the panel agree this is a great place to start (from a base of 0%) the 25% of people it preclude is significant. The service therefore needs to:
- actively work with the market to grow this coverage to as close to 100% as can be achieved, as early as possible during the Beta
- ensure that relying party services assess how this demographic coverage maps to their own users as part of their onboarding, and ensure that they have a clear plan to meet the demand for alternative ways to verify users’ identity for those who can’t provide the required evidence
- until 100% coverage is possible, provide a clear journey for users who need to take an alternative route to verify their identity
- Assisted digital support. Related to the above, to ensure users needing assisted digital support are aware of their options, the panel recommend that GOV.UK Verify should include service-specific signposting to the assisted digital support available for each relying party service. The service team should test for successful ways of signposting service-specific AD support on the IDPs’ pages and take steps to require IDPs to include such signposting in their pages.
- Prioritise testing disaster recovery and continuous deployment. The assessment panel recommend that the planned work on testing the data-centre failover system, and improving the ability to deploy seamlessly without risk of interrupting the service, both be given very high priority.
- Look harder at the user experience of choosing an ID provider. The panel were uncertain about:
- how well users will understand the choice they are being asked to make between different ID providers (both now when there is little choice, and in future when there is a risk of too many choices for the user to understand)
- how well users will remember their choice when they return to re-use the service
- the limited control the GOV.UK Verify team has over the quality of the user experience for the IDP part of the journey
at the Live assessment, the panel would like to see evidence of these things not being a problem for users, or changes to the service or governance arrangements which address them.
The assessment panel are also keen to see the service integrate with the performance platform as soon as possible (the service team is already working with performance platform on this).
The service has clearly come a long way since the assessment at the end of the alpha and is a glowing example of “doing the hard work to make it simple”.
Digital by Default Service Standard criteria
| Criteria | Passed | Criteria | Passed |
| 1 | Yes | 2 | Yes |
| 3 | Yes | 4 | Yes |
| 5 | Yes | 6 | Yes |
| 7 | Yes | 8 | Yes |
| 9 | Yes | 10 | Yes |
| 11 | Yes | 12 | Yes |
| 13 | Yes | 14 | Yes |
| 15 | Yes | 16 | Yes |
| 17 | Yes | 18 | Yes |
| 19 | Yes | 20 | Yes |
| 21 | Yes | 22 | Yes |
| 23 | Yes | 24 | Yes |
| 25 | Yes | 26 | Yes |
