Part 2: Definitions and Program
Normative Definitions
Utah Code § 63A-20-201 provides 30 definitions. Many are standard legal definitions, but several are technically prescriptive and constrain the system architecture. This section annotates each definition that carries technical implications.
Cross-Context Correlation
"Cross-context correlation" means the ability of a person to link, associate, or infer that the presentation of a state-endorsed digital identity originating with the same or another person relates to the same individual.
Technical Annotation: This definition scopes the anti-correlation requirements in Utah Code § 63A-20-301(1)(a). "Link, associate, or infer" is broad, covering not only shared unique identifiers but also timing analysis, attribute fingerprinting, and behavioral patterns. Implementations must consider both cryptographic linkability (shared identifiers, signature patterns) and statistical linkability (rare attribute combinations, presentation timing).
Digital Identity
(a) "Digital identity" means an electronic record that: (i) an individual may use to assert an individual's identity or identity attributes; and (ii) can be mathematically verified.
(b) "Digital identity" does not include an electronic record that relies on shared authentication information to verify an individual's identity, including a username, password, personal identification number, or one-time code.
Technical Annotation: Two hard constraints. First, "mathematically verified" mandates cryptographic proof of authenticity and integrity, ruling out visual inspection, database lookups, or bearer tokens as the verification mechanism. Second, the explicit exclusion of shared-secret authentication (passwords, PINs, OTPs) means the verification mechanism must be based on asymmetric cryptography or equivalent public-key schemes. A verifier must be able to confirm authenticity using only publicly available information (the issuer's public key) and the credential itself.
Personal Digital Identifier
"Personal digital identifier" means an identifier that is: (a) unique; (b) created by or at the direction of an individual; (c) mathematically provable to be under a holder's control; and (d) transportable to technical infrastructure of the holder's choosing.
Technical Annotation: This is the most architecturally prescriptive definition in the statute. The four properties define the functional requirements for a personal digital identifier:
- (a) Unique: The identifier must have negligible collision probability across the entire system.
- (b) Created by or at the direction of an individual: The individual initiates or directs the creation of the identifier. The Department SHALL NOT unilaterally generate identifiers on behalf of individuals. This permits delegation (e.g., directing a wallet provider to create the identifier) as long as the individual retains control of the result.
- (c) Mathematically provable to be under a holder's control: The holder must be able to demonstrate control of the identifier through a mathematical proof (e.g., digital signature, proof of knowledge, or equivalent mechanism). This is the "proof of possession" requirement.
- (d) Transportable: The identifier (or a recovery mechanism) must be movable to different wallet implementations. This prohibits hard binding to a specific device or vendor without an export/recovery path.
These properties are typically satisfied by an asymmetric key pair, but other constructs meeting all four properties are permitted.
State-Endorsed Digital Identity
"State-endorsed digital identity" means an individual's digital identity that: (a) includes a personal digital identifier; and (b) the department has issued.
Technical Annotation: A SEDI is the combination of a holder-controlled personal digital identifier (per Utah Code § 63A-20-201(20)) and a Department-issued endorsement. The Department cryptographically binds its endorsement to the holder's personal digital identifier and the endorsed attributes, creating a verifiable credential that the holder controls.
Verifier
"Verifier" means a person that mathematically verifies a state digital identity to evaluate the state digital identity's authenticity and integrity.
Technical Annotation: Combined with the "mathematically verified" requirement in Utah Code § 63A-20-201(4), this mandates cryptographic verification. A verifier performs signature verification using the Department's public key, confirms the credential's integrity (no tampering), and may verify proof of possession from the holder's personal digital identifier. Visual inspection, barcode scanning without cryptographic validation, or database lookups alone do not satisfy this definition.
Verifier vs. Relying Party Distinction
The statute creates a structural separation between the verifier (Utah Code §§ 63A-20-201(30), 501) and the relying party (Utah Code §§ 63A-20-201(26), Part 601). This is unusual in identity frameworks and carries architectural implications:
- A verifier performs cryptographic operations: signature validation, integrity checks, proof-of-possession verification.
- A relying party consumes the verifier's output: the verified identity attributes and the verifier's assertion of authenticity.
These may be the same entity, but the statute imposes distinct obligations on each role. This separation enables architectures where verification is performed by a specialized service (a "verification service provider") while the relying party only receives a verified assertion.
For the complete set of statutory definitions with technical annotations, see Annex C: Glossary.
Program Creation and Administrative Requirements
Utah Code § 63A-20-202 creates the State-Endorsed Digital Identity Program within the Department of Government Operations and defines its duties. Utah Code § 63A-20-203 establishes the program manager role.
|
Req ID |
63A-20 |
Requirement |
Control |
Governance |
|---|---|---|---|---|
|
SEDI issuance compliance |
EXPT |
Statute |
||
|
Publish technical standards |
EXPT |
Rule |
||
|
Data governance standards |
EXPT |
Rule |
||
|
45-day public comment period |
ADMN |
Statute |
||
|
Response to public comments |
ADMN |
Statute |
||
|
Fee structure publication |
ADMN |
Statute |
||
|
Annual program reporting |
ADMN |
Statute |
||
|
Program manager qualifications |
ADMN |
Statute |
Implementation Decisions
Before the requirements in this part can be assessed, the responsible parties must specify:
- Minimum experience thresholds (PRG-08): minimum qualifications or experience levels required for each of the four domains (government administration, data privacy, cybersecurity, information technology).
SEDI-PRG-01: SEDI issuance compliance
The department shall design, implement, administer, and issue a state-endorsed digital identity in compliance with Part 3.
Utah Code § 63A-20-202(2)
Requirement: The Department SHALL operate the SEDI issuance system in conformance with all SEDI-SDI requirements.
Criticality: Critical — non-compliance with Part 3 undermines the entire SEDI program's legal foundation.
Roles: Department
Assessment Objectives
Determine if:
- the SEDI issuance system is designed and implemented in conformance with all SEDI-SDI requirements;
- the issuance system produces correct outputs for each SEDI-SDI requirement that has an AUTO control type;
- operational procedures and change management processes maintain ongoing conformance with Part 3 requirements;
- deviations from SEDI-SDI requirements are identified, documented, and remediated.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
Recommended |
Department |
Per release and quarterly |
Cannot cover EXPT/ADMN requirements or emergent integration issues |
|
EXPT |
Mandatory |
Independent assessor |
Annually and after major changes |
Point-in-time; does not detect regressions between assessments |
|
ADMN |
Recommended |
Department |
Annually |
Relies on documentation accuracy; does not test live system behavior |
Objective coverage: AUTO → 2; EXPT → 1, 3, 4; ADMN → 3, 4
Assessment objects: SEDI issuance system architecture documentation; Part 3 conformance test results; operational procedures and change management records; independent assessment reports; deviation and remediation logs.
Statutory compliance: Compliance is demonstrated through expert assessment because the requirement spans the full set of Part 3 obligations, many of which require human judgment.
SEDI-PRG-02: Publish technical standards
Establish technological standards and best practices for governmental entities regarding the creation, issuance, use, and acceptance of a state-endorsed digital identity. (Utah Code § 63A-20-202(3)(a)(ii)(A)
Requirement: The Department SHALL publish technical standards covering the full credential lifecycle: creation, issuance, use (presentation), and acceptance (verification). Standards SHALL be sufficient for independent implementation.
Criticality: Critical — absence of published standards prevents any ecosystem participant from building conformant implementations.
Roles: Department
Assessment Objectives
Determine if:
- published technical standards cover the creation phase of the credential lifecycle;
- published technical standards cover the issuance phase of the credential lifecycle;
- published technical standards cover the use (presentation) phase of the credential lifecycle;
- published technical standards cover the acceptance (verification) phase of the credential lifecycle;
- standards are written in sufficient detail for independent implementation by a third party without access to the Department's internal documentation;
- standards documents are publicly accessible at their canonical locations.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
Recommended |
Department |
Per publication cycle |
Cannot evaluate technical sufficiency or implementability |
|
EXPT |
Mandatory |
Independent assessor |
At initial publication and after major revisions |
Subjective judgment on "sufficient for independent implementation" |
|
ADMN |
Recommended |
Department |
Annually |
Does not verify technical content quality |
Objective coverage: AUTO → 6; EXPT → 1, 2, 3, 4, 5; ADMN → 1, 2, 3, 4
Assessment objects: Published technical standards documents; standards publication URLs and access logs; stakeholder feedback records; independent implementer experience reports; standards revision history.
Statutory compliance: Expert review is mandatory because "sufficient for independent implementation" requires qualitative assessment that automated tooling cannot provide.
SEDI-PRG-03: Data governance standards
Establish standards for the collection, processing, storage, and disclosure of individual identity or identity attributes. (Utah Code § 63A-20-202(3)(a)(ii)(B)
Requirement: The Department SHALL publish data governance standards covering the collection, processing, storage, and disclosure of identity data by all ecosystem participants.
Criticality: High — data governance gaps expose identity attributes to misuse across the ecosystem.
Roles: Department
Assessment Objectives
Determine if:
- published data governance standards address the collection of identity data;
- published data governance standards address the processing of identity data;
- published data governance standards address the storage of identity data;
- published data governance standards address the disclosure of identity data;
- governance standards apply to all ecosystem participants (Department, wallet providers, identity proofing entities, verifiers, relying parties);
- governance documents are publicly accessible.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
Recommended |
Department |
Per publication cycle |
Cannot evaluate whether standards are substantively adequate |
|
EXPT |
Mandatory |
Independent assessor |
At initial publication and after major revisions |
Depends on assessor's familiarity with all participant types |
|
ADMN |
Recommended |
Department |
Annually |
Self-reported compliance may not reflect actual practice |
Objective coverage: AUTO → 6; EXPT → 1, 2, 3, 4, 5; ADMN → 1, 2, 3, 4, 5
Assessment objects: Published data governance standards documents; data flow diagrams showing collection, processing, storage, and disclosure points; ecosystem participant agreements and data handling addenda; privacy impact assessments; governance document publication URLs.
Statutory compliance: Expert review is mandatory because adequacy of data governance standards requires domain expertise in privacy and information management.
SEDI-PRG-04: 45-day public comment period
Accept public comment for a period of 45 days from the day the proposed rule is published. (Utah Code § 63A-20-202(3)(b)(i)
Requirement: All SEDI rules and technical standards SHALL undergo a minimum 45-day public comment period following publication in the Utah State Bulletin.
Criticality: High — skipping the comment period violates statutory rulemaking procedure and invalidates the resulting rule.
Roles: Department
Assessment Objectives
Determine if:
- the proposed rule was published in the Utah State Bulletin before the comment period began;
- a minimum of 45 calendar days elapsed between publication and the rule's effective date;
- the public comment submission mechanism was accessible for the full 45-day period;
- the comment period applied to all SEDI rules and technical standards, not only selected ones.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
N/A |
— |
— |
Comment period timing is a legal/procedural requirement not enforceable through automated technical controls |
|
EXPT |
N/A |
— |
— |
No technical expert assessment adds value beyond administrative record review |
|
ADMN |
Mandatory |
Department legal counsel |
Per rulemaking |
Relies on accurate record-keeping; does not prevent retroactive falsification of dates |
Objective coverage: ADMN → 1, 2, 3, 4
Assessment objects: Utah State Bulletin publication records; rulemaking docket with dates; public comment submission portal access logs; rule effective date documentation; rulemaking process checklist.
Statutory compliance: Administrative review is the only feasible method; the comment period is a procedural and legal process requirement that cannot be enforced through technology.
SEDI-PRG-05: Response to public comments
Issue a response to substantive comments submitted by the public before making the proposed rule effective. (Utah Code § 63A-20-202(3)(b)(ii)
Requirement: The Department SHALL publish written responses to substantive public comments before rules take effect.
Criticality: High — failure to respond to substantive comments undermines the legitimacy of rulemaking and may create legal vulnerability.
Roles: Department
Assessment Objectives
Determine if:
- the Department identified and categorized substantive public comments;
- written responses were produced for each substantive comment;
- responses were published before the rule's effective date;
- responses address the substance of the comment rather than providing only a generic acknowledgment.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
N/A |
— |
— |
Substantive response is a human deliberative act that cannot be automated or verified by technical controls |
|
EXPT |
N/A |
— |
— |
No technical expert assessment adds value beyond administrative record review |
|
ADMN |
Mandatory |
Department legal counsel |
Per rulemaking |
Cannot assess whether responses are genuinely substantive or merely pro forma |
Objective coverage: ADMN → 1, 2, 3, 4
Assessment objects: Public comment submissions and categorization records; Department written responses to substantive comments; publication dates of responses relative to rule effective dates; rulemaking docket and timeline documentation.
Statutory compliance: Administrative review is the only feasible method; responding to public comments is a human-driven deliberative process that cannot be enforced by technology.
SEDI-PRG-06: Fee structure publication
The department may establish fees for issuing, renewing, or replacing a state-endorsed digital identity.
Utah Code § 63A-20-202(5)(a)
Requirement: If fees are established, the fee structure SHALL be published. Fees SHALL NOT be structured so as to create a barrier to SEDI adoption that effectively compels use of physical identity or vice versa (consistent with BOR-09).
Criticality: Medium — fee publication is a transparency requirement; non-discriminatory fee levels are important but recoverable through adjustment.
Roles: Department
Assessment Objectives
Determine if:
- the fee structure, if established, is publicly published;
- fee levels do not create a financial barrier that effectively compels use of physical identity over SEDI;
- fee levels do not create a financial barrier that effectively compels use of SEDI over physical identity;
- the fee structure is consistent with the non-discrimination principle in SEDI-BOR-09.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
N/A |
— |
— |
Fee-setting and discriminatory impact assessment are policy judgments not amenable to automated verification |
|
EXPT |
N/A |
— |
— |
No technical expert assessment applicable; this is a policy and equity evaluation |
|
ADMN |
Mandatory |
Department, oversight body |
Per fee change and annually |
"Discriminatory impact" involves subjective judgment; no bright-line test exists |
Objective coverage: ADMN → 1, 2, 3, 4
Assessment objects: Published fee schedule; fee comparison analysis between SEDI and physical identity issuance; fee waiver or reduced-fee program documentation; public comment records related to fee levels; demographic impact analysis if available.
Statutory compliance: Administrative review is the only feasible method; fee-setting is a policy decision, and assessing discriminatory impact requires human judgment on equity and access.
SEDI-PRG-07: Annual program reporting
Beginning on January 1, 2027, the department shall annually report on program implementation and adoption metrics, security incidents, public comments, changes, vendor ecosystem status, and recommended statutory changes.
Utah Code § 63A-20-202(6)
Requirement: The Department SHALL report annually before June 1 to the Economic Development and Workforce Services Interim Committee covering: (a) adoption rates, (b) security incident count and remediations, (c) public comment summary, (d) program changes made in response, (e) number of conformant wallets and verifier tools, (f) findings and recommendations from coordination activities under Utah Code § 63A-20-204, (g) statutory change recommendations.
Criticality: Medium — reporting is a legislative accountability mechanism; late or missing reports are visible but do not compromise system security.
Roles: Department
Assessment Objectives
Determine if:
- the annual report includes adoption rates;
- the annual report includes security incident count and remediations;
- the annual report includes a public comment summary;
- the annual report includes program changes made in response to public comments;
- the annual report includes the number of conformant wallets and verifier tools;
- the annual report includes findings and recommendations from coordination activities under Utah Code § 63A-20-204;
- the annual report includes statutory change recommendations;
- the annual report is delivered before June 1 of each year beginning in 2027;
- automated metric collection pipelines are operational for quantitative data points (adoption rates, incident counts, ecosystem participant counts).
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
Recommended |
Department |
Continuously |
Cannot generate narrative analysis, recommendations, or public comment summaries |
|
EXPT |
N/A |
— |
— |
No expert technical assessment adds value beyond metric validation |
|
ADMN |
Mandatory |
Department, legislative oversight |
Annually |
Cannot assess whether report content is accurate or complete without independent audit |
Objective coverage: AUTO → 9; ADMN → 1, 2, 3, 4, 5, 6, 7, 8
Assessment objects: Published annual report; metric collection pipeline configuration and output; security incident tracking records; public comment log and response records; ecosystem participant registry; legislative submission records; report publication date evidence.
Statutory compliance: Administrative review is mandatory because the report is a human-authored deliverable requiring judgment on content and framing. Automated metric collection supports but does not replace the report itself.
SEDI-PRG-08: Program manager qualifications
The program manager shall be experienced in government administration, data privacy, cybersecurity, and information technology.
Utah Code § 63A-20-203(2)
Requirement: Administrative requirement; no direct technical implementation.
Criticality: Medium — an unqualified program manager increases operational risk but does not directly compromise the technical system.
Roles: Department
Assessment Objectives
Determine if:
- the program manager has documented experience in government administration meeting the defined minimum experience thresholds;
- the program manager has documented experience in data privacy meeting the defined minimum experience thresholds;
- the program manager has documented experience in cybersecurity meeting the defined minimum experience thresholds;
- the program manager has documented experience in information technology meeting the defined minimum experience thresholds.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
N/A |
— |
— |
Personnel qualifications are inherently non-technical hiring criteria |
|
EXPT |
N/A |
— |
— |
No technical expert assessment applicable to hiring decisions |
|
ADMN |
Mandatory |
Department HR, appointing authority |
At appointment and during performance reviews |
Experience assessment is subjective; no standardized qualification threshold defined in statute |
Objective coverage: ADMN → 1, 2, 3, 4
Assessment objects: Program manager job description and qualification requirements; candidate or incumbent resume and credentials; hiring decision documentation; performance review records; professional certifications in relevant domains.
Statutory compliance: Administrative review is the only feasible method; personnel qualification requirements are inherently non-technical hiring criteria that cannot be enforced through technology.
Coordination on Use Cases
Utah Code § 63A-20-204 requires the Department to coordinate with specific agencies on SEDI use cases. This section generates requirements for interagency coordination and use case development.
|
Req ID |
Cite |
Requirement |
Control |
Governance |
|---|---|---|---|---|
|
Interagency coordination |
ADMN |
Statute |
||
|
Use case development |
ADMN |
Rule |
||
|
Coordination standards and guidance |
ADMN |
Rule |
SEDI-PRG-09: Interagency coordination
The department shall coordinate with the following agencies to evaluate mechanisms by which a state-endorsed digital identity may be accepted and verified in the performance of their statutory duties or authorized functions: (a) the Department of Alcoholic Beverage Services; (b) the Driver License Division; (c) the Department of Health and Human Services; (d) the State Board of Education; and (e) state and local law enforcement agencies.
Utah Code § 63A-20-204(1)
Requirement: The Department SHALL establish formal coordination with the five named agencies to evaluate SEDI acceptance and verification mechanisms relevant to each agency's statutory duties.
Criticality: High — failure to coordinate with named agencies delays SEDI adoption in statutorily mandated use cases.
Roles: Department
Assessment Objectives
Determine if:
- formal coordination exists with the Department of Alcoholic Beverage Services;
- formal coordination exists with the Driver License Division;
- formal coordination exists with the Department of Health and Human Services;
- formal coordination exists with the State Board of Education;
- formal coordination exists with state and local law enforcement agencies;
- each coordination engagement includes evaluation of SEDI acceptance mechanisms relevant to that agency's statutory duties;
- each coordination engagement includes evaluation of SEDI verification mechanisms relevant to that agency's statutory duties.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
N/A |
— |
— |
Interagency coordination is a relationship-driven process not amenable to automated verification |
|
EXPT |
N/A |
— |
— |
No technical expert assessment applicable to coordination activities |
|
ADMN |
Mandatory |
Department, legislative oversight |
Annually |
Cannot assess quality or effectiveness of coordination; participation by partner agencies is outside Department control |
Objective coverage: ADMN → 1, 2, 3, 4, 5, 6, 7
Assessment objects: Memoranda of understanding or coordination agreements with each named agency; meeting minutes and coordination activity logs; documented evaluations of SEDI acceptance and verification mechanisms per agency; agency point-of-contact designations; coordination timeline and milestone records.
Statutory compliance: Administrative review is the only feasible method; interagency coordination is a relationship and governance activity that cannot be enforced through technology.
SEDI-PRG-10: Use case development
The coordination described in Utah Code § 63A-20-204 (1) shall include evaluation and development of use cases for: (a) age verification for the purchase of alcoholic products under Utah Code Title 32B; (b) student enrollment and related identity verification within public education systems; (c) identity verification by law enforcement officers during lawful encounters; and (d) identity verification by Utah financial institutions consistent with applicable state and federal law.
Utah Code § 63A-20-204(2)
Requirement: The Department SHALL develop and document use cases for each of the four enumerated scenarios. Use cases SHALL specify operational, technical, privacy, and legal requirements for SEDI acceptance in each context.
Criticality: High — without documented use cases, partner agencies cannot implement SEDI acceptance in statutorily mandated scenarios.
Roles: Department
Assessment Objectives
Determine if:
- a documented use case exists for age verification for the purchase of alcoholic products under Title 32B;
- a documented use case exists for student enrollment and related identity verification within public education systems;
- a documented use case exists for identity verification by law enforcement officers during lawful encounters;
- a documented use case exists for identity verification by Utah financial institutions consistent with applicable state and federal law;
- each use case specifies operational requirements for SEDI acceptance in its context;
- each use case specifies technical requirements for SEDI acceptance in its context;
- each use case specifies privacy requirements for SEDI acceptance in its context;
- each use case specifies legal requirements for SEDI acceptance in its context.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
N/A |
— |
— |
Use case development is a human analytical activity requiring domain expertise in multiple fields |
|
EXPT |
Recommended |
Domain experts from partner agencies |
At initial development and after major revisions |
Quality depends on availability and engagement of domain experts from each partner agency |
|
ADMN |
Mandatory |
Department |
Annually |
Cannot assess whether use cases are practical or accepted by the implementing agencies |
Objective coverage: EXPT → 5, 6, 7, 8; ADMN → 1, 2, 3, 4, 5, 6, 7, 8
Assessment objects: Documented use case specifications for each of the four enumerated scenarios; operational workflow diagrams; technical integration requirements; privacy impact assessments per use case; legal analysis of applicable state and federal law per scenario; partner agency review and feedback records.
Statutory compliance: Administrative review is the primary method; expert review from partner agencies adds value by validating domain-specific adequacy of each use case.
SEDI-PRG-11: Coordination standards and guidance
In performing the duties described in this section, the department shall: (a) identify operational, technical, privacy, and legal requirements necessary to enable secure and reliable acceptance and verification of a state-endorsed digital identity; (b) develop standards and guidance to support consistent implementation; and (c) identify any statutory, rule, or policy changes necessary to facilitate integration and acceptance.
Utah Code § 63A-20-204(3)
Requirement: The Department SHALL produce standards, guidance, and gap analysis covering operational, technical, privacy, and legal requirements for SEDI integration with the coordinated agencies.
Criticality: High — without standards and gap analysis, coordinated agencies cannot achieve consistent SEDI implementation.
Roles: Department
Assessment Objectives
Determine if:
- the Department has identified operational requirements necessary to enable secure and reliable SEDI acceptance and verification;
- the Department has identified technical requirements necessary to enable secure and reliable SEDI acceptance and verification;
- the Department has identified privacy requirements necessary to enable secure and reliable SEDI acceptance and verification;
- the Department has identified legal requirements necessary to enable secure and reliable SEDI acceptance and verification;
- standards and guidance have been developed to support consistent implementation across coordinated agencies;
- a gap analysis identifies statutory changes necessary to facilitate SEDI integration and acceptance;
- a gap analysis identifies rule changes necessary to facilitate SEDI integration and acceptance;
- a gap analysis identifies policy changes necessary to facilitate SEDI integration and acceptance.
Verification Methods
|
Method |
Applicability |
Performed By |
Frequency |
Limitations |
|---|---|---|---|---|
|
AUTO |
N/A |
— |
— |
Standards development and gap analysis require human judgment across legal, policy, and technical domains |
|
EXPT |
Recommended |
Independent assessor |
At initial publication and after major revisions |
Assessor may lack full context on each partner agency's operational constraints |
|
ADMN |
Mandatory |
Department, legislative oversight |
Annually |
Cannot assess whether identified gaps are prioritized or acted upon |
Objective coverage: EXPT → 1, 2, 3, 4, 5; ADMN → 1, 2, 3, 4, 5, 6, 7, 8
Assessment objects: Published standards and implementation guidance documents; gap analysis report identifying statutory, rule, and policy changes; operational requirements documentation; technical integration specifications; privacy requirements analysis; legal requirements analysis; partner agency feedback on standards and guidance.
Statutory compliance: Administrative review is the primary method; expert review adds value by validating technical soundness and completeness of the gap analysis.
Rulemaking Requirements
The statute delegates significant technical specification to the Department's rulemaking authority under the Utah Administrative Rulemaking Act (Utah Code Title 63G, Chapter 3). This implementation guide informs but does not replace that rulemaking. The following topics require rules:
- Administration of Utah Code Chapter Title 63A,- Chapter 20 (Utah Code § 63A-20-202(3)(a)(i))
- Technological standards for governmental entities (Utah Code § 63A-20-202(3)(a)(ii))
- Application procedures (Utah Code § 63A-20-202(3)(a)(iii)(A))
- Digital guardian designation procedures (Utah Code § 63A-20-202(3)(a)(iii)(B))
- Identity proofing standards and processes (Utah Code § 63A-20-303(4)(a))
- Application form and manner (Utah Code § 63A-20-302(4)(a))
- Identity proofing requirements and procedures (Utah Code § 63A-20-302(4)(b))
- Denial, correction, reissuance, and compromise recovery procedures (Utah Code § 63A-20-302(4)(c))