Part 3: State-Endorsed Digital Identity

Utah Code § 63A-20-301: State-Endorsed Digital Identity Requirements

Utah Code § 63A-20-301 contains the core technical requirements for the SEDI itself. This is the densest and most architecturally significant section of the statute. It defines what a SEDI must do (Utah Code § 63A-20-301(1)), what the Department must do operationally (Utah Code § 63A-20-301(2)), what the system must not do (Utah Code § 63A-20-301(3)), how data may be used (Utah Code § 63A-20-301(4)), when revocation is permitted (Utah Code § 63A-20-301(5)), and breach reporting obligations (Utah Code § 63A-20-301(6)).

SEDI Functional Requirements

Safeguards and Protections  

Utah Code § 63A-20-301(1)(a) requires that a SEDI "incorporate state-of-the-art safeguards for protecting an individual's identity, including compromise detection, recovery mechanisms, and cross-context correlation protections."

This single provision generates three distinct technical requirements:

• Compromise detection: The system must be able to detect when a SEDI has been compromised (e.g., key theft, unauthorized duplication) and communicate that status to verifiers.
• Recovery mechanisms: A holder whose SEDI is compromised must be able to obtain a replacement without repeating the full identity proofing process (within a defined window).
• Cross-context correlation protections: Presentations to different verifiers must not enable those verifiers (or any third party) to determine that the presentations originated from the same holder.

Authenticity and Integrity

Utah Code § 63A-20-301(1)(b) requires methods to "establish authenticity and integrity." Authenticity means the SEDI was genuinely issued by the Department. Integrity means the SEDI has not been altered since issuance. Both are satisfied by cryptographic digital signatures.

Interoperability

Utah Code § 63A-20-301(1)(c) requires compatibility "with a wide variety of technological systems while maintaining strong privacy and security." Interoperability must not come at the cost of privacy or security; this prevents downgrade attacks where a system accepts a less-private presentation format for compatibility.

Online and Offline Presentation

Utah Code § 63A-20-301(1)(d) requires support for both online and offline presentation. Offline presentation "does not involve the internet" (Utah Code § 63A-20-201(16)), meaning the verification flow must complete without any network connectivity, including no real-time communication with the Department or any other backend system.

Selective Disclosure

Utah Code § 63A-20-301(1)(e)(i) requires the SEDI to "enable a holder to selectively disclose an individual's identity attributes." This means the cryptographic structure of the credential must support revealing individual attributes without revealing others. Simple signed-document formats that require revealing the entire signed payload do not satisfy this requirement.

Age Verification Without Disclosure

Utah Code § 63A-20-301(1)(e)(ii) requires the ability to "demonstrate that the individual meets a specified minimum age without disclosing the individual's age or birth date." This is a predicate proof: a boolean assertion ("age >= 21") derived from an underlying attribute (birth date) without revealing the attribute value. This requires zero-knowledge proof capabilities or equivalent cryptographic mechanisms.

Wallet Choice

Utah Code § 63A-20-301(1)(f) requires the SEDI to "allow a holder to choose a digital wallet that conforms with the requirements established by the department." This mandates an open wallet ecosystem where multiple providers can participate.

Usability  

Utah Code § 63A-20-301(1)(g) requires the SEDI to "be easy for a holder to adopt and use." Usability is a soft constraint but a mandatory one. Complex key management ceremonies, multi-step verification flows, or expert-level technical knowledge cannot be prerequisites for ordinary use. 

Department Operational Requirements

Open Standards Requirement

Utah Code § 63A-20-301(2)(e) mandates selection of "open technological standards" that are: - (i) publicly available - (ii) free from: (A) licensing fees; and (B) patent restrictions

This is one of the most consequential requirements in the statute. It disqualifies any proprietary protocol, patent-encumbered algorithm, or standards-body specification that requires licensing fees for implementation.

State Data Center Requirement

Utah Code § 63A-20-301(2)(c) and (d) require: - Technical infrastructure for issuance and revocation SHALL be maintained in a state-controlled data center within Utah - That data center SHALL use best practices for data handling

This is a data sovereignty and operational control requirement. It does NOT apply to the presentation flow (which occurs holder-to-verifier) nor to wallet providers or verifiers, who may operate anywhere.

Anti-Surveillance Requirement

Utah Code § 63A-20-301(3) prohibits the SEDI from including "a mechanism that allows the department to monitor, surveil, or track the presentation of a state-endorsed digital identity to another entity."

This is an absolute architectural constraint. It prohibits: - Any "phone home" capability during presentation - Any Department-accessible presentation transaction log - Any unique identifier in the credential that the Department could use to correlate presentations - Any revocation-checking mechanism that reveals presentation activity to the Department

Implementation Decisions

Before the requirements in this part can be assessed, the responsible parties must specify:

• Maximum acceptable propagation delay (SDI-01): The upper bound on how long revocation status updates may take to reach verifiers.
• Time window from original proofing (SDI-02): The period after initial identity proofing during which a holder may use an expedited recovery process without full re-proofing.
• Cryptographic algorithm suite and key parameters (SDI-04): The set of cryptographic algorithms, key sizes, and related parameters used for credential signing and integrity protection.
• Minimum set of platforms and environments (SDI-05): The operating systems, device types, and application environments against which interoperability must be validated.
• Usability success criteria and testing methodology (SDI-10): The measurable thresholds for task completion, error rates, and user satisfaction, along with the testing methods used to evaluate them.
• Security framework and assurance level (SDI-14): The recognized security framework (e.g., NIST Cybersecurity Framework, FedRAMP) and the target assurance level that data center operations must satisfy.
• Maximum retention period (SDI-20): The longest permissible duration that each category of application data (e.g., proofing evidence, transaction logs, analytics) may be retained before deletion.
• Specific identity proofing standard and assurance level (IDP-01): The identity proofing standard (e.g., NIST SP 800-63A) and the target assurance level, established through administrative rulemaking.

SEDI-SDI-01: Compromise detection

A state-endorsed digital identity shall incorporate state-of-the-art safeguards for protecting an individual's identity, including compromise detection [...]

Utah Code § 63A-20-301(1)(a)

Requirement: The system SHALL support revocation or status checking that enables verifiers to detect compromised SEDIs. The revocation mechanism SHALL NOT reveal presentation patterns to the Department (see SEDI-SDI-17).

Criticality: Critical — undetected compromised credentials enable identity fraud across the entire ecosystem.

Roles: Department, Verifiers

Assessment Objectives

Determine if:

1. the system supports a revocation or status-checking mechanism that enables verifiers to detect compromised SEDIs;
2. verifiers detect a revoked credential within the maximum acceptable propagation delay;
3. the revocation mechanism does not reveal presentation patterns to the Department (per SEDI-SDI-17).

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 1, 3

Assessment objects: Revocation protocol specification; status list or revocation list distribution mechanism; conformance test suite source code and test vectors; revocation propagation SLA documentation; network traffic captures during presentation flows; Department operational procedures for revocation processing.

Statutory compliance: Automated testing is mandatory because compromise detection is a fully testable cryptographic and protocol-level property.

SEDI-SDI-02: Recovery mechanisms

Derived: [...] including [...] recovery mechanisms [...]

Utah Code § 63A-20-301(1)(a)

Requirement: A holder whose SEDI is compromised SHALL be able to obtain a replacement SEDI through an expedited process that does not require full re-proofing, within a defined window from original proofing.

Criticality: High — inability to recover a compromised SEDI forces full re-proofing and leaves the holder without a valid identity credential.

Roles: Department

Assessment Objectives

Determine if:

1. a recovery process exists for holders whose SEDI has been compromised;
2. the recovery process is expedited relative to the initial issuance process;
3. the recovery process does not require full re-proofing within the time window from original proofing;
4. the replacement SEDI is bound to a new personal digital identifier.

Verification Methods

Objective coverage: AUTO → 1, 4; EXPT → 1, 2, 3; ADMN → 2

Assessment objects: Recovery API specification and endpoint documentation; recovery workflow design documents; identity re-binding procedures; recovery request logs and completion time metrics; Department recovery policy defining the expedited window; conformance test suite covering recovery flows.

Statutory compliance: Expert assessment is mandatory because "expedited" and "does not require full re-proofing" involve judgment about process sufficiency that automated tests alone cannot fully evaluate.

SEDI-SDI-03: Cross-context correlation protections

Derived: [...] including [...] cross-context correlation protections.

Utah Code § 63A-20-301(1)(a)

Requirement: Presentations to different verifiers SHALL NOT contain shared unique identifiers, signature patterns, or other data that enables cross-context linking by verifiers, relying parties, or any third party.

Criticality: Critical — failure enables mass surveillance through cross-verifier correlation, directly undermining the statute's privacy protections.

Roles: Department, Wallet Providers

Assessment Objectives

Determine if:

1. presentations to different verifiers do not contain shared unique identifiers;
2. presentations to different verifiers do not contain deterministic or repeated signature patterns;
3. no other data in the presentation payload enables cross-context linking by verifiers, relying parties, or any third party;
4. the credential format and presentation protocol are designed to prevent statistical linkability from attribute combinations.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 3, 4

Assessment objects: Credential format specification; presentation protocol documentation; conformance test suite source code and multi-presentation comparison test vectors; cryptographic analysis reports; network traffic captures of multiple presentations from the same holder.

Statutory compliance: Automated testing is mandatory because cross-context correlation is a testable property of the credential format and presentation protocol.

SEDI-SDI-04: Authenticity and integrity

A state-endorsed digital identity shall [...] include methods to establish authenticity and integrity.

Utah Code § 63A-20-301(1)(b)

Requirement: The SEDI SHALL employ cryptographic methods to establish authenticity (that it was genuinely issued by the Department) and integrity (that it has not been altered since issuance). These methods SHALL NOT rely on shared-secret authentication (63A-20-201(4)(b)). Verification SHALL be possible using only publicly available information and the credential itself, without real-time communication with the Department.

Criticality: Critical — without authenticity and integrity, verifiers cannot trust any SEDI, rendering the entire system meaningless.

Roles: Department, Verifiers

Assessment Objectives

Determine if:

1. the credential signature validates against the Department's published public key material using the defined cryptographic algorithm suite and key parameters;
2. any modification to credential content after issuance is detected by the integrity mechanism;
3. no shared-secret authentication mechanism (password, PIN, OTP) is used for verification (Utah Code § 63A-20-201(4)(b));
4. verification completes using only publicly available information and the credential itself, without real-time communication with the Department.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4

Assessment objects: Credential format specification and signature scheme documentation; Department public key distribution mechanism; conformance test suite source code and test vectors; cryptographic algorithm selection rationale; key management policy and procedures (see SEDI-KMS requirements).

Statutory compliance: Automated testing is mandatory because authenticity and integrity are deterministic cryptographic properties fully verifiable by test suites.

SEDI-SDI-05: Interoperability

A state-endorsed digital identity shall [...] be compatible with a wide variety of technological systems while maintaining strong privacy and security.

Utah Code § 63A-20-301(1)(c)

Requirement: The SEDI data format and presentation protocols SHALL be implementable across major operating systems, device types, and application environments. Interoperability SHALL NOT be achieved by weakening privacy or security properties.

Criticality: High — poor interoperability limits adoption to a subset of platforms, undermining the program's utility.

Roles: Department

Assessment Objectives

Determine if:

1. the SEDI data format and presentation protocols are implementable across major operating systems and device types;
2. credential operations (issuance, storage, presentation, verification) succeed on the minimum set of platforms and environments;
3. no compatibility or interoperability mode weakens privacy properties (e.g., disables selective disclosure or unlinkability);
4. no compatibility or interoperability mode weakens security properties (e.g., downgrades cryptographic strength).

Verification Methods

Objective coverage: AUTO → 2, 3, 4; EXPT → 1, 3, 4

Assessment objects: Credential format specification; presentation protocol documentation; cross-platform conformance test suite results; platform compatibility matrix; privacy and security downgrade analysis documentation; interoperability test environment inventory.

Statutory compliance: Expert assessment is mandatory because "wide variety of technological systems" and "maintaining strong privacy and security" require qualitative judgment across diverse platforms.

SEDI-SDI-06: Online and offline presentation

A state-endorsed digital identity shall [...] support online and offline presentation.

Utah Code § 63A-20-301(1)(d)

Requirement: The SEDI system SHALL support presentation protocols that function both with and without internet connectivity. Offline presentation SHALL NOT require real-time communication with the Department, any verifier backend, or any other network service.

Criticality: Critical — offline presentation is a statutory mandate; inability to present without connectivity renders the SEDI unusable in many real-world scenarios.

Roles: Department, Wallet Providers, Verifiers

Assessment Objectives

Determine if:

1. the presentation protocol completes successfully without any internet connectivity (offline mode);
2. offline presentation does not require real-time communication with the Department, any verifier backend, or any other network service;
3. online presentation is also supported and functional;
4. privacy properties are equivalent in both online and offline modes;
5. security properties are equivalent in both online and offline modes.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 4, 5

Assessment objects: Presentation protocol specification (online and offline modes); network traffic captures during offline presentation; conformance test suite source code and offline test vectors; protocol design documentation comparing online and offline security and privacy properties.

Statutory compliance: Automated testing is mandatory because online and offline presentation are deterministic protocol behaviors fully verifiable in controlled test environments.

SEDI-SDI-07: Selective disclosure

A state-endorsed digital identity shall [...] enable a holder to selectively disclose an individual's identity attributes. (Utah Code § 63A-20-301(1)(e)(i)

Requirement: The SEDI credential SHALL enable the holder to choose which identity attributes to present. Attributes not selected by the holder SHALL NOT be disclosed to the verifier. The mechanism ensuring non-disclosure MAY be cryptographic, structural, or a combination, but SHALL be sufficient to prevent the verifier from accessing non-selected attributes through the presentation itself.

Criticality: Critical — without selective disclosure, every presentation leaks the full credential, violating the statute's core privacy mandate.

Roles: Department, Wallet Providers

Assessment Objectives

Determine if:

1. the holder can choose which identity attributes to include in a presentation;
2. attributes not selected by the holder are absent from the presentation payload;
3. the verifier cannot extract or infer non-selected attributes from the presentation data;
4. the selective disclosure mechanism is cryptographic, structural, or a combination sufficient to prevent non-selected attribute access.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 3, 4

Assessment objects: Credential format specification and selective disclosure mechanism documentation; presentation payload samples with various attribute subsets; conformance test suite source code and selective disclosure test vectors; cryptographic analysis of the disclosure mechanism; wallet application attribute selection interface.

Statutory compliance: Automated testing is mandatory because selective disclosure is a deterministic property of the credential format and presentation protocol.

SEDI-SDI-08: Age verification without disclosure

A state-endorsed digital identity shall [...] enable a holder to [...] demonstrate that the individual meets a specified minimum age without disclosing the individual's age or birth date. 

(Utah Code §  63A-20-301(1)(e)(ii)

Requirement: The system SHALL support a mechanism that allows the holder to demonstrate "age >= X" (or similar age predicate) without disclosing the holder's actual age or date of birth. The mechanism SHALL produce only a boolean result. The verifier SHALL NOT be able to infer the holder's actual age or birth date from the presentation.

Criticality: Critical — this is an explicit statutory mandate; failure means every age check leaks the holder's birth date.

Roles: Department, Wallet Providers

Assessment Objectives

Determine if:

1. the system supports an age predicate mechanism that demonstrates "age >= X" without disclosing the holder's actual age or date of birth;
2. the presentation payload contains only a boolean result for the age predicate, with no birth date or age value present;
3. the verifier cannot infer the holder's actual age or birth date from the proof;
4. the mechanism functions correctly at boundary conditions (e.g., the holder's birthday, threshold ages).

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 3

Assessment objects: Age predicate proof specification and mechanism documentation; presentation payload samples for various age thresholds; conformance test suite source code and boundary condition test vectors; cryptographic analysis of age predicate proof for information leakage; wallet application age verification interface.

Statutory compliance: Automated testing is mandatory because the boolean-only output and absence of birth date leakage are deterministic properties of the proof mechanism.

SEDI-SDI-09: Wallet choice

A state-endorsed digital identity shall [...] allow a holder to choose a digital wallet that conforms with the requirements established by the department.

Utah Code §  63A-20-301(1)(f)

Requirement: The SEDI credential format SHALL be wallet-agnostic. Any wallet meeting the WAL requirements SHALL be able to store, manage, and present a SEDI. The Department SHALL NOT grant exclusive or preferential access to any single wallet provider.

Criticality: Critical — wallet lock-in violates the statute and creates a single point of failure for the entire holder ecosystem.

Roles: Department, Wallet Providers

Assessment Objectives

Determine if:

1. the SEDI credential format is wallet-agnostic and does not depend on proprietary APIs or wallet-specific extensions;
2. any wallet meeting the WAL requirements can store, manage, and present a SEDI;
3. credential import follows documented open specifications;
4. the Department does not grant exclusive or preferential access to any single wallet provider;
5. at least two independently developed wallets can successfully import and present the same SEDI.

Verification Methods

Objective coverage: AUTO → 1, 3, 5; EXPT → 2, 4; ADMN → 4

Assessment objects: Credential format specification and import protocol documentation; wallet certification program requirements; wallet provider agreements and contractual terms; conformance test suite results across multiple wallet implementations; wallet API specifications; Department wallet provider registry.

Statutory compliance: Automated testing is mandatory because wallet-agnostic credential import and presentation are deterministic interoperability properties fully verifiable by test suites.

SEDI-SDI-10: Usability

A state-endorsed digital identity shall [...] be easy for a holder to adopt and use.

Utah Code §  63A-20-301(1)(g)

Requirement: The SEDI system SHALL be usable by individuals without specialized technical knowledge. Key management operations (backup, recovery, migration) SHALL be abstracted behind user-friendly interfaces.

Criticality: High — poor usability prevents adoption, undermining the program's purpose even if all technical requirements are met.

Roles: Department, Wallet Providers

Assessment Objectives

Determine if:

1. the system meets the defined usability success criteria when evaluated with representative users without specialized technical knowledge;
2. primary operations (enrollment, presentation, recovery) are available through graphical interfaces;
3. key management operations (backup, recovery, migration) are abstracted behind user-friendly interfaces;
4. no command-line interaction or expert-level technical knowledge is required for ordinary use.

Verification Methods

Objective coverage: AUTO → 2, 4; EXPT → 1, 3; ADMN → 1

Assessment objects: Wallet application user interface designs and prototypes; usability test plans and results; user support ticket logs and complaint categorization; key management workflow documentation; enrollment and presentation user journey maps; accessibility compliance reports.

Statutory compliance: Expert usability assessment is mandatory because "easy to adopt and use" is an inherently qualitative standard that automated testing cannot fully evaluate.

SEDI-SDI-11: Identity proofing validation

The department shall validate verification of an individual's identity provided by an identity proofing entity.

Utah Code §  63A-20-301(2)(a)

Requirement: The Department SHALL independently validate the identity proofing performed by identity proofing entities before issuing a SEDI. Validation SHALL confirm that the proofing entity followed the required standards and that the proofing results meet the required assurance level.

Criticality: Critical — issuing a SEDI without validating identity proofing enables fraudulent identity credentials.

Roles: Department, Identity Proofing Entities

Assessment Objectives

Determine if:

1. the Department independently validates identity proofing performed by proofing entities before issuing a SEDI;
2. validation confirms the proofing entity followed the required standards;
3. validation confirms the proofing results meet the required assurance level;
4. issuance is blocked when proofing validation fails;
5. the proofing entity is authorized by the Department at the time of validation.

Verification Methods

Objective coverage: AUTO → 4, 5; EXPT → 1, 2, 3, 4; ADMN → 5

Assessment objects: Identity proofing validation workflow documentation; proofing entity authorization registry; assurance level verification logic and configuration; issuance decision logs showing validation outcomes; proofing entity onboarding procedures; validation exception reports.

Statutory compliance: Expert assessment is mandatory because validation of identity proofing quality and assurance levels requires judgment beyond what automated checks on authorization status can provide.

SEDI-SDI-12: Technological compliance mandate

The department shall [...] comply with the requirements of this chapter through technological means where possible.

Utah Code §  63A-20-301(2)(b)

Requirement: Compliance with Utah Code Title 63A- Chapter 20 requirements SHALL be enforced through technical controls (cryptography, access controls, protocol design) rather than relying solely on policy or contractual obligations. Where technological enforcement is not possible, the departure SHALL be documented with justification.

Criticality: Critical — this is the meta-requirement that mandates technical enforcement across the entire chapter.

Roles: Department

Assessment Objectives

Determine if:

1. compliance with Utah Code Title 63A, Chapter -20 requirements is enforced through technical controls (cryptography, access controls, protocol design) where possible;
2. each requirement lacking technological enforcement has a documented justification explaining why technical enforcement is not possible;
3. no requirement relies solely on policy or contractual obligations where a technological control is feasible;
4. the requirement-to-control mapping is maintained and current.

Verification Methods

Objective coverage: AUTO → 4; EXPT → 1, 2, 3; ADMN → 1, 3, 4

Assessment objects: Requirement-to-control mapping registry; control classification justification documents for each requirement; system architecture documentation showing technical enforcement mechanisms; policy-only compliance exception register with justifications.

Statutory compliance: Expert assessment is mandatory because determining whether technological enforcement is "possible" for each requirement requires engineering judgment.

SEDI-SDI-13: State data center requirement

The department shall [...] ensure any technical infrastructure used to control the issuance or revocation of a state-endorsed digital identity is maintained within a state-controlled data center located within the state.

Utah Code § 63A-20-301(2)(c)

Requirement: All systems involved in SEDI issuance (key generation, credential signing, attribute binding) and revocation status management SHALL be physically located within state-controlled data centers in Utah.

Criticality: Critical — out-of-state infrastructure violates the statute's data sovereignty mandate and exposes issuance/revocation to external jurisdictional risk.

Roles: Department

Assessment Objectives

Determine if:

1. all systems involved in SEDI issuance (key generation, credential signing, attribute binding) are physically located within state-controlled data centers in Utah;
2. all systems involved in revocation status management are physically located within state-controlled data centers in Utah;
3. issuance and revocation traffic routes only to in-state endpoints;
4. signing keys are generated and stored within state-controlled Utah facilities.

Verification Methods

Objective coverage: AUTO → 3; EXPT → 1, 2, 4; ADMN → 1, 2

Assessment objects: Data center contracts and service agreements; infrastructure asset inventory with physical location records; network topology diagrams; key ceremony procedures and audit logs; change management records for infrastructure relocations; on-site audit reports.

Statutory compliance: Expert audit is mandatory because physical infrastructure location requires on-site verification that automated network checks alone cannot conclusively provide.

SEDI-SDI-14: Data center best practices

The department shall [...] ensure that a state-controlled data center located within the state shall use best practices in collection, processing, storage, and disclosure of all individual identity and identity attributes.

Utah Code §  63A-20-301(2)(d)

Requirement: State data centers handling SEDI data SHALL implement security controls aligned with current best practices (e.g., NIST Cybersecurity Framework, FedRAMP-equivalent controls).

Criticality: High — inadequate data center security exposes identity attributes to breach, but specific control gaps are remediable.

Roles: Department

Assessment Objectives

Determine if:

1. data at rest within the state data center is encrypted;
2. data in transit to and from the state data center is encrypted;
3. access controls restrict administrative access to authorized personnel;
4. audit logging captures all administrative access and data operations;
5. the data center's security posture is aligned with the organization's security framework and assurance level.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 5; ADMN → 5

Assessment objects: Data center security certification documentation (e.g., SOC 2, FedRAMP); encryption configuration for data at rest and in transit; access control policies and role-based access matrices; audit log infrastructure and retention policies; incident response plans and drill results; vulnerability scan and penetration test reports.

Statutory compliance: Expert security assessment is mandatory because "best practices" is an evolving standard requiring professional judgment. Automated scans verify specific controls but cannot evaluate overall adequacy.

SEDI-SDI-15: Open standards mandate

The department shall [...] select open technological standards for the creation, issuance, use, and acceptance of a state-endorsed digital identity that are: (i) publicly available; and (ii) free from: (A) licensing fees; and (B) patent restrictions.

Utah Code § 63A-20-301(2)(e)

Requirement: ALL protocols, data formats, and cryptographic schemes used in the SEDI system SHALL be defined in standards that are: (a) publicly available without cost, (b) implementable without licensing fees, and (c) free from patent restrictions or available under royalty-free terms.

Criticality: Critical — use of patent-encumbered or proprietary standards violates the statute and creates vendor lock-in.

Roles: Department

Assessment Objectives

Determine if:

1. all protocols, data formats, and cryptographic schemes used in the SEDI system are defined in publicly available standards;
2. all referenced standards are downloadable without cost;
3. all referenced standards are implementable without licensing fees;
4. all referenced standards are free from patent restrictions or available under royalty-free terms;
5. no proprietary extensions beyond the referenced standards are required for implementation.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 4, 5; ADMN → 1, 2

Assessment objects: Standards catalog listing all referenced specifications with public access URLs; IPR declarations and patent status for each referenced standard; licensing terms documentation; standards-body IPR database records; system implementation documentation identifying all protocols, formats, and cryptographic schemes in use.

Statutory compliance: Automated verification is mandatory because public availability, absence of licensing fees, and patent status are deterministic, checkable properties of each referenced standard.

SEDI-SDI-16: Endorsed attribute set

The department shall [...] verify and endorse a specific set of identity attributes including an individual's: (i) name; (ii) birth date; (iii) image; and (iv) Utah residence address.

Utah Code § 63A-20-301(2)(f)

Requirement: The SEDI SHALL contain, at minimum, the following endorsed attributes: (a) name, (b) birth date, (c) image (photograph), and (d) Utah residence address. Additional attributes MAY be endorsed but are not required by statute.

Criticality: Critical — omitting a mandatory attribute violates the statute and renders the SEDI incomplete for its intended use cases.

Roles: Department

Assessment Objectives

Determine if:

1. the SEDI credential contains the holder's name as an endorsed attribute;
2. the SEDI credential contains the holder's birth date as an endorsed attribute;
3. the SEDI credential contains the holder's image (photograph) as an endorsed attribute;
4. the SEDI credential contains the holder's Utah residence address as an endorsed attribute;
5. each mandatory attribute is individually selectively disclosable.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 5; EXPT → 5

Assessment objects: Credential schema specification; issued credential samples; conformance test suite source code and attribute presence test vectors; selective disclosure test results for each mandatory attribute; schema design documentation.

Statutory compliance: Automated testing is mandatory because the presence of mandatory attributes in the credential schema is a deterministic, parseable property.

SEDI-SDI-17: Anti-surveillance

A state-endorsed digital identity may not include a mechanism that allows the department to monitor, surveil, or track the presentation of a state-endorsed digital identity to another entity.

Utah Code § 63A-20-301(3)

Requirement: The SEDI system SHALL be architected so that the Department has no technical capability to monitor, surveil, or track presentations. This requirement is satisfied if: (a) the Department receives no presentation-related traffic or signals during normal operation, OR (b) any Department-received signals (e.g., revocation status queries) are designed so that individual presentation patterns cannot be inferred from them. This is a structural requirement: it is not sufficient for the Department to promise not to monitor; the architecture must make monitoring infeasible.

Criticality: Critical — surveillance capability is an absolute statutory prohibition; any violation undermines public trust in the entire program.

Roles: Department

Assessment Objectives

Determine if:

1. the Department receives no presentation-related traffic or signals during normal credential presentation;
2. if any Department-received signals exist (e.g., revocation status queries), individual presentation patterns cannot be inferred from them;
3. the architecture makes monitoring of presentation activity infeasible, not merely prohibited by policy;
4. no unique identifier in the credential enables the Department to correlate presentations;
5. no presentation transaction log is accessible to the Department.

Verification Methods

Objective coverage: AUTO → 1, 2, 4; EXPT → 3, 5; ADMN → 5

Assessment objects: System architecture diagrams showing presentation data flows; network traffic captures during presentation events; revocation status query protocol specification; Department system logs and data retention policies; access control configurations for presentation-related infrastructure; threat model documentation for surveillance vectors.

Statutory compliance: Automated testing is mandatory because the absence of Department-bound presentation traffic is a deterministic, observable network property.

SEDI-SDI-18: Purpose limitation

Information provided by an individual to the state to obtain a state-endorsed digital identity may only be [...] used for the purpose of issuing and managing a state-endorsed digital identity [or] used as authorized by the individual.

Utah Code §§ 63A-20-301(4)(a), 301(4)(b)

Requirement: Application data collected during identity proofing and issuance SHALL be used only for the purpose of issuing and managing a SEDI, or as expressly authorized by the individual, and SHALL NOT be accessible to Department systems outside the SEDI program. The mechanism for enforcing purpose limitation (e.g., access controls, data tagging, logical separation) is an implementation choice.

Criticality: Critical — purpose limitation is a statutory data protection mandate; violation exposes identity data to unauthorized use across government systems.

Roles: Department

Assessment Objectives

Determine if:

1. application data collected during identity proofing and issuance is used only for the purpose of issuing and managing a SEDI;
2. application data is not accessible to Department systems outside the SEDI program;
3. access control configurations restrict application data to SEDI program systems;
4. access attempts from non-SEDI system accounts are denied.

Verification Methods

Objective coverage: AUTO → 1, 3, 4; EXPT → 2, 3; ADMN → 2

Assessment objects: Access control configuration for SEDI application data stores; purpose-limitation tagging implementation in data schemas; data flow architecture diagrams; inter-system integration agreements and data sharing contracts; access denial logs from non-SEDI system accounts; Department organizational chart mapping SEDI program boundaries.

Statutory compliance: Automated testing is mandatory because access control enforcement and purpose-limitation tagging are deterministic, testable system properties.

SEDI-SDI-19: Individual authorization

Information provided by an individual to the state to obtain a state-endorsed digital identity may only be [...] (b) used as authorized by the individual.

Utah Code § 63A-20-301(4)(b)

Requirement: Beyond the issuance purpose (SDI-18), identity information MAY be used for other purposes if and only if the individual has expressly authorized such use. Authorization SHALL be per-purpose, affirmative, and revocable.

Criticality: Critical — unauthorized use of identity data violates the statute's individual consent mandate.

Roles: Department

Assessment Objectives

Determine if:

1. the system enforces per-purpose authorization before any non-issuance use of identity information;
2. authorization is affirmative (no pre-checked defaults or opt-out models);
3. authorization is per-purpose (not a blanket consent covering multiple uses);
4. authorization is revocable by the individual;
5. revocation of authorization immediately blocks further access for the revoked purpose.

Verification Methods

Objective coverage: AUTO → 1, 2, 4, 5; EXPT → 2, 3, 4; ADMN → 3, 5

Assessment objects: Consent flow user interface designs and implementation; authorization management API and data model; per-purpose authorization records; authorization revocation workflow and audit logs; consent language and presentation; data access logs correlated with authorization status.

Statutory compliance: Automated testing is mandatory because per-purpose authorization enforcement and revocability are deterministic system behaviors.

SEDI-SDI-20: Retention limitation

[Information may be] retained as long as necessary to issue and manage a state-endorsed digital identity.

Utah Code § 63A-20-301(4)(c)

Requirement: Application data SHALL be subject to a defined retention schedule. Data no longer necessary SHALL be deleted.

Criticality: High — retaining data beyond necessity violates the statute and increases breach exposure, but specific retention violations are correctable.

Roles: Department

Assessment Objectives

Determine if:

1. a defined retention schedule exists for application data;
2. data no longer necessary for SEDI issuance and management is deleted;
3. automated enforcement mechanisms flag or delete data past the maximum retention period;
4. deletion covers all storage locations, including primary storage, backups, and replicas.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 1, 4; ADMN → 1, 4

Assessment objects: Data retention schedule documentation; automated deletion job configuration and execution logs; storage inventory covering primary, backup, and replica locations; deletion audit trails; data lifecycle management policy; backup purge schedules and verification records.

Statutory compliance: Automated enforcement is mandatory because retention schedule enforcement and data deletion are programmable system operations.

SEDI-SDI-21: In-state data storage

[Information shall be] maintained within a state-controlled data center located within the state.

Utah Code § 63A-20-301(4)(d)

Requirement: Application and identity proofing data SHALL be stored exclusively within state-controlled data centers in Utah.

Criticality: Critical — out-of-state storage violates the statute's data sovereignty mandate for application data.

Roles: Department

Assessment Objectives

Determine if:

1. application and identity proofing data is stored exclusively within state-controlled data centers in Utah;
2. all primary storage locations are within state-controlled Utah data centers;
3. all backup and replica storage locations are within state-controlled Utah data centers;
4. no cloud or out-of-state replication exists for application data.

Verification Methods

Objective coverage: AUTO → 1, 2; EXPT → 1, 2, 3, 4; ADMN → 3, 4

Assessment objects: Storage infrastructure inventory with physical location records; data center contracts and cloud service configurations; backup and replication policies; network storage monitoring logs; on-site audit reports for all storage locations; change management records for storage infrastructure.

Statutory compliance: Expert audit is mandatory because physical storage location requires on-site verification that automated monitoring alone cannot conclusively provide.

SEDI-SDI-22: Disclosure restrictions

[Information may be] disclosed to: (i) the subject of the record or the subject's digital guardian; or (ii) a person with a warrant or court order.

Utah Code § 63A-20-301(4)(e)

Requirement: Application data SHALL NOT be disclosed except to: (a) the data subject or their digital guardian, or (b) pursuant to a valid warrant or court order. No administrative subpoena, informal request, or inter-agency sharing suffices.

Criticality: Critical — unauthorized disclosure violates statutory privacy protections and may expose individuals to harm.

Roles: Department

Assessment Objectives

Determine if:

1. application data is not disclosed except to the data subject or their digital guardian;
2. application data is not disclosed except pursuant to a valid warrant or court order;
3. no bulk export capability exists for application data;
4. no pathway exists for administrative subpoena, informal request, or inter-agency sharing of application data;
5. audit logs capture every disclosure event;
6. each warrant/court order disclosure is reviewed for legal validity before execution.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 5; EXPT → 4; ADMN → 2, 6

Assessment objects: Access control configuration for application data stores; disclosure audit logs; data subject and digital guardian access interface; warrant/court order disclosure procedures and legal review records; inter-system integration agreements; bulk export capability assessment; data sharing policy documentation.

Statutory compliance: Automated testing is mandatory for access control enforcement, but warrant/court order validation inherently requires human legal review. The automated controls restrict all other disclosure pathways.

SEDI-SDI-23: Revocation constraints

The department may only revoke an individual's state-endorsed digital identity if: (a) the state-endorsed digital identity has been compromised; (b) the department's endorsement was: (i) issued in error; or (ii) based on fraudulent information; or (c) the holder requests [...] revocation.

Utah Code § 63A-20-301(5)

Requirement: Revocation SHALL be limited to the three enumerated grounds. The revocation system SHALL record the ground for revocation. No administrative revocation outside these grounds SHALL be technically possible.

Criticality: Critical — arbitrary revocation capability would give the Department power to disable an individual's identity credential without statutory basis.

Roles: Department

Assessment Objectives

Determine if:

1. revocation is limited to the three enumerated grounds: (a) compromise, (b) issuance error or fraud, (c) holder request;
2. the revocation API requires a reason code from the three enumerated grounds;
3. revocation with an invalid or missing reason code is rejected;
4. revocation records include the ground for revocation;
5. no administrative override or backdoor exists to revoke outside the three enumerated grounds.

Verification Methods

Objective coverage: AUTO → 2, 3, 4; EXPT → 1, 5; ADMN → 1, 2, 3, 4

Assessment objects: Revocation API specification and reason code enumeration; revocation system architecture documentation; revocation audit logs with reason codes; conformance test suite covering valid and invalid revocation attempts; administrative access controls for the revocation system; disputed revocation case records.

Statutory compliance: Automated testing is mandatory because reason code enforcement is a deterministic system constraint that can be fully validated by test suites.

SEDI-SDI-24: Breach reporting

The department shall report a data breach regarding individual identity or identity attributes in accordance with Section Utah Code § 63A-19-405.

Utah Code § 63A-20-301(6)

Requirement: The Department SHALL maintain breach detection capabilities and follow the reporting procedures in Section Utah Code § 63A-19-405.

Criticality: High — Failure to detect or report breaches exposes individuals to identity compromise and violates statutory reporting obligations.

Roles: Department

Assessment Objectives

Determine if:

1. intrusion detection and anomaly monitoring systems are operational and covering SEDI infrastructure;
2. alerting pipelines trigger on breach indicators;
3. logging infrastructure captures events required for breach determination;
4. incident response procedures reference Section Utah Code § 63A-19-405 timelines and notification requirements;
5. a detection-to-reporting pipeline exists and is tested;
6. the incident response plan is current and staff are trained on breach reporting procedures.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 4, 5; ADMN → 6

Assessment objects: Intrusion detection system configuration and coverage maps; alerting pipeline configuration and test results; logging infrastructure and event capture policies; incident response plan and Section Utah Code § 63A-19-405 compliance mapping; tabletop exercise or red-team assessment reports; staff training records for breach reporting; prior breach report filings and timeline compliance records.

Statutory compliance: Expert review is mandatory because breach reporting compliance requires human assessment of detection coverage, response procedures, and alignment with Section Utah Code §  63A-19-405 timelines. Automated monitoring supplements by verifying detection infrastructure is operational.

Architectural Tensions

The following design tensions arise from the interplay of requirements in Section Utah Code § 63A-20- 301:

Tension 1: Offline Presentation and Revocation Checking

SEDI-SDI-06 requires offline presentation (no internet). SEDI-SDI-01 requires compromise detection (revocation status). If verification works offline, how is revocation status checked? Options include: short-lived credentials requiring periodic renewal, embedded revocation epochs, device-cached status lists, or acceptance of bounded staleness in offline scenarios.

Tension 2: Anti-Surveillance and Revocation Infrastructure

SEDI-SDI-17 prohibits the Department from inferring presentation patterns. SEDI-SDI-01 requires a revocation mechanism. If verifiers check revocation status against a Department-operated service, the Department could potentially infer presentation activity from query patterns. The revocation mechanism must be designed so that status queries do not reveal which specific credential is being presented (e.g., via status lists downloaded in bulk rather than queried per-credential).

Tension 3: Wallet Portability and Tamper Resistance

SEDI-SDI-09 (wallet choice) and Utah Code § 63A-20-301(2)(g)(i)(E) (migration between wallets) require that credentials and key material be portable. Utah Code § 63A-20-401(1)(d) (tamper resistance) requires that wallets protect key material from unauthorized extraction. These are in tension: key material must be exportable for migration but protected from theft.

Tension 4: Verifier/Relying Party Separation

The statute defines distinct roles for verifiers (cryptographic verification, Utah Code § 63A-20- 501) and relying parties (trust decisions based on verified assertions, Utah Code 63A-20- 601). Some deployments may combine these roles; others may separate them (e.g., a cloud verification service used by multiple relying parties).

63A-20-302: Application and Eligibility

Utah Code § 63A-20-302 and Utah Code § 63A-20-303 establish who may obtain a SEDI, how they apply, and the standards for identity proofing. The identity proofing requirements are deliberately aligned with "generally accepted identity proofing standards" (Utah Code § 63A-20-303(1)(a)(i)). NIST SP 800-63-4 (Digital Identity Guidelines) is the primary reference framework for identity proofing assurance levels in this chapter.

EXPTApplication and Eligibility

SEDI-APP-01: Age and emancipation eligibility

An individual who is at least 18 years old, or is an emancipated minor, may apply to the department for a state-endorsed digital identity.

Utah Code § 63A-20-302(1)

Requirement: The application system SHALL verify the applicant meets age/emancipation eligibility as part of the application workflow.

Criticality: Critical — Failure to enforce age/emancipation eligibility would allow ineligible individuals into the SEDI program, undermining statutory enrollment criteria.

Roles: Department

Assessment Objectives

Determine if:

1. an age eligibility check is part of the application workflow;
2. applicants under 18 who are not emancipated minors are rejected;
3. an emancipated minor pathway exists and accepts valid emancipation documentation;
4. age boundary conditions are handled correctly (e.g., boundary dates, timezone handling, leap years).

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 4; ADMN → 3

Assessment objects: Application workflow source code and configuration; age eligibility check implementation; emancipation verification logic and documentation requirements; conformance test suite covering age boundary conditions; application rejection logs with reason codes.

Statutory compliance: Automated testing is mandatory because age/emancipation checks are deterministic logic enforceable in code; expert review is recommended for edge-case validation.

SEDI-APP-02: Guardian consent for minors

An individual who is under 18 years old, and is not an emancipated minor, may apply to the department for a state-endorsed digital identity only with the consent of the individual's digital guardian.

Utah Code § 63A-20-302(2)

Requirement: The application system SHALL implement a guardian consent workflow for minor applicants. Consent SHALL be verified before proceeding with identity proofing.

Criticality: Critical — Processing a minor's application without guardian consent violates statutory protections for minors.

Roles: Department

Assessment Objectives

Determine if:

1. a guardian consent workflow exists for minor applicants;
2. no minor application proceeds without verified guardian consent;
3. the guardian's identity is verified before consent is accepted;
4. the consent workflow cannot be bypassed or skipped;
5. guardian consent records are retained and auditable.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 4; ADMN → 5

Assessment objects: Guardian consent workflow implementation and user interface; guardian identity verification procedures; consent record storage and audit trail; application workflow logic for minor applicants; conformance test suite covering consent bypass attempts.

Statutory compliance: Automated testing is mandatory because the consent gate is a deterministic workflow control; expert review is recommended to verify no bypass paths exist.

SEDI-APP-03: Guardian-initiated applications

If an individual is unable to apply for a state-endorsed digital identity due to the individual's youth or incapacitation, the application may be made on behalf of that individual by the individual's digital guardian.

Utah Code § 63A-20-302(3)

Requirement: The application system SHALL support guardian-initiated applications with appropriate identity verification of both the guardian and the subject.

The digital guardian applying on behalf of a minor or incapacitated individual SHALL provide: (a) identification, as required by the Department; and (b) the consent of the incapacitated individual, as required by the Department (Utah Code § 63A-20-302(3)(b)).

Criticality: High — Absent guardian-initiated pathways, vulnerable populations (minors, incapacitated individuals) would be excluded from SEDI.

Roles: Department

Assessment Objectives

Determine if:

1. a guardian-initiated application pathway exists for minors and incapacitated individuals;
2. the guardian's identity is verified as part of the guardian-initiated application;
3. the subject's identity is verified as part of the guardian-initiated application;
4. guardian authorization (identification and, where applicable, consent of the incapacitated individual) is validated before the application proceeds;
5. the guardian-initiated pathway resists abuse scenarios (e.g., unauthorized guardianship claims).

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 5; ADMN → 4

Assessment objects: Guardian-initiated application workflow implementation; guardian and subject identity verification procedures; guardian authorization validation logic; guardian documentation requirements; conformance test suite covering guardian-initiated flows; abuse scenario analysis documentation.

Statutory compliance: Automated testing is mandatory because the guardian application pathway is a distinct technical workflow; expert review is recommended for abuse-resistance analysis.

SEDI-APP-04: No mandatory enrollment

An individual is not required to apply for or obtain a state-endorsed digital identity.

Utah Code § 63A-20-302(5)

Requirement: The SEDI program SHALL NOT make enrollment a prerequisite for any government service or benefit. No system SHALL assume SEDI possession.

Criticality: Critical — Making SEDI mandatory would violate the statute and erode public trust in the voluntary nature of the program.

Roles: Department, Governmental Entities

Assessment Objectives

Determine if:

1. no government service or benefit requires SEDI enrollment as a prerequisite;
2. no system assumes SEDI possession for service delivery;
3. system designs do not default to SEDI-only pathways;
4. integration agreements include non-SEDI fallback requirements.

Verification Methods

Objective coverage: ADMN → 1, 2, 3, 4

Assessment objects: Government service enrollment policies and intake procedures; system integration agreements and onboarding specifications; service workflow diagrams showing identity acceptance pathways; Department guidance to governmental entities on non-mandatory enrollment; complaint and reporting channel for mandatory enrollment incidents.

Statutory compliance: Only administrative verification is feasible because whether government services require or assume SEDI is a policy and operational commitment, not a property of the SEDI system itself.

SEDI-APP-05: Three eligibility criteria

To apply for or receive a state-endorsed digital identity, an applicant shall: (a) have lawful presence in the United States; (b) be a resident of Utah; and (c) successfully complete the department's identity proofing process established under this part.

Utah Code § 63A-20-302(6)

Requirement: The application system SHALL verify all three eligibility criteria. Failure of any criterion SHALL result in denial with a specific reason code.

Criticality: Critical — Issuing SEDIs to ineligible applicants undermines the statutory foundation of the program.

Roles: Department, Identity Proofing Entities

Assessment Objectives

Determine if:

1. the application system verifies lawful presence in the United States;
2. the application system verifies Utah residency;
3. the application system verifies successful completion of the Department's identity proofing process;
4. failure of any single criterion results in denial;
5. denial responses include a specific reason code for the failed criterion.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 5; EXPT → 4, 5; ADMN → 1, 2, 3, 4, 5

Assessment objects: Eligibility verification logic and configuration; lawful presence verification data sources and integration; Utah residency verification procedures; identity proofing completion confirmation workflow; denial reason code enumeration and mapping to criteria; application decision logs with reason codes.

Statutory compliance: Automated testing is mandatory because eligibility checks are deterministic logic with clear pass/fail criteria enforceable in code.

SEDI-APP-06: Data minimization in application

The department may not require collection of information that is not necessary to verify identity or eligibility.

Utah Code § 63A-20-302(7)(a)

Requirement: Data collection during application SHALL be limited to the minimum necessary for identity proofing and eligibility verification. No supplementary data collection (marketing, analytics, profiling) SHALL occur during the application process.

Criticality: High — Over-collection of personal data during application creates privacy risk and violates statutory data minimization requirements.

Roles: Department

Assessment Objectives

Determine if:

1. data collection during application is limited to the minimum necessary for identity proofing and eligibility verification;
2. no supplementary data collection (marketing, analytics, profiling) occurs during the application process;
3. each collected data field has a documented justification tied to identity proofing or eligibility verification;
4. no application form field or API payload field lacks a mapping to identity proofing or eligibility requirements.

Verification Methods

Objective coverage: AUTO → 4; EXPT → 1, 2, 3, 4; ADMN → 3, 4

Assessment objects: Application form schemas and API payload definitions; data field-to-requirement mapping documentation; data collection justification records for each field; application data flow diagrams; privacy impact assessment covering data minimization.

Statutory compliance: Expert review is mandatory because determining whether a data field is "necessary" requires contextual judgment that cannot be fully automated; automated scanning is recommended for detecting obvious over-collection.

SEDI-APP-07: Enumerated data collection fields

Required information may include, as determined by the department and documented by rule: [...] the applicant's true and full legal name; date of birth; Utah residence address; evidence of lawful presence in the United States; evidence of Utah residency; and other information strictly necessary to complete identity proofing.

Utah Code § 63A-20-302(7)(b)

Requirement: The application form SHALL collect only the enumerated categories of information, plus other information "strictly necessary" for identity proofing. Any additional field beyond the enumerated categories SHALL be justified in the Department's published rules.

Criticality: High — Collecting fields outside the enumerated categories without published justification violates statutory constraints on data collection.

Roles: Department

Assessment Objectives

Determine if:

1. the application form collects the holder's true legal name;
2. the application form collects the holder's date of birth;
3. the application form collects the holder's Utah residence address;
4. the application form collects evidence of lawful presence;
5. the application form collects evidence of Utah residency;
6. any additional fields beyond the enumerated categories are justified in published Department rules;
7. no form field exists that is not mapped to an enumerated category or justified as "strictly necessary" for identity proofing.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 5, 7; EXPT → 6, 7; ADMN → 6

Assessment objects: Application form schemas and field inventories; enumerated category mapping for each field; published Department rules justifying non-enumerated fields; conformance test suite validating field presence and absence; application data flow documentation.

Statutory compliance: Expert review is mandatory because determining whether non-enumerated fields are "strictly necessary" requires subject-matter judgment; automated scanning is recommended for structural verification against the enumerated list.

Utah Code § 63A-20-303: Identity Proofing

SEDI-IDP-01: Follow accepted proofing standard

Follow a generally accepted identity proofing standard. 

(Utah Code § 63A-20-303(1)(a)(i)

Requirement: Identity proofing SHALL align with a generally accepted identity proofing standard (e.g., NIST SP 800-63A or equivalent). The identity assurance level SHALL be documented. The specific standard and assurance level SHALL be determined by the Department through rulemaking.

Criticality: Critical — Using a non-standard or undocumented proofing process undermines confidence in the entire SEDI credential.

Roles: Department, Identity Proofing Entities

Assessment Objectives

Determine if:

1. identity proofing procedures align with the identity proofing standard and assurance level;
2. the identity assurance level is documented;
3. the proofing procedures meet the claimed assurance level.

Verification Methods

Objective coverage: AUTO → 1; EXPT → 1, 2, 3; ADMN → 2

Assessment objects: Identity proofing procedure documentation; referenced proofing standard specification; Department rulemaking defining the selected standard and assurance level; proofing entity operational procedures; conformance test suite mapping to standard requirements; assurance level documentation.

Statutory compliance: Expert review is mandatory because assessing conformance to a proofing standard requires subject-matter expertise that cannot be fully automated; automated checks are recommended for structural alignment verification.

SEDI-IDP-02: Risk-commensurate proofing

Commensurate with the risks of impersonation, fraud, and misuse. 

(Utah Code § 63A-20-303(1)(a)(ii)

Requirement: The Department SHALL conduct a risk assessment to determine the appropriate identity proofing assurance level, considering the consequences of impersonation, fraud, and credential misuse.

Criticality: High — A proofing level that is disproportionate to the risk either under-protects holders (too low) or creates unnecessary barriers (too high).

Roles: Department

Assessment Objectives

Determine if:

1. the Department has conducted a risk assessment addressing impersonation, fraud, and credential misuse;
2. the risk assessment methodology is documented and sound;
3. the selected identity proofing assurance level is proportionate to the assessed risks;
4. the risk assessment is periodically reviewed and updated.

Verification Methods

Objective coverage: EXPT → 1, 2, 3; ADMN → 1, 4

Assessment objects: Risk assessment documentation and methodology; threat analysis covering impersonation, fraud, and misuse scenarios; assurance level selection rationale; risk assessment review schedule and update history; comparable risk assessments from peer jurisdictions (informative).

Statutory compliance: Expert review is mandatory because evaluating whether a proofing level is "commensurate with the risks" requires security and risk-assessment expertise.

SEDI-IDP-03: Privacy-consistent proofing

Consistent with the privacy, civil liberties, and security requirements of this chapter. 

(Utah Code § 63A-20-303(1)(a)(iii)

Requirement: Identity proofing procedures SHALL NOT require collection of biometric data beyond what is strictly necessary. Proofing SHALL NOT create surveillance risks (e.g., persistent biometric databases beyond retention requirements).

Criticality: Critical — Privacy-invasive proofing practices could violate the Bill of Rights and expose the program to legal challenge.

Roles: Department, Identity Proofing Entities

Assessment Objectives

Determine if:

1. identity proofing procedures do not require collection of biometric data beyond what is strictly necessary;
2. biometric data collected during proofing has a defined retention and deletion schedule;
3. biometric data is deleted according to the defined retention schedule;
4. proofing procedures do not create persistent surveillance risks (e.g., persistent biometric databases beyond retention requirements);
5. a privacy impact assessment covering biometric data handling has been completed.

Verification Methods

Objective coverage: AUTO → 3; EXPT → 1, 2, 4; ADMN → 5

Assessment objects: Identity proofing data collection inventory including biometric data types; biometric data retention schedule and deletion procedures; biometric data storage infrastructure and access controls; privacy impact assessment documentation; proofing entity biometric data handling agreements; deletion verification records.

Statutory compliance: Expert review is mandatory because privacy and civil liberties alignment requires contextual judgment about what data collection is "strictly necessary" and whether surveillance risks exist.

SEDI-IDP-04: Four verified assertions

The proofing process shall establish that: (i) the applicant is a real individual; (ii) the applicant is the claimed individual; (iii) the birth date is as claimed; (iv) the applicant meets eligibility requirements.

Utah Code § 63A-20-303(1)(b)

Requirement: Identity proofing SHALL produce, at minimum, four verified assertions: (a) liveness/existence, (b) identity binding, (c) birth date verification, (d) eligibility confirmation.

Criticality: Critical — Missing any of the four assertions invalidates the proofing outcome and the resulting SEDI.

Roles: Department, Identity Proofing Entities

Assessment Objectives

Determine if:

1. the proofing process establishes that the applicant is a real individual (liveness/existence);
2. the proofing process establishes that the applicant is the claimed individual (identity binding);
3. the proofing process verifies the applicant's birth date;
4. the proofing process confirms the applicant meets eligibility requirements;
5. incomplete assertions (any of the four missing) block SEDI issuance.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 5; EXPT → 1, 2; ADMN → 1, 2, 3, 4

Assessment objects: Identity proofing workflow documentation and implementation; liveness detection mechanism; identity binding procedures against authoritative sources; birth date verification logic; eligibility confirmation workflow; issuance decision gate requiring all four assertions; proofing entity operational procedures.

Statutory compliance: Automated testing is mandatory because the presence of four distinct assertion checks is a structural property of the proofing workflow that can be verified programmatically.

SEDI-IDP-05: Sufficient for age assurance reliance

Credential provides sufficient confidence for reliance by governmental entities and private-sector relying parties where required by law or policy for online age assurance. 

(Utah Code § 63A-20-303(1)(c)(i)

Requirement: The identity proofing assurance level SHALL be sufficient for relying parties to accept the SEDI for age-gated services. This implies at minimum a level of assurance where the proofing outcome is trusted by both government and private sector.

Criticality: High — Insufficient assurance level would render SEDI unusable for its primary statutory use case of age verification.

Roles: Department

Assessment Objectives

Determine if:

1. the identity proofing assurance level is documented as sufficient for age assurance use cases;
2. the assurance level is sufficient for reliance by governmental entities for online age assurance;
3. the assurance level is sufficient for reliance by private-sector relying parties where required by law or policy;
4. relying party guidance on SEDI assurance levels is published.

Verification Methods

Objective coverage: EXPT → 1, 2, 3; ADMN → 1, 4

Assessment objects: Assurance level documentation and rationale; relying party guidance documents; trust framework documentation; age assurance use case analysis; comparable assurance level determinations from peer programs (informative).

Statutory compliance: Expert review is mandatory because evaluating whether an assurance level provides "sufficient confidence" for age-gated reliance requires security and standards expertise.

SEDI-IDP-06: Online and offline suitability

Appropriate for use in both online and offline presentations. 

(Utah Code § 63A-20-303(1)(c)(ii)

Requirement: Identity proofing requirements SHALL be the same regardless of whether the resulting SEDI will be used in online or offline presentations.

Criticality: Medium — A tiered proofing approach would not directly compromise security but would create unnecessary complexity and potential confusion.

Roles: Department

Assessment Objectives

Determine if:

1. identity proofing requirements are the same regardless of whether the resulting SEDI will be used online or offline;
2. no separate proofing tier or workflow branch exists based on intended presentation mode;
3. proofing procedures produce credentials that are technically suitable for both online and offline presentation.

Verification Methods

Objective coverage: AUTO → 2; EXPT → 1, 3; ADMN → 1

Assessment objects: Proofing workflow documentation covering online and offline credential issuance; proofing rules and administrative procedures; credential schema documentation confirming mode-independent design; conformance test suite covering both presentation modes.

Statutory compliance: Expert review is mandatory because assessing whether proofing is "appropriate for use" in both modes requires evaluating the resulting credential's technical properties.

SEDI-IDP-07: Point-in-time endorsement

The state's endorsement reflects verification at a point in time and does not require continuous monitoring or tracking.

Utah Code § 63A-20-303(1)(d)

Requirement: The SEDI SHALL represent a point-in-time endorsement. The system SHALL NOT require ongoing re-verification of the holder's identity or attributes outside of defined renewal cycles. No continuous monitoring or tracking of the holder is permitted as a condition of maintaining a valid SEDI.

Criticality: Critical — Continuous monitoring or tracking would violate the anti-surveillance principles foundational to the SEDI program.

Roles: Department

Assessment Objectives

Determine if:

1. the SEDI represents a point-in-time endorsement, not a continuously verified status;
2. no continuous re-verification of the holder's identity or attributes is required outside defined renewal cycles;
3. no "heartbeat," "check-in," or periodic callback mechanism is required for SEDI validity;
4. no continuous monitoring or tracking of the holder occurs as a condition of maintaining a valid SEDI;
5. renewal is periodic (not continuous) and occurs at defined intervals.

Verification Methods

Objective coverage: AUTO → 2, 3, 5; EXPT → 1, 4; ADMN → 1, 4

Assessment objects: Credential lifecycle specification and renewal procedures; system architecture diagrams showing absence of continuous monitoring; protocol analysis showing no holder-to-Department callbacks during normal use; Department policies documenting point-in-time endorsement; renewal schedule documentation.

Statutory compliance: Automated testing is mandatory because the absence of continuous monitoring is a structural property of the system verifiable through protocol and API analysis.

SEDI-APP-08: Fraud prohibition

Knowingly providing materially false information for the purpose of obtaining a state-endorsed digital identity constitutes fraud and may result in denial, revocation, and other remedies provided by law.

Utah Code § 63A-20-303(2)(b)

Requirement: The application system SHOULD implement controls to detect materially false information where feasible. Denial and revocation procedures SHALL be established for cases of confirmed fraud.

Criticality: High — Undetected fraud undermines the trustworthiness of SEDIs issued to all holders.

Roles: Department

Assessment Objectives

Determine if:

1. controls exist to detect materially false information in applications, where feasible;
2. denial procedures are established for cases of confirmed fraud;
3. revocation procedures are established for SEDIs obtained through fraud;
4. a fraud referral process exists for law enforcement coordination;
5. fraud cases are tracked and resolved.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 1; ADMN → 2, 3, 4, 5

Assessment objects: Fraud detection control documentation and configuration; denial and revocation procedures for fraud cases; fraud referral process documentation; fraud case tracking system and resolution records; application verification data sources; Department administrative rules addressing fraud.

Statutory compliance: Only administrative verification is mandatory because detecting "materially false information" requires human judgment and cross-referencing with external data sources; automated and expert methods are recommended supplements.

SEDI-IDP-09: No physical document surrender

An individual is not required to surrender, cancel, or replace any physical identity document as a condition of applying for or holding a SEDI.

Utah Code § 63A-20-303(3)(b)

Requirement: The application process SHALL NOT include any step requiring physical document surrender, cancellation, or replacement.

Criticality: High — Requiring physical document surrender would deter SEDI adoption and violate statutory protections.

Roles: Department

Assessment Objectives

Determine if:

1. the application process does not include any step requiring physical document surrender;
2. the application process does not include any step requiring physical document cancellation;
3. the application process does not include any step requiring physical document replacement;
4. enrollment procedures explicitly prohibit document surrender requirements.

Verification Methods

Objective coverage: EXPT → 1, 2, 3; ADMN → 1, 2, 3, 4

Assessment objects: Application workflow documentation and user interface; enrollment center operating procedures; staff training materials addressing document handling; applicant-facing instructions and disclosures; complaint records related to document surrender requests.

Statutory compliance: Administrative verification is mandatory because the prohibition is a procedural policy enforced through process design and training, not a technical control.

SEDI-IDP-10: Multiple proofing methods

Rules shall describe acceptable methods: in-person, remote, or hybrid methods, and conditions under which each may be used. 

(Utah Code § 63A-20-303(4)(b)(ii)(A)

Requirement: The Department SHALL define through rulemaking which identity proofing methods are acceptable and the conditions for each. At minimum, in-person and at least one remote or hybrid method SHOULD be supported for accessibility.

Criticality: High — A single proofing method would exclude populations unable to use that method, reducing program accessibility.

Roles: Department

Assessment Objectives

Determine if:

1. the Department has defined through rulemaking which identity proofing methods are acceptable;
2. conditions under which each method may be used are specified;
3. at least in-person proofing is supported;
4. at least one remote or hybrid method is supported for accessibility;
5. each defined method is operationally available.

Verification Methods

Objective coverage: AUTO → 3, 4, 5; EXPT → 1, 2, 4; ADMN → 1, 5

Assessment objects: Department administrative rules defining proofing methods; proofing method condition specifications; proofing entity operational capabilities inventory; accessibility analysis for each proofing method; system support documentation for in-person, remote, and hybrid proofing pathways.

Statutory compliance: Expert review is mandatory because evaluating whether the defined methods and conditions are appropriate requires subject-matter judgment about proofing standards and accessibility.

SEDI-IDP-11: Proofing entity authorization

Establish requirements and a process to become an identity proofing entity. 

(Utah Code § 63A-20-303(4)(b)(iv)

Requirement: The Department SHALL publish requirements for identity proofing entity authorization, including competency, security, and compliance criteria. A defined authorization process SHALL exist.

Criticality: High — Unauthorized or unqualified proofing entities would undermine the integrity of all SEDIs they issue.

Roles: Department

Assessment Objectives

Determine if:

1. the Department has published requirements for identity proofing entity authorization;
2. the requirements include competency, security, and compliance criteria;
3. a defined authorization process exists;
4. at least one authorized proofing entity exists at program launch;
5. a periodic re-authorization process exists for authorized entities.

Verification Methods

Objective coverage: EXPT → 2; ADMN → 1, 3, 4, 5

Assessment objects: Published proofing entity authorization requirements; authorization process documentation; proofing entity application and review records; authorized entity registry; re-authorization schedule and compliance records; competency and security criteria specifications.

Statutory compliance: Administrative verification is mandatory because proofing entity authorization is an organizational credentialing and oversight process; expert review is recommended to assess the adequacy of authorization criteria.

NIST SP 800-63-4 Alignment

The statute's reference to "generally accepted identity proofing standards" (Utah Code § 63A-20-303(1)(a)(i)) aligns naturally with NIST SP 800-63-4 (Digital Identity Guidelines), specifically Volume A (Identity Proofing and Enrollment). This section documents the conceptual mapping between SEDI identity proofing requirements and the NIST 800-63A framework.

This mapping is informative, not normative. The Department SHALL determine the specific assurance level and proofing procedures through rulemaking (SEDI-IDP-01). However, the structural alignment is strong enough that conformance profiles SHOULD reference NIST 800-63A when specifying identity proofing procedures.

Where SEDI goes beyond NIST 800-63:

• Anti-surveillance (SEDI-IDP-03, BOR-10): NIST 800-63A permits biometric collection with appropriate retention controls. SEDI's statutory prohibition on surveillance and tracking imposes stricter constraints on biometric data use during proofing.
• Point-in-time endorsement (SEDI-IDP-07): NIST 800-63 contemplates ongoing credential lifecycle management. The SEDI statute explicitly prohibits continuous monitoring as a condition of maintaining a valid credential.
• Independence from physical ID (SEDI-IDP-08): NIST does not address the relationship between digital and physical identity documents. The SEDI statute requires complete independence.
• Eligibility verification (SEDI-IDP-04(iv), SEDI-APP-05): NIST proofing verifies identity, not eligibility for a specific program. SEDI adds lawful presence and Utah residency as proofing objectives.

63A-20-304: Requirements for Governmental Entities

Utah Code § 63A-20-304 and Utah Code § 63A-20-305 impose specific obligations on governmental entities and large health care providers regarding SEDI acceptance, non-discrimination, and timelines.

SEDI-GOV-01: No material benefit for SEDI use

A governmental entity may not convey a material benefit upon an individual for using a state digital identity instead of a physical identity.

Utah Code § 63A-20-304(1)(a)

Requirement: Government systems SHALL NOT offer preferential treatment (faster processing, fee waivers, enhanced services) for SEDI users that is not available to physical identity users.

Criticality: High — Preferential treatment for SEDI users would create coercive pressure to adopt SEDI, undermining the voluntary nature of the program.

Roles: Governmental Entities

Assessment Objectives

Determine if:

1. no preferential treatment (faster processing, fee waivers, enhanced services) is offered to SEDI users that is not available to physical identity users;
2. no incentive programs are tied to SEDI adoption;
3. service-level documentation reflects parity between SEDI and physical identity users;
4. government service workflows do not include differential treatment based on identity format.

Verification Methods

Objective coverage: EXPT → 1, 2, 3, 4; ADMN → 1, 2, 3

Assessment objects: Government service-level agreements and documentation; fee schedules for SEDI and physical identity users; processing time metrics by identity format; incentive program inventories; government entity service workflow documentation; complaint records related to differential treatment.

Statutory compliance: Administrative verification is mandatory because service-level parity is an organizational policy commitment that cannot be enforced through technical controls alone; expert review is recommended for workflow analysis.

SEDI-GOV-02: No service withholding for physical ID

May not withhold services or benefits from an individual if the individual uses a physical identity or is otherwise unable to use a state digital identity.

Utah Code § 63A-20-304(1)(b)

Requirement: All government services that accept SEDI SHALL continue to accept physical identity. No service SHALL become SEDI-only.

Criticality: Critical — Withholding services from physical identity users would violate statutory protections and effectively compel SEDI adoption.

Roles: Governmental Entities

Assessment Objectives

Determine if:

1. all government services that accept SEDI continue to accept physical identity;
2. no service has become SEDI-only;
3. no service degradation exists for physical identity users compared to SEDI users;
4. complaint mechanisms exist for individuals denied service based on identity format.

Verification Methods

Objective coverage: EXPT → 1, 2; ADMN → 1, 2, 3, 4

Assessment objects: Government service integration specifications and acceptance point inventories; service-level documentation for SEDI and physical identity pathways; complaint and reporting channel documentation for service denial; government entity service catalogs; physical identity acceptance verification records.

Statutory compliance: Administrative verification is mandatory because maintaining physical identity acceptance alongside SEDI is an operational and process commitment by each governmental entity, not enforceable through technical controls alone.

SEDI-GOV-03: No device surrender

May not require a holder to surrender the holder's secure electronic device in the course of a presentation.

Utah Code § 63A-20-304(1)(c)

Requirement: Government verification procedures SHALL support contactless presentation. Training and procedures SHALL explicitly prohibit device confiscation.

Criticality: Critical — Device surrender creates physical security risks and enables potential unauthorized data extraction from the holder's device.

Roles: Governmental Entities

Assessment Objectives

Determine if:

1. contactless presentation is supported in the verification protocol;
2. no device docking or wired connection is required for verification;
3. government verification hardware supports contactless presentation;
4. training materials and procedures explicitly prohibit device surrender requests.

Verification Methods

Objective coverage: AUTO → 1, 2; EXPT → 3; ADMN → 4

Assessment objects: Verification protocol specification confirming contactless support; government verification hardware specifications and deployment guides; staff training materials addressing device handling; government entity operating procedures; complaint records related to device surrender requests.

Statutory compliance: Automated testing is mandatory because contactless verification is a protocol-level property verifiable through specification and testing.

SEDI-GOV-04: New systems must accept SEDI

A governmental entity that, on or after May 6, 2026, implements a new system that accepts a digital identity shall, within three months after the day on which the department issues the first state-endorsed digital identity, accept a state-endorsed digital identity.

Utah Code § 63A-20-304(2)(a)

Requirement: Government entities implementing new digital identity acceptance systems after May 6, 2026 SHALL integrate SEDI acceptance within three months of the first SEDI issuance.

Criticality: High — Failure to integrate SEDI in new systems undermines the statutory mandate for SEDI acceptance by government.

Roles: Governmental Entities

Assessment Objectives

Determine if:

1. new systems implemented on or after May 6, 2026 that accept a digital identity include SEDI acceptance;
2. SEDI acceptance is integrated within three months after the first SEDI issuance;
3. SEDI integration includes functional acceptance endpoints and completes the presentation protocol;
4. government entities track new system implementations and their SEDI integration timelines.

Verification Methods

Objective coverage: AUTO → 3; EXPT → 1, 2, 3; ADMN → 2, 4

Assessment objects: Government entity new system implementation registry; SEDI integration timeline tracking records; conformance test suite results for new system SEDI acceptance; system launch dates and first SEDI issuance date correlation; SEDI acceptance endpoint documentation for new systems.

Statutory compliance: Expert review is mandatory because assessing whether a system was "implemented" after the statutory date and whether SEDI acceptance is complete requires contextual judgment about system lifecycle and integration scope.

SEDI-GOV-05: Technical infeasibility exemption

A governmental entity is not required to accept SEDI if: (i)(A) it demonstrates technical infeasibility and (B) provides a plan for acceptance as soon as feasible; or (ii) is required by law to accept only a specific form.

Utah Code § 63A-20-304(2)(b)

Requirement: Governmental entities claiming technical infeasibility SHALL document the specific barriers and provide a remediation timeline to the Department.

Criticality: Medium — The exemption is a legitimate safety valve; the risk is in its overuse or insufficient remediation planning.

Roles: Governmental Entities

Assessment Objectives

Determine if:

1. governmental entities claiming technical infeasibility document the specific barriers;
2. a remediation timeline is provided to the Department;
3. the Department has reviewed and accepted the infeasibility claim;
4. remediation progress is tracked against the stated timeline;
5. entities claiming a legal requirement for a specific identity form provide the applicable statutory citation.

Verification Methods

Objective coverage: EXPT → 1, 2; ADMN → 1, 2, 3, 4, 5

Assessment objects: Technical infeasibility documentation and barrier descriptions; remediation plans with timelines; Department review records for infeasibility claims; remediation progress reports; statutory citations for specific identity form requirements; government entity correspondence with the Department.

Statutory compliance: Administrative verification is mandatory because demonstrating technical infeasibility and providing a remediation plan are documentation and planning exercises; expert review is recommended to evaluate the validity of infeasibility claims.

Utah Code § 63A-20-305: Requirements for Health Care Providers

SEDI-GOV-06: Health care provider SEDI acceptance

Within two years from the date the first SEDI is issued, a health care provider that receives at least $10,000,000 a year in public funding shall accept a SEDI if the health care provider has a program or system that accepts a digital identity.

Utah Code § 63A-20-305(1)

Requirement: Qualifying health care providers (>=$10M public funding, existing digital ID system) SHALL integrate SEDI acceptance within two years of first SEDI issuance.

Criticality: High — Failure to integrate SEDI in qualifying health care systems undermines the statutory mandate for health care SEDI acceptance.

Roles: Health Care Providers

Assessment Objectives

Determine if:

1. qualifying health care providers (>=$10M public funding with existing digital ID system) are identified;
2. qualifying providers integrate SEDI acceptance within two years of first SEDI issuance;
3. SEDI integration includes functional acceptance endpoints and completes the presentation protocol;
4. the Department maintains a registry of qualifying providers and tracks integration timelines.

Verification Methods

Objective coverage: AUTO → 3; EXPT → 1, 2, 3; ADMN → 1, 4

Assessment objects: Qualifying health care provider registry; public funding records and threshold verification; existing digital identity system inventory for each provider; SEDI integration timeline tracking records; conformance test suite results for provider SEDI acceptance; first SEDI issuance date and two-year deadline documentation.

Statutory compliance: Expert review is mandatory because determining whether a health care provider meets the qualifying criteria (funding threshold, existing digital ID system) and has integrated SEDI within the timeline requires contextual assessment.

SEDI-GOV-07: Health care infeasibility exemption

A health care provider is not required to accept a state-endorsed digital identity within the time frame described in Subsection Utah Code § 63A-20-305(1) if the health care provider: (a)(i) demonstrates to the satisfaction of the department that accepting a state-endorsed digital identity at that time is not technically feasible; and (ii) provides a plan for accepting a state-endorsed digital identity as soon as feasible; or (b) is required by law to only accept a specific form of state digital identity.

Utah Code § 63A-20-305(2)

Requirement: Same as SEDI-GOV-05, applied to health care providers.

Criticality: Medium — Same rationale as SEDI-GOV-05; the exemption is a legitimate safety valve with risk of overuse.

Roles: Health Care Providers

Assessment Objectives

Determine if:

1. health care providers claiming technical infeasibility demonstrate infeasibility to the satisfaction of the Department;
2. a remediation plan for accepting SEDI as soon as feasible is provided;
3. the Department has reviewed and is satisfied with the infeasibility demonstration;
4. remediation progress is tracked against the stated timeline;
5. providers claiming a legal requirement for a specific identity form provide the applicable statutory citation.

Verification Methods

Objective coverage: EXPT → 1, 2; ADMN → 1, 2, 3, 4, 5

Assessment objects: Technical infeasibility documentation from health care providers; remediation plans with timelines; Department review and satisfaction records; remediation progress reports; statutory citations for specific identity form requirements; health care provider correspondence with the Department.

Statutory compliance: Administrative verification is mandatory because demonstrating infeasibility and planning remediation are administrative processes; expert review is recommended to evaluate infeasibility claims.