Part 6: Identity Management (IdM) Landscape: IdM standards, organizations and gap analysis

​X.Sup7: ITU-T X.1250 - Supplement on overview of identity management in the context of cybersecurity

X Suppl. 22: ITU-T X.1144 - Supplement on enhancements and new features in eXtensible Access Control Markup Language (XACML 3.0)

X Suppl. 35: ITU-T X.1254 – Supplement on use cases of entity authentication assurance (EAA) framework

Work in progress includes:

X.1250rev: Baseline capabilities for enhanced global identity management and interoperability

X.1251rev: A framework for user control of digital identity

​X.gpwd: Threat Analysis and guidelines for securing password and password-less authentication solutions

X.oob-sa: Framework for out-of-band server authentication using mobile devices

X.pet_auth: Entity authentication service for pet animals using telebiometrics

X.srdidm​: Security requirements for decentralized identity management systems using distributed ledger technology

X.tas: Telebiometric authentication using speaker recognition

ITU-T SG2(Operational aspects)​

The following work has been completed:

E.217: Maritime communications - Ship Station identity

Work in progress includes:

TR.OTTnum: Current use of E.164 numbers as identifiers for OTTs

E.sup.OTTnum: Guidance on the use of E.164 numbers as identifiers for OTTs

E.IoT-NNAI: Internet of Things Naming Numbering Addressing and Identifiers

M.uiamr: User Identity and Access Management Requirements for Telecommunications Management Network

ITU-T SG3 (Economic and policy issues)

The following work has been completed:

D.1140 (D.DigID) | X.1261*: Policy framework including principles for digital identity infrastructure

* Dual numbering of the D.1140(SG3) as X.1261 (SG17)

Work in progress includes:

D.princip_bigdata: Policy framework and principles for data protection in the context of big data relating to international telecommunication services

Study_bigdata: Technical Paper on economic and policy aspects of Big Data in international telecommunication services and networks

ITU-T SG11 (Protocols and test specifications)

In SG11, identity management related work is undertaken by Question 2, Question 12, and Question 15 as follows:

a) Q2/11: Identity management on telecommunication equipment (such as trustable interconnection between network entities) and service (such as calling party line identity);

b) Q12/11: Identity management related to test of internet of things;

c) Q15/11: Identity management on combating counterfeit and stolen telecommunication/ICT devices.

The following work has been completed:

Q.5052 (ex Q.DEV_DUI) : Addressing mobile devices with duplicate unique identifier

Q.3062 (ex Q.Pro-Trust): Signalling procedures and protocols for enabling interconnection between trustable network entities in support of existing and emerging networks

Q.3063 (ex Q.CIDA): Signalling procedures of calling line identification authentication

ITU-T SG 13 (Future Networks)

In SG 13, identity management related work is undertaken by Question 22 (Networks beyond IMT2020: Emerging network technologies). The following work has been completed:

Y.2720: NGN identity management framework

Y.2721: NGN identity management requirements and use cases

Y.2722: NGN identity management mechanisms

Y.3081: Self-Controlled Identity based on Blockchain: Requirements and Framework

ITU-T SG16 ( Multimedia and digital technologies)

The following work has been completed:

H.642.3: Information technology – Automatic identification and data capture technique - Identifier resolution protocol for multimedia information access triggered by tag-based identification

ITU-T SG20 (IoT and smart cities and communities)

In SG 20, identity management related work is undertaken by Question 6. 

The following work has been completed:

Y.4462 (Y.IoT-ics): Requirements and functional architecture of Open IoT identity correlation service

Y.4476 (ex Y.IoT-rf-dlt)​: OID-based Resolution framework for transaction of distributed ledger assigned to IoT resources

Y.4500.3 (ex Y.oneM2M.SEC.SOL): oneM2M - Security Solutions

Y.4809 (ex Y.IoT-ITS-ID): Unified IoT Identifiers for intelligent transport systems

Y.4811: Reference framework of converged service for identification and authentication for IoT devices in a decentralized environment

​Work in progress includes:

Y.IoT-Smartcity-Risk: Reference framework of cybersecurity risk management of IoT ecosystems on smart cities

YSTR-IADIoT: Intelligent Anomaly Detection System for IoT

Y.IoT-IoD-PT: Identity of IoT devices based on secure procedures and ensures privacy and trust of IoT systems

YSTR.Feas-DID-IoT: Feasibility of Decentralised Identifiers (DIDs) in IoT

Y.FW.IC.MDSC: Framework of identification and connectivity of moving devices in smart city

Y.IoT-Ath-SC: Framework of IoT-devices authentication in smart city

YSTR.IoT-IMS: Requirements and capability framework for identification management service of IoT device

ISO/IEC JTC 1/SC 27 (Information security, cybersecurity and privacy protection)

The following work has been completed:

ITU-T X.1085 | ISO/IEC 17922 – Telebiometric authentication framework using biometric hardware security module was published as an International Standard (IS) in 2017-09 as common text with ITU-T.

ISO/IEC 20547-4 – Big data reference architecture – Part 4: Security and privacy was published as an International Standard (IS) in 2020-09. This is a project of WG 4, on which WG 5 had collaborated with a co-editor.​

ISO/IEC 20889 – Privacy enhancing data de-identification terminology and classification of techniques was published as an International Standard (IS) in 2018-11.

ISO/IEC 24745 – Biometric information protection has been published as an International Standard (IS) on 2011-06. The revision has been renamed Information security, cybersecurity and privacy protection – biometric information protection, and it has been published as an International Standard (IS) in 2022-02..

ISO/IEC 24760 – A Framework for identity management: Part 1 “Terminology and Concepts” was published in 2011-12. It is freely available at no cost via www.jtc1.org and was confirmed in 2017. An amendment resulted in a 2n edition published in 2019-06. A further amendment has been initiated at Committee Draft (CD) status in 2021-10 and was meanwhile progressed to Final Draft Amendment (FDAM) status. Part 2 “Reference architecture and requirements” was published as an International Standard (IS) in 2015-06. In 2020-10 a revision was initiated, and meanwhile progressed to Draft International Standard (DIS) status. Part 3 “Practice” was published as an International Standard (IS) in 2016-07 and confirmed in 2022-05. In parallel an amendment was initiated in 2020-10 and meanwhile progressed to Final Draft Amendment (FDAM) status. Part 4 “A framework for identity management” was initiated in 2020-09 and is being progressed to Working Draft (WD) status.

ISO/IEC 24761 – Authentication context for biometrics has been published as an IS in 2009-05 with a technical corrigendum published in 2013-03. Its 2nd edition was published in 2019-10 .

ISO/IEC TS 27006-2 (formerly 27558) – Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy Information Management Systems has been published as a Technical Specification (TS) in 2021-02. A revision towards an International Standard (IS) has been initiated in 2021-04 and remains at Committee Draft (CD) status..

ISO/IEC 27018 – Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors was first published as an International Standard (IS) in 2014-08. A minor revision was published in 2019-01. A revision of this standard considering the revision of 27001 and 27002 is being prepared.

ISO/IEC TR 27550 – Privacy engineering for system life cycle processes was published as a Technical Report (TR) in 2019-09.

ISO/IEC 27556 – User-centric privacy preferences management framework has been published as an International Standard (IS) in 2022-10.

ISO/IEC 27557 – Organizational privacy risk management has been published as an International Standard (IS) in 2022-11.

ISO/IEC 27559 – Privacy-enhancing data de-identification framework has been published as an International Standard (IS) in 2022-11.

ISO/IEC TS 27570 – Privacy guidelines for smart cities was published as Technical Specification (TS) in 2021-01.

ISO/IEC 27701 (formerly 27552) – Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines was published as an International Standard (IS) in 2019-08. A revision starting at DIS status has been initiated in 2022-10.

ISO/IEC TS 29003 – Identity proofing was published as a Technical Specification (TS) in 2018-03. In 2021-11 it was confirmed as Technical Specification (TS).​

ISO/IEC 29100 – Privacy framework was published as an International Standard (IS) in 2011-12 and confirmed in 2017-05. It is freely available at no cost via www.jtc1.org. An amendment was published in 2018-06. In 2002-10 a minor revision of 29100 was initiated​​.

ISO/IEC 29101 – Privacy architecture framework was first published as an International Standard (IS) in 2013-04. A 2nd edition was published in 2018-11.

ISO/IEC 29115 – Entity authentication assurance framework was published as an International Standard (IS) in 2013-04. After an approach towards its revision was cancelled 29115 was confirmed in 2020-09.

ISO/IEC 29134 – Privacy impact assessment was published as an International Standard (IS) in 2017-06. An amendment has been initiated and has progressed at Final Draft Amendment (FDAM) status. It is now being integrated as part of a revision initiated at DIS status.

ISO/IEC 29146 – A framework for access management was published as an International Standard (IS) in 2016-06 and confirmed in 2021-11. An amendment was published in 2022-08.

ITU-T X.1058 | ISO/IEC 29151 – Code of practice for personally identifiable information protection was published as an International Standard (IS) in 2017-08 as common text with ITU-T.

ISO/IEC 29184 – Guidelines for online privacy notices and consent was published as an International Standard (IS) in 2020-06.

ISO/IEC 29190 – Privacy capability assessment model was published as an International Standard (IS) in 2015-08- and confirmed in 2021-04​.

ISO/IEC 29191 – Requirements for partially anonymous, partially unlinkable authentication was published as an International Standard (IS) in 2012-12 and confirmed in 2018-11.

Work in progress includes:​

​ISO/IEC 27553 – Security and privacy requirements for authentication using biometrics on mobile devices, is divided in two parts, Part 1: Local mode, and Part 2: Remote mode. Part 1 has passed an FDIS ballot and is under publication as an International Standard (IS). Work on Part 2 is being progressed to Working Draft (WD) status.

ISO/IEC 27554 –Application of ISO 31000 for assessment of identity-related risk remains at Committee Draft (CD) status.

ISO/IEC 27560 – Consent record information structure has been progressed to Draft Technical Specification (DTS).

ISO/IEC 27561 – Privacy Operationalization Model and Method for Engineering (POMME) remains at Committee Draft (CD) status.

ISO/IEC 27562 – Privacy guidelines for fintech services has been progressed to Committee Draft (CD) status.

ISO/IEC 27563 – Security and privacy in artificial intelligence use cases will be published as a technical report (TR).

ISO/IEC 27565 – Guidelines on Privacy Preservation based on Zero-Knowledge Proofs remains as Working Draft (WD) status.