Understanding the Technical Standards Behind Digital Identity

Digital identity has become a central pillar of our everyday digital lives. Online account creation, customer onboarding, electronic signatures, KYC checks, and access to sensitive services increasingly rely on fully digital, remote processes.

While this widespread adoption delivers significant gains in speed and user experience, it also comes with a sharp rise in identity fraud. In this context, a key question emerges: how can we ensure that digital identity solutions are truly secure, trustworthy, and comparable? This is precisely where technical standards come into play.

Why Do Technical Standards Matter in Digital Identity?

A technical standard can be understood as a shared framework or a common language. It defines rules, requirements, and testing methods that make it possible to objectively assess a technology, a process, or a service.

In the field of digital identity, standards serve several essential purposes:

• Providing measurable security: they make it possible to demonstrate that a solution can effectively withstand different types of attacks.
• Ensuring interoperability: standards enable cooperation between vendors, platforms, governments, and regulators by relying on a common set of rules.
  Building trust: for end users, businesses, and authorities alike, standards are a strong signal of transparency, reliability, and seriousness.
• Supporting regulation: increasingly, European regulatory frameworks directly rely on technical standards to define their requirements.

Without standards, each provider would define its own security criteria, making any meaningful comparison between solutions impossible.

The Main Families of Digital Identity Standards

ISO Standards: A Global Benchmark

The International Organization for Standardization (ISO) develops standards that are recognized worldwide, covering a wide range of technical domains, including identity and biometrics.

One key example is ISO/IEC 30107, a widely adopted reference that defines how biometric systems should be tested against presentation attacks. These attacks occur when someone attempts to fool a biometric system using a photo, a mask, or a pre-recorded video.

CEN Standards: A European Response to Local Challenges

The European Committee for Standardization (CEN) acts as the technical arm of the European Union, developing standards tailored to the specific needs of the European market. Its goal is to ensure alignment between technologies and regulatory requirements, particularly those related to eIDAS and electronic identity.

A notable example is CEN/TS 18099, a European standard focused on detecting video and digital injection attacks (Injection Attack Detection, or IAD). It complements ISO biometric standards by addressing more modern and complex threats, such as deepfakes and manipulated video streams.

ETSI: Bridging Technology and Regulation

The European Telecommunications Standards Institute (ETSI) plays a key role as a bridge between technology and regulation. It publishes technical specifications that translate regulatory requirements, such as those defined under eIDAS, into concrete, operational criteria for trust services like electronic signatures, seals, and timestamps.

ETSI 119 461 specifically addresses remote identity proofing and defines technical requirements based on expected assurance levels. It directly relies on standards such as ISO/IEC 30107 and CEN/TS 18099 to define biometric security expectations. In this way, ETSI acts as the link between technological innovation and regulatory compliance.

Understanding Security and Assurance Levels

Standards do more than define what needs to be implemented, they also help measure how secure a process actually is. In the European framework, this assessment is structured around three assurance levels: Low, Substantial, and High.

• Low level: designed for low-risk use cases and non-sensitive services, such as signing up for a newsletter or a promotional campaign.
• Substantial level: an intermediate level commonly used for standard customer journeys. Controls are stronger and resilient to common fraud techniques.
• High level: required for highly sensitive or heavily regulated transactions, such as access to medical data or the signing of legally binding documents. It involves robust procedures, biometric verification, full auditability, and certification by accredited providers.

Conclusion

ISO, CEN, and ETSI standards are not merely technical constraints, they form the foundation of trust for modern digital identity.

In a context of rapidly growing fraud and widespread digitalization, these standards provide a clear, measurable, and shared framework to secure digital journeys, protect users, and enable trust at scale.

‍