What Is ISO/IEC 18013-7? Definition & Examples

ISO/IEC 18013-7 is the part of the mDL standard set that covers online presentation and verification. It enables remote identity checks using the same credential model, so organisations must control relying-party onboarding, protect presentation requests, and verify that returned data is fresh and authorised.

How ISO/IEC 18013-7 Works in Online mDL Verification

ISO/IEC 18013-7 extends the mobile driving licence model into remote transactions, so the relying party can request data and verify it without a face-to-face reader session. That changes the security focus from proximity exchange to request integrity, response authenticity, and session trust.

The standard matters because online presentation can be replayed, relayed, or altered if the request flow is weak. In practice, the relying party must treat the presentation request as security-sensitive input and validate that the response matches the intended transaction.

Trust Boundaries for Relying Parties and Presentation Requests

For online verification, the relying party is not just a consumer of data, it is part of the trust chain. A sound implementation must control who is allowed to onboard as a relying party, what requests they can issue, and how those requests are bound to the expected use case.

That is why mDL online presentation is not simply an API call. It is a delegated verification flow that depends on policy, request authenticity, and the verifier’s ability to distinguish a legitimate session from an injected or redirected one. Mobile Driving Licence (mDL) Guide is useful background for the broader mDL trust model, including online presentation and verifier interactions.

Freshness, Replay Resistance, and Authorisation Checks

Online mDL verification only works if the returned data is current and authorised for the specific request. That makes freshness controls, nonce-style request binding, and audience restrictions central to the security model.

If a verifier accepts stale or misbound data, the result can be an apparently valid check built on an outdated credential state. The security concern is not only disclosure, but also trust failure, where the organisation accepts an answer that was never authorised for that transaction.

Implementations also need a clear policy for what data elements are requested, because overbroad requests expand privacy exposure and make consent or disclosure handling harder to justify. Online presentation should therefore be designed as a narrow, purpose-specific verification step rather than a general identity data pull.

Operational Controls for Deployment and Review

Organisations should govern mDL online verification as a controlled onboarding and assurance process, not a one-time technical integration. The important questions are whether the relying party is approved, whether request generation is locked to the expected workflow, and whether verification logs are sufficient for later review.

Post-incident review should focus on request integrity, unexpected relying-party activity, and whether any accepted response could have been replayed or substituted. For broader governance and control mapping, ISO 27001 Certification Guide is a practical companion for policy, audit, and control ownership, while NIST SP 800-63 Digital Identity Guidelines provides useful identity assurance context for verifier trust decisions.

Risk and Threat Considerations

Online mDL verification introduces a clear abuse path: if an attacker can tamper with the request, relay a response, or reuse an old proof, the verifier may accept identity data outside the intended transaction. That can create both privacy exposure and fraudulent access decisions.

Failure mechanism: Weak request binding, poor relying-party governance, or missing freshness checks can let a malicious or compromised verifier session accept replayed, redirected, or otherwise unauthorised presentation data.

Impact: The organisation may approve the wrong person, expose more identity data than intended, or lose confidence in a remote verification process that should have been tightly bounded.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 provides the primary governance reference for this term.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Covers lifecycle control of authenticators supporting remote identity verification.
	IA-8 — Identification and Authentication (Non-Organizational Users)	Applies when external users present identity assertions to a verifier.
	AC-3 — Access Enforcement	Supports relying-party onboarding and constrained access decisions for presentation flows.
Recommendation — Enforce lifecycle controls for verifier credentials and related authenticators. Validate external-user identity assertions before accepting remote mDL data. Restrict relying-party access to approved online presentation functions.

Practitioner Guidance

Governance implication: Treat online mDL verification as a governed trust relationship, not a generic login flow. The relying party should be approved, the request format should be constrained to the business purpose, and the verification path should be owned by the team responsible for identity assurance.

What to watch for: Repeated verification failures, unexpected request patterns, and any sign that responses are being accepted without clear freshness or session binding. Those are often the earliest indicators that the online presentation flow is too loose for production use.

Practitioner takeaway: If the verifier cannot prove that the response belongs to the exact live request it issued, the online mDL flow is not yet trustworthy enough for high-value decisions.

ISO/IEC 18013-7