Because GPG45 is not based on one evidence point. A document can be genuine and still leave gaps in activity history, fraud risk or verification that the person presenting it is the true owner. Higher assurance depends on the combined profile, so a weakness in one element can prevent the journey from reaching medium or high.
Why a Genuine Identity Document Can Still Fall Short
A strong document is only one piece of the assurance decision. GPG45 looks at the evidence set as a whole, so a genuine passport or licence can still leave unresolved questions about continuity of use, fraud exposure or whether the presenter is the true owner. Assurance rises only when the combined checks support the claimed identity with enough confidence.
That is why document authenticity and assurance level are not the same thing. A document may be valid, unaltered and issued by a trusted authority, yet still not satisfy the broader profile needed for higher confidence if other evidence is thin, inconsistent or absent.
For the document side of the journey, the key issue is whether the evidence supports the person, not just the plastic or paper. NHIMG’s Identity Proofing and KYC Guide is useful here because it separates document checks, liveness and fraud controls that often need to line up before higher assurance is justified.
What Usually Blocks the Step Up to Medium or High Assurance?
Higher assurance typically fails for one of three reasons: the applicant has too little activity history, the evidence set does not convincingly link the document to the same person over time, or the fraud signals are not strong enough to clear the threshold. A single strong document cannot compensate for weak corroboration elsewhere in the journey.
In practice, the blocker is often not the document itself but the absence of supporting evidence that strengthens the overall identity profile. That can include repeated use, corroborated account history, or other checks that reduce the chance of impersonation, reuse or synthetic presentation.
This is where process design matters. If the organisation treats “document present” as synonymous with “assured identity,” the journey will over-grant confidence. The better model is to treat document verification as one control in a layered assurance chain, not as the final verdict.
When organisations need a stricter document-and-evidence model, NHIMG’s NIST SP 800-63A-4 Identity Proofing Guide is a useful companion because it focuses on evidence strength, verification pathways and fraud controls rather than a single document event.
Why the Combined Profile Matters More Than Any Single Check
Assurance is cumulative. A document that is genuine may still be insufficient if the rest of the profile does not support persistence, possession and legitimacy. The journey advances when multiple signals align, not when one signal is excellent in isolation.
That combined view is especially important when the verification path must distinguish between an authentic document and an authentic identity relationship. A genuine ID can still be presented by the wrong person, used too early in the lifecycle to support stronger confidence, or attached to a profile that has not accumulated enough trustworthy history.
For organisations trying to align policy, controls and audit evidence around that broader assurance picture, NHIMG’s Audit, Assurance and Compliance Guide helps connect the evidence story to the assurance decision rather than treating verification as a one-off event.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | The question turns on assurance levels and evidence strength in digital identity. |
| Recommendation — Apply the guideline's assurance model to judge whether the full evidence set supports the required confidence. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | The topic concerns external identity assurance and proofing for a presented identity. |
| IA-12 — Identity Proofing | The issue is whether evidence is sufficient to validate the person behind the document. | |
| Recommendation — Use IA-8 to require stronger proofing and authentication before granting higher assurance. Use IA-12 to strengthen identity proofing evidence and verification steps. | ||
| OWASP ASVS | V6 — Authentication | The page is about assurance boundaries in identity verification, which directly affects authentication confidence. |
| V10 — OAuth and OIDC | Federated identity journeys often depend on assurance claims and verified identity evidence. | |
| Recommendation — Align authentication requirements to the evidence strength needed for the target assurance level. Validate assurance claims and upstream identity evidence before trusting the federated result. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access Control | Assurance outcomes determine who can be trusted to access protected services or data. |
| Recommendation — Tie access decisions to documented assurance requirements rather than to a single document check. | ||
Practitioner Guidance
What to verify: Treat document authenticity as necessary but not sufficient. Before allowing a higher assurance outcome, verify that the identity profile also shows enough corroboration, consistency and fraud resistance to support the decision being made.
Decision rule: If the journey has one excellent document but thin history or weak linkage to the presenter, hold the assurance level down rather than forcing an upgrade. The right decision is based on the weakest material gap, not the strongest individual evidence item.
What practitioners underestimate: Teams often over-weight the document check because it is easy to observe and explain. The harder control is judging whether the combined evidence actually closes the trust gap the business cares about.
Practitioner takeaway: Higher assurance is a profile judgment, not a document judgment, so the right question is whether the full evidence set removes enough doubt to justify the step up.
Related resources from NHI Mgmt Group
- Why do federated sign-in models still need strong identity assurance?
- How do organisations balance usability and strong document identity assurance?
- Why does privacy-preserving age assurance still need strong identity governance?
- Why do passive selfie-based checks still need strong assurance controls in identity verification?