GPG45 Very High Assurance

What Very High Assurance Means in Identity Proofing

Very High Assurance is about making identity proofing hard to fake. At this level, the service is not just asking whether a person can answer challenge questions or upload documents, it is trying to establish strong confidence that the claimed identity is genuine before issuing access, credentials, or account privileges.

This matters because identity proofing sits at the front of the trust chain. If the wrong person passes the proofing step, every later control built on that identity, from login to recovery to delegated access, inherits that mistake.

How Very High Assurance Differs from Lower Assurance Levels

Lower assurance levels accept more convenience and more residual doubt. Very High Assurance pushes in the opposite direction: it tolerates more friction, more evidence, and more verification because the downstream consequences of a false identity are higher.

That usually means stronger evidence checks, more robust anti-fraud screening, and stronger confidence that the applicant is physically present and matching the identity being asserted. In practice, this level is chosen where identity fraud would create unacceptable operational, financial, or safety impact.

The practical effect is that this is not just a stronger version of ordinary onboarding. It is a different risk posture, one that assumes an adversary may try to impersonate a real person, reuse stolen identity material, or exploit weak remote verification flows.

Evidence, Liveness, and Fraud Resistance

Very High Assurance commonly depends on multiple reinforcing signals rather than one document or one check. The stronger the assurance target, the more important it becomes to combine evidence quality, document authenticity, liveness testing, and fraud-resistant workflows so that a single weak signal cannot carry the decision.

That is why this level is often associated with biometric or liveness checks and with controls that reduce synthetic identity, document tampering, and replay-style abuse. For a broader view of assurance, governance, and evidence handling, see the Audit, Assurance and Compliance Guide, which is useful when identity proofing must stand up to audit or regulatory scrutiny.

Where the organisation needs a formal reference point for identity assurance levels, NIST SP 800-63 Digital Identity Guidelines is the most direct external guide for understanding how higher assurance proofing and authentication expectations fit together.

Operational Implications for High-Value Services

Very High Assurance is usually reserved for services where identity compromise would be expensive to unwind. Examples include access to regulated services, sensitive customer accounts, high-value transactions, or environments where proofing quality directly affects fraud loss and trust.

Because the proofing decision becomes a security control in its own right, organisations need to treat its failure modes seriously. Weaknesses can arise in remote enrolment, identity document handling, reviewer consistency, fraud exceptions, or recovery processes that let a previously proofed identity be reasserted too easily.

Where assurance is being applied in regulated or certification-heavy environments, the page EU Cybersecurity Certification EUCC Guide is a useful adjacent reference for thinking about assurance, evidence, and high-confidence trust decisions in a formal scheme context.

Related resources from NHI Mgmt Group

• When do passkeys work best for regulated or high-assurance environments?
• When does MFA create enough assurance for high-risk access?
• Why does high-assurance identity verification matter for compliance teams?
• Why do shared clinical devices complicate high assurance authentication?