An identity profile is the confidence level produced by combining the results of multiple identity checking steps. Each profile reflects how much evidence was collected, how strong the checks were, and how well the person matched the evidence. Under GPG 45, profiles map to low, medium, high, or very high confidence.
What an identity profile measures
An identity profile is not a verdict by itself, it is a confidence output. It summarises how much assurance has been built up through several checks, so the reader can understand whether the evidence chain supports a low, medium, high, or very high level of confidence.
The important point is that the profile is produced by combination, not by a single signal. Stronger identity checking steps, more complete evidence, and better agreement between the person and the evidence all increase confidence. Weak, incomplete, or inconsistent checks lower it.
How identity profiles are formed
Identity profiling brings together multiple identity checking steps into one usable confidence level. In practice, that means the assessment looks at the breadth of evidence collected, the strength of each check, and whether the individual consistently matches the evidence presented across those checks.
This is why profile levels are useful in assurance frameworks such as GPG 45. They let an organisation translate several different verification results into a single confidence judgement that can be used consistently across onboarding, account recovery, or other identity decisions.
What the confidence levels mean
The low, medium, high, and very high labels describe assurance strength, not personal identity quality. A higher profile means the organisation has stronger confidence that the identity evidence is genuine and that the person matched it reliably during the process.
That distinction matters because the same person may receive different profile outcomes depending on the process used. A light-touch check may produce a lower profile, while a stronger evidence set with more robust validation can support a higher one.
Why identity profiles matter in assurance decisions
Identity profiles help organisations make consistent decisions where the required level of confidence matters. They reduce ambiguity by turning a collection of checks into a structured outcome that can be compared against policy, risk tolerance, or the sensitivity of the service being accessed.
They also create a clearer audit trail. When an identity decision is challenged later, the organisation can explain not just the final result, but the strength and composition of the evidence that led to it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines assurance-based identity proofing and confidence concepts central to identity profiles. |
| Recommendation — Align profile thresholds to identity assurance outcomes and evidence strength. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Identity profiles support governed identity assurance and controlled identity lifecycle decisions. |
| Recommendation — Define who may accept, review, and act on identity confidence outcomes. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Identity profiles inform assurance for external users whose identity must be established before access. |
| Recommendation — Use stronger identity proofing before granting access to external users. | ||
Practitioner Guidance
Why practitioners should care: Identity profiles are only as strong as the weakest meaningful step in the checking process. If the evidence set is thin, inconsistent, or poorly documented, the resulting confidence level can look more authoritative than it really is.
Practitioner takeaway: Treat the profile as an assurance summary, not a substitute for understanding which checks were actually performed and how much confidence each one contributed.
Related resources from NHI Mgmt Group
- Why do profile mappings matter so much in federated identity?
- How should teams migrate from profile-based MDM to identity-centric UEM?
- Why do passkeys change the risk profile for human identity programmes?
- Why do vishing attacks bypass traditional phishing training and create a different risk profile for identity security teams?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org