stage 6 final recommendations part 2

---
layout: raw-data.njk
title: "stage 6 final recommendations part 2"
---

# Stage 6: Structure Proposal and Content Retrieval Plan (Part 2)

## Date and Agent
- Date: 2025-11-19
- Agent: general-purpose (opus)
- Scope: Structure proposal and high-level retrieval plan

## Overview

This structure proposal implements the eight recommendations from Part 1 by fundamentally reorganizing the identification standards around the **conformance workflow** rather than conceptual topics. The new architecture creates a single, consolidated resource that guides users through understanding when conformance applies, assessing their identification risk, selecting appropriate controls, implementing standards with integrated guidance, and completing the conformance process.

The proposal addresses the core problem identified in our analysis: users come to these standards to achieve conformance, yet conformance is "tucked away" as peripheral content. This new structure makes conformance the **primary organizing framework**, with all content structured to support users' journey from initial assessment through successful conformance demonstration.

## Overall Document Architecture

### Approach

**Single consolidated document** organized as a comprehensive identification conformance resource.

**Rationale for single document approach**:
- Eliminates navigation burden across 30 separate documents
- Allows progressive disclosure through the conformance workflow
- Enables integrated presentation of standards and guidance
- Provides single search/navigation context
- Supports both linear reading and reference use
- Aligns with government AI guidance on consolidated resources

The document will use clear visual hierarchy and formatting to distinguish:
- Normative requirements (core standards text)
- Implementation guidance
- Examples and case studies
- Checklists and assessment tools
- Cross-references and navigation aids

### Entry Points

Users enter the resource through **role-based pathways** on the landing page:

1. **"I need to achieve conformance"** → Start with risk assessment
2. **"I'm assessing someone's conformance"** → Jump to assessment checklists
3. **"I'm implementing specific controls"** → Browse by standard/control
4. **"I need to understand concepts"** → Access terminology and overview
5. **"I have a specific question"** → Search or browse by topic

Each pathway provides a customized view into the same consolidated resource, with relevant sections highlighted and irrelevant sections de-emphasized.

### Navigation Strategy

**Primary navigation**: Conformance workflow stages (left sidebar)
- Each stage shows current position in workflow
- Sub-sections expand within each stage
- Progress indicators show completion

**Secondary navigation**: Quick access (right sidebar)
- Control reference lookup
- Checklists and templates
- Terminology glossary
- Related resources

**Cross-cutting features**:
- Breadcrumb navigation showing location
- "Related sections" links at section ends
- Control number index for direct access
- Search with filters (requirements, guidance, examples)

## Proposed Structure (High-Level)

### Level 1: Major Sections

**1. Understanding Conformance with Identification Standards**
*Entry point establishing relevance and context*

**2. Assessing Your Identification Risk**
*Practical risk assessment methodology*

**3. Selecting Your Assurance Levels**
*Mapping risk to required controls*

**4. Federation Assurance Standard & Implementation**
*Integrated standard and guidance*

**5. Information Assurance Standard & Implementation**
*Integrated standard and guidance with cybersecurity cross-references*

**6. Authentication Assurance Standard & Implementation**
*Integrated standard and guidance with biometric privacy requirements*

**7. Binding Assurance Standard & Implementation**
*Integrated standard and guidance*

**8. Demonstrating Conformance**
*Assessment process, checklists, evidence requirements*

**9. Reference Materials**
*Terminology, templates, historical versions*

### Level 2: Key Subsections

#### 1. Understanding Conformance with Identification Standards
- 1.1 Who needs to conform with these standards?
  - DISTF mandatory requirements (primary use case acknowledged)
  - Other contexts where standards apply
  - Quick self-assessment tool
- 1.2 Benefits of conformance
  - Risk reduction
  - Legal compliance
  - Interoperability
- 1.3 How the conformance process works
  - Overview of stages
  - Timeline expectations
  - Support available
- 1.4 Your conformance journey map
  - Visual workflow
  - Decision points
  - Key milestones

#### 2. Assessing Your Identification Risk
- 2.1 Understanding identification threats
  - Common attack vectors
  - Fraud patterns
  - Impact scenarios
- 2.2 Risk assessment methodology
  - Step-by-step process
  - Risk scoring framework
  - Documentation requirements
- 2.3 Risk assessment tools
  - Interactive worksheets
  - Scenario calculator
  - Example assessments
- 2.4 Counter-fraud considerations
  - Detection techniques
  - Prevention strategies
  - Response protocols

#### 3. Selecting Your Assurance Levels
- 3.1 Understanding assurance levels
  - IA, BA, AA, FA explained
  - How levels interact
  - Minimum viable combinations
- 3.2 Mapping risk to assurance
  - Decision matrix
  - Level selection guide
  - Trade-off considerations
- 3.3 Implementation planning
  - Resource requirements
  - Timeline considerations
  - Phased approach options

#### 4. Federation Assurance Standard & Implementation
- 4.1 When federation assurance applies
  - Use cases and scenarios
  - Relationship to other standards
- 4.2 Federation requirements (FA1-FA15)
  - [Core standard text unchanged]
  - Implementation guidance integrated after each control
  - Examples and clarifications inline
- 4.3 Federation conformance checklist
  - Control-by-control assessment
  - Evidence requirements
  - Common issues

#### 5. Information Assurance Standard & Implementation
- 5.1 When information assurance applies
- 5.2 Information requirements (IA1-IA12)
  - [Core standard text unchanged]
  - Implementation guidance integrated
- 5.3 Cybersecurity Requirements for Identification Systems
  - **NEW CONTENT**: NCSC 10 Minimum Standards cross-references
  - Which standards apply and why
  - Implementation coordination
- 5.4 Information conformance checklist

#### 6. Authentication Assurance Standard & Implementation
- 6.1 When authentication assurance applies
- 6.2 Authentication requirements (AA1-AA10)
  - [Core standard text unchanged]
  - Implementation guidance integrated
- 6.3 Authenticator selection guide
  - Types and characteristics
  - Strength evaluation
  - Technology options
- 6.4 Privacy Requirements for Biometric Authentication
  - **NEW CONTENT**: Privacy Code 2025 requirements (2-3 pages)
  - Necessity and proportionality
  - Consent requirements
  - Template security
  - Retention limits
  - Purpose specification
- 6.5 Authentication conformance checklist

#### 7. Binding Assurance Standard & Implementation
- 7.1 When binding assurance applies
- 7.2 Binding requirements (BA1-BA8)
  - [Core standard text unchanged]
  - Implementation guidance integrated
- 7.3 Document verification techniques
  - Using documents as evidence
  - Verification methods
  - Fraud indicators
- 7.4 Binding conformance checklist

#### 8. Demonstrating Conformance
- 8.1 Preparing for conformance assessment
  - Evidence collection
  - Documentation requirements
  - Self-assessment process
- 8.2 The assessment process
  - Who can assess
  - Assessment methodology
  - Timeline and stages
- 8.3 Master conformance checklist
  - Combined requirements
  - Assessment tracking
  - Remediation planning
- 8.4 Maintaining conformance
  - Ongoing obligations
  - Change management
  - Renewal process

#### 9. Reference Materials
- 9.1 Identification terminology
  - Agreed terms
  - Evolving terms
  - International mappings
- 9.2 Templates and tools
  - Risk assessment templates
  - Conformance checklists
  - Evidence templates
- 9.3 Legal and regulatory context
  - EIVA brief mention (1 paragraph)
  - Privacy Act considerations
  - DISTF framework
- 9.4 Version history and changes

### Structure Rationale

This structure implements **conformance-centered organization** (Recommendation #1) by:

1. **Starting with conformance relevance** rather than abstract concepts
2. **Following the natural workflow**: assess risk → select levels → implement standards → demonstrate conformance
3. **Integrating guidance with requirements** at point of need
4. **Surfacing conformance tools** (checklists, templates) prominently
5. **Providing clear pathways** based on user goals

The structure eliminates the current separation between standards and implementation guides, removes all detail expanders by using clear hierarchy, and provides space for essential content additions while maintaining the integrity of core standards text.

## Four Core Standards Integration

### Federation Assurance Standard
- **Location in structure**: Section 4 - positioned after risk assessment and level selection
- **Guidance integration**: Implementation guide content appears immediately after each control (FA1-FA15), using visual formatting to distinguish
- **Presentation approach**:
  - Control text in distinct formatting (e.g., bordered box)
  - "How to implement" subsection follows each control
  - Examples and clarifications in callout boxes
  - Cross-references to related controls inline

### Information Assurance Standard
- **Location in structure**: Section 5 - follows Federation as it often provides input to federation
- **Guidance integration**: Similar pattern to Federation Standard
- **Presentation approach**: Same visual distinction approach
- **Content addition**: New subsection 5.3 for NCSC cybersecurity cross-references

### Authentication Assurance Standard
- **Location in structure**: Section 6 - critical for most implementations
- **Guidance integration**: Enhanced with authenticator selection guide
- **Presentation approach**: Same visual distinction approach
- **Content addition**: New subsection 6.4 for biometric privacy requirements (2-3 pages)

### Binding Assurance Standard
- **Location in structure**: Section 7 - often implemented with authentication
- **Guidance integration**: Enhanced with document verification techniques
- **Presentation approach**: Same visual distinction approach

## Essential Content Additions

### Biometric Privacy Code Integration
- **Location**: Section 6.4 - "Privacy Requirements for Biometric Authentication"
- **Content scope**:
  - Legal obligations overview (Privacy Code 2025 effective 3 Nov 2025)
  - 5 key rules with practical implementation guidance:
    1. Necessity and proportionality assessment
    2. Explicit consent requirements and exceptions
    3. Biometric template security standards
    4. Retention limitations and deletion requirements
    5. Purpose specification and use limitations
  - Compliance checklist linking AA9/AA10 controls to privacy rules
  - Quick reference card for implementers
- **Size**: 2-3 pages
- **Integration approach**: Presented as mandatory complementary requirements to AA technical controls

### NCSC Cybersecurity Standards Reference
- **Location**: Section 5.3 - "Cybersecurity Requirements for Identification Systems"
- **Content scope**:
  - Relationship overview: How NCSC standards provide operational security for IA controls
  - Specific mappings:
    - NCSC Standard 1 (Asset Management) → IA data handling
    - NCSC Standard 4 (Access Control) → IA system controls
    - NCSC Standard 5 (Data Security) → IA information protection
    - NCSC Standard 8 (Application Security) → IA system integrity
  - Implementation coordination guidance
  - Example scenario: Implementing IA3 with NCSC Standard 5
- **Size**: 1 page
- **Integration approach**: Cross-reference table with explanatory context

### EIVA Brief Mention
- **Location**: Section 9.3 - "Legal and regulatory context"
- **Content**: "The Electronic Identity Verification Act 2012 (EIVA) establishes the EIVA Service as one specific government implementation of electronic identity verification. These identification standards are technology and implementation neutral, applying broadly to identification management regardless of whether organizations use the EIVA Service, other verification services, or manual processes."
- **Size**: 1 paragraph (4 sentences)

## High-Level Content Retrieval Plan

### Section 1: Understanding Conformance with Identification Standards
- **Sources**:
  - conforming-with-the-identification-standards (primary)
  - overview-of-the-identification-standards (context)
  - about-identification-management (concepts)
  - DISTF Act/Rules (mandatory use case)
- **Retrieval**:
  - `search_by_document` for full conformance document
  - `semantic_search` for "when conformance required mandatory"
  - `semantic_search` for "benefits of conformance"
  - `find_semantic_neighbors` from conformance overview sections
- **Expected coverage**: 70% from existing sources, 30% new framing/organization

### Section 2: Assessing Your Identification Risk
- **Sources**:
  - assessing-identification-risk (primary - 225 nodes)
  - counter-fraud-techniques (supplementary - 212 nodes)
  - Tom's annotations on risk assessment improvements
- **Retrieval**:
  - `search_by_document` for full risk assessment guide
  - `semantic_search` for "threat assessment methodology"
  - `semantic_search` for "fraud detection prevention"
  - `find_semantic_neighbors` for risk-related content
- **Expected coverage**: 85% from existing sources, 15% reorganization/active voice

### Sections 4-7: Core Standards with Integrated Guidance
- **Sources** (example for Authentication Standard):
  - authentication-assurance-standard (328 nodes)
  - implementing-the-authentication-assurance-standard (280 nodes)
  - authenticator-types (204 nodes)
  - Biometric Privacy Code (new external content)
- **Retrieval**:
  - `search_by_document` for complete standards and guides
  - `get_hierarchical_context` for each control to maintain structure
  - `semantic_search` for specific implementation examples
  - Manual extraction from Privacy Code for biometric requirements
- **Expected coverage**: 90% from existing sources, 10% new privacy/security content

### Section 8: Demonstrating Conformance
- **Sources**:
  - conforming-with-the-identification-standards (parts 3-4)
  - Existing Word checklists from ChecklistsAndTablesFromConformingPageIdentificationStandards/
  - Tom's annotations on conformance process improvements
- **Retrieval**:
  - `semantic_search` for "assessment process methodology"
  - `semantic_search` for "evidence requirements documentation"
  - `find_semantic_neighbors` from existing checklist references
  - Manual conversion of Word checklists to markdown
- **Expected coverage**: 80% from existing sources, 20% enhanced checklists/tools

### Section 9: Reference Materials
- **Sources**:
  - identification-terminology (383 nodes)
  - superseded-standards (20 nodes)
  - Various navigation pages
- **Retrieval**:
  - `search_by_document` for terminology
  - `semantic_search` for "definitions glossary"
  - Consolidate from multiple navigation pages
- **Expected coverage**: 95% from existing sources, 5% new organization

## Navigation and Finding Aids

### Table of Contents
- **Approach**: Expandable 3-level hierarchy
- **Depth**:
  - Level 1: Major sections (always visible)
  - Level 2: Key subsections (expandable)
  - Level 3: Specific topics/controls (expandable)
- **Features**:
  - Current location highlighting
  - Progress indicators for completed sections
  - Quick jump to any section
  - Search within TOC

### Cross-Linking Strategy
- **Control references**: Any mention of a control number becomes a link (e.g., "FA3" links to that control)
- **Concept connections**: Key terms link to terminology definitions
- **Workflow navigation**: "Next step" links at section ends
- **Related content**: "See also" boxes connect related topics
- **Breadcrumbs**: Show current location and enable up-navigation

### Checklists and Tables
- **Master checklist**: Section 8.3 provides combined view
- **Standard-specific checklists**: End of each standard section (4.3, 5.4, 6.5, 7.4)
- **Interactive format**: Checkboxes, progress tracking, export capability
- **Integration**: Checklists reference specific control sections directly

## How Structure Reflects Recommendations

**Recommendation 1 - Conformance-Centered Reorganization**:
- Entire structure organized around conformance workflow
- Conformance is literally the first major section
- All content serves the conformance journey

**Recommendation 2 - Systematic Active Voice**:
- Structure enables rewriting of all guidance sections
- Clear separation allows voice changes without touching core standards

**Recommendation 3 - Eliminate Detail Expanders**:
- Hierarchical structure with no hidden content
- All information visible through clear heading levels

**Recommendation 4 - Integrate Standards and Guidance**:
- Each standard section (4-7) includes implementation guidance inline
- No more parallel documents to navigate between

**Recommendation 5 - Biometric Privacy Requirements**:
- Dedicated subsection 6.4 in Authentication Standard
- Positioned directly after technical controls for logical flow

**Recommendation 6 - NCSC Cybersecurity Cross-References**:
- Dedicated subsection 5.3 in Information Standard
- Specific mappings rather than vague references

**Recommendation 7 - Clarify DISTF Relationship**:
- Addressed upfront in section 1.1
- Acknowledges as primary use case while noting broader applicability

**Recommendation 8 - User Journey Entry Points**:
- Landing page with 5 role-based pathways
- Each pathway provides customized navigation

## Implementation Notes

### Phase 2 Stage 8-10 Guidance

**Stage 8 (Markdown Style)**:
- Study existing markdown patterns in MarkdownVersionsOfDocRefDocuments/
- Document conventions for distinguishing standards from guidance
- Develop consistent formatting for checklists, tables, examples

**Stage 9 (Retrieval Planning)**:
- Create detailed queries for each subsection
- Plan iterative retrieval (broad then specific)
- Organize RetrievalResults/ folder to mirror structure

**Stage 10 (Content Retrieval)**:
- Execute planned queries systematically
- Preserve all DocRef citations
- Track coverage and gaps

### Constraints and Trade-offs

**Decisions made**:
- Single document chosen over multiple for better integration
- Standards remain distinguishable through formatting not separation
- Biometric privacy limited to 2-3 pages to avoid scope creep
- EIVA mentioned briefly to acknowledge without overemphasizing

**Alternatives considered but rejected**:
- Keeping standards and guidance separate (perpetuates navigation burden)
- Creating separate conformance guide (maintains fragmentation)
- Extensive EIVA integration (out of scope, would confuse purpose)

## Next Steps

Stage 7 should validate this structure against AI guidance principles, specifically examining:

1. **User-centered organization** - Does workflow match user mental models?
2. **Progressive disclosure** - Is information revealed at the right time?
3. **Accessibility** - Are all users able to navigate and find content?
4. **Scannability** - Can users quickly find what they need?
5. **Clarity** - Is the structure self-explanatory?
6. **Completeness** - Are all use cases accommodated?

The validation should confirm this structure supports both linear progression through conformance and reference usage for specific questions, while maintaining full traceability to source documents through DocRef citations.