Provisioning

In most cases this is done initially by a hiring manager or work unit supervisor who then engages with IT security and other administrators to validate and implement. This involves:

• The requesting individual provides supporting evidence attesting to their identity, such as governmentissued documents or digital ID. Identity proofing is performed to review and authenticate these documents to ensure the individual is uniquely and unambiguously the person they claim to be and is not an impostor, for example*.
• The data owner reviews the request and provides access approval or rejection to the data custodian (who is responsible for implementing the request). The data owner also provides any additional user permissions guidance. This may be in broad, high-level terms (such as "all operational environments, but not development ones"), or it may need to be detailed, depending upon the organization's security procedures.
• The data custodian creates a user account for the individual. Depending on the system, the environment, and the privileges being granted, this may require the creation and provisioning of multiple accounts with different login credentials. It may also involve populating (or pushing) these account IDs and privileges into various applications platforms, other systems, or domains within the organization's infrastructures.
• The data custodian notifies the user and the data owner of the account creation, and the user begins to access the systems and resources within the permissions they've been granted.

• Identity proofing has challenges dealing with undocumented or under-documented individuals, such as migrants, refugees, and the victims of human trafficking.

Victims of identity theft can also find it difficult to present a conflict-free claim to their own identity. Voter registration, public identification systems, public health and benefits, and banking all face issues with these types of situations.