Policy paper

Alpha testing of the trust framework

Updated 26 January 2023

Live testing of the national digital identity and attributes trust framework alpha is now open for applications. This testing will enable organisations to self-assess against the relevant rules of the trust framework, with some organisations going on to have a mock audit completed by the testing team. It will provide us with valuable feedback to develop the beta version of the trust framework (expected in 2022), as well as give organisations the opportunity to help shape the rules and prepare for full certification in future.

If you are an organisation and wish to participate in the testing, please submit an expression of interest by 11.59pm on Sunday 19 September 2021.

1. What are our objectives?

The objectives of this live alpha testing are to:

• assess where trust framework rules are fit for purpose and where they should be improved
• further understand the level of interest from organisations to become certified against the trust framework
• assess the effectiveness of the proposed certification process for joining the trust framework through user research, making improvements where needed, and
• build the evidence required for the trust framework to move to beta phase.

2. Why should my organisation take part?

There are a number of benefits to taking part in this stage of testing, which will enable your organisation to:

• understand to what extent your organisation’s service meets the proposed trust framework rules
• help shape the rules in the trust framework through the lens of your organisation’s service
• help shape the certification process for joining the trust framework through participating in user research, and
• help meet the eligibility criteria to take part in beta stage testing (plans for beta testing will be announced at the earliest opportunity).

There is no cost to taking part in the alpha testing, aside from the time and resources needed to complete the activities described below.

DCMS is partnering with the Disclosure and Barring Service (DBS) who plan to build upon the alpha testing process by inviting participating organisations to join their testing of digital applications for criminal record checks. This will involve assessment against use case specific rules which complement the trust framework. Further details will be communicated to participants during Autumn 2021.

3. Is my organisation eligible to apply?

You are eligible to take part in live alpha testing if you meet the following criteria:

• you are a non-public sector organisation, registered with the appropriate body e.g. Companies House or the Charity Commission
• the service you are providing aligns with at least one of the following roles under the trust framework (role definitions can be found in the [trust framework alpha]):
• identity service provider
• attribute service provider, and
• orchestration service provider
• you can confirm you will complete a self assessment of your service against trust framework rules, alongside a user research questionnaire.

If you only want to join the trust framework as a relying party and/or scheme owner you are not eligible to apply for this round of testing, as these roles do not require certification.

You do not need to meet all of the rules in the trust framework alpha to be eligible. This is because it is in draft form and the alpha testing will help us to iterate the trust framework rules so that they are fit for purpose.

4. How will you test schemes during the alpha phase?

Testing schemes is a hugely important part of the alpha phase. While organisations who want to play the role of scheme owner are ineligible to apply through the expression of interest, we will complete a parallel alpha testing process with those organisations. This testing process will involve the testing team:

• reviewing scheme documentation to check for alignment with trust framework rules
• working in partnership with scheme owners to further develop and iterate policy around the licensing, * management, structure and governance of schemes, and
• playing an observer role on scheme-led tests and piloting (where resourcing allows).

If you are interested in playing the role of scheme owner and are not already engaged with the DCMS team, please contact digitalidentityalpha@dcms.gov.uk.

5. What is the process for live alpha testing?

The following information is an overview of the planned process for live alpha testing. Further information will be provided to participating organisations at each stage of the process.

There are five stages in the process:

1.Expression of interest

2.Shortlisting

3.Self assessment

4.Self assessment feedback

5.Mock audit

5.1 1. Expression of interest stage

If you would like to participate in live alpha testing you must submit an expression of interest by xx. You cannot proceed in the live alpha testing without completing an expression of interest. However, doing so will not commit you to being involved and you can drop out of the process at any time by notifying the testing team.

The trust framework testing team, which is made up of DCMS and Government Digital Service (GDS) subject matter experts and policy professionals, aims to review expressions of interest by xx. All organisations will be notified of the outcome using the email address provided on the expression of interest form. There are 3 possible outcomes:

• you meet the eligibility criteria and will proceed to the self assessment stage. You are also shortlisted for the self assessment feedback stage
• you meet the eligibility criteria and will proceed to the self assessment stage. You are not shortlisted for the self assessment feedback stage, or have chosen not to take part in this stage
• you do not meet the eligibility criteria and will be removed from the process. If it is not clear whether or not an organisation meets the eligibility criteria, the testing team may ask follow up questions before making a decision.

5.2 2. Shortlisting stage

As well as assessing whether organisations are eligible, the expression of interest form may be used to decide whether you are invited to progress to the self assessment feedback stage. Around 30 organisations will be invited to progress to this stage. If we have more eligible organisations that want to progress to the next stage, the testing team will complete a shortlisting exercise, with an ordered reserve list of all eligible organisations kept in case organisations drop out or the testing team has additional capacity for this work. The testing team will complete the shortlisting exercise internally based on a two stage process:

Shortlisting stage - Stage A

You will be scored in accordance with the below criteria against their answers to the following questions in the expression of interest form:

---

Question: Is your service planned, in development, or already in use in the market? Please give details related to how far developed or widely used your service is at the moment.

Key considerations	Positive indicators	Negative indicators
How ready the service is for alpha testing	The service is in use or close to being fully developed	The service is not close to being fully developed
	The organisation has existing commercial relationships for the service

---

Question: Please give an overview of your organisation’s experience being certified against other schemes/standards, domestically or internationally.

Key considerations	Positive indicators	Negative indicators
Level of experience of certification processes	Experience of being certified against recognised schemes/standards	No prior experience of certification processes

---

Question: How has your service been developed (or will be developed) to be inclusive to a range of individuals?

Key considerations	Positive indicators	Negative indicators
Extent to which inclusion has been considered in the development of the service	Clear evidence that inclusion has been considered and steps taken to maximise inclusion in the development of the service	No evidence that inclusivity has been a key factor in service development

Shortlisting stage - Stage B

The primary factor used to determine whether you will be invited to progress to the self assessment feedback stage will be the highest scores from Stage A.

The following factors will also be considered at Stage B:

• the role(s) your organisation is interested in playing under the trust framework
• the size of your organisation
• the sector of your organisation and/or use case for the service, and
• the type of technology and/or model for digital identity and/or attributes being used by your service.

The objective of Stage B is to ensure that an appropriate range of organisations, service types and use cases are part of all stages of alpha testing. The testing team will assess these factors in combination with Stage A scores to reach a final decision on which organisations are invited to progress to the self assessment feedback stage.

5.3 3. Self assessment stage

All organisations that meet the eligibility criteria will be invited to take part in the self assessment stage. This means you will receive the materials required to complete a self assessment for your service against the relevant rules of the trust framework. We estimate that completing a self assessment will take approximately one day’s work for someone with a detailed knowledge of the service. At the same time, a user research questionnaire on the process and trust framework rules will be provided. This questionnaire will be used to inform the evaluation of alpha testing.

If you were not invited to the next stage you will still be able to complete a self assessment of your service for your own records. You may also be invited to a workshop to provide further feedback and ask any questions you have to the testing team.

All organisations that complete a self assessment will be able to:

better understand to what extent they meet the trust framework rules identify where improvements could be made to their service to meet more trust framework rules feedback more effectively on where draft trust framework rules don’t work for their service, and better prepare for full certification against the trust framework in the future.

5.4 4. Self assessment feedback stage

You are only invited to this stage if you were shortlisted after submitting an expression of interest. You can only, however, progress to this stage once you have completed the self assessment materials provided to you. All information received by the testing team will be kept strictly confidential and securely stored for the duration of alpha testing. It will be deleted upon completion of the alpha evaluation, after no more than one year.

After you have submitted your self assessment to the testing team, the team will provide you with a structured feedback report. This will help to deliver the same benefits as the self assessment stage, but with the added benefit of independent feedback on how you have done.

5.5 5. Mock audit stage

After the self assessment and self assessment feedback stages are complete, a selection of organisations will be invited to take part in a mock audit. Organisations interested in participating in this stage will be prioritised based on their relative compliance at the self assessment feedback stage, taking into consideration the factors listed at Stage B of the shortlisting exercise above.

If you are selected for the mock audit stage you will be asked to complete criteria documents about your service to a more detailed level than the self assessment stage, as well as provide additional supporting evidence. The criteria documents and evidence will be used to conduct a remote, desk-based mock audit of your service against trust framework rules.

After the mock audit is complete, the testing team will provide you with a structured feedback report. This will help to prepare you for the audits needed to become certified against the trust framework in the future. A second user research questionnaire will be provided and/or interviews conducted, with questions on the process and trust framework rules.

With the consent of participating organisations, the results of the mock audits may be shared with external certification bodies and auditors to seek further assurance the process meets industry best practice for certification schemes.

6. What are the timelines?

This is an approximate timeline for alpha testing and dates are subject to change:

• Expressions of interest open - Monday 2 August
• Expressions of interest close - Sunday 5 September
• Applicants informed of the outcome and self assessment materials and user research questionnaire shared with eligible organisations - September 2021
• Deadline for organisations completing the self assessment materials (only if shortlisted) and user research questionnaire (all eligible organisations) - October 2021
• Self assessment feedback provided - November 2021
• Mock audit criteria documents shared and evidence requested - December 2021
• Mock audits conducted and feedback provided - January 2022

7. What are the next steps after alpha testing?

The evidence gathered from the alpha testing will be used to complete an evaluation of the alpha phase of the trust framework. The trust framework and certification process will also be iterated in line with our findings. If the evaluation is positive, the trust framework will progress to beta phase during 2022.

The beta phase will incorporate more dynamic sandbox-style testing by facilitating the secure checking of data in real world scenarios. The details of this testing will be shared at the earliest opportunity.

Part of the eligibility criteria for organisations taking part in beta testing will be to complete an assessment against the relevant trust framework rules for their service. Organisations which participate in alpha testing will therefore have already completed some of the groundwork when applications for beta testing open.

Organisations who did not participate in alpha testing will still be able to apply to take part in beta testing.

8. Contact details

If you have any questions please contact digitalidentityalpha@dcms.gov.uk.