90-day identity-readiness scorecard

Use this scorecard to identify the next practical work, not to claim compliance. Your answers stay in this browser and are not submitted to MyID.

For: Irish identity-project owners and cross-functional readiness teams. This is independent information, not legal, compliance or security advice.

Score your current position

Governance and use case

We have a named owner and documented service decision. We have separated current requirements from future wallet opportunities.

Data and privacy

We have mapped every data field, role, recipient and retention period. We have tested necessity, proportionality and alternatives.

Security and fraud

We have a threat model covering capture, injection, recovery and operations. Supplier evidence is scoped to the product and configuration we will use.

Procurement and integration

Requirements and success measures were defined before vendor selection. We have documented integration, change, incident and exit responsibilities.

People and operations

Accessible fallback and human review are designed and tested. Production metrics include fraud, completion, errors, appeals and segment outcomes.

Calculate locally

Select the statements that are already evidenced, then calculate your result.

Interpretation

• 0–3: discovery — define ownership, purpose and evidence before approaching implementation.
• 4–6: foundation — close material governance, data and control gaps.
• 7–8: pilot-ready — test representative users, attacks, failures and operations.
• 9–10: readiness evidence exists — verify it remains current and production-specific.

A practical 90-day sequence

1. Days 1–30: use case, responsibility, legal/status and data-flow map.
2. Days 31–60: method, requirements, DPIA/threat work and supplier evidence.
3. Days 61–90: pilot, fallback, operations, metrics and go/no-go review.

What the score cannot tell you

A high score does not prove regulatory compliance, security, fairness or production performance. It indicates that the organisation has recorded evidence across the areas a serious review should examine.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• Regulation (EU) 2024/1183
• European Commission EUDI Wallet Toolbox and ARF
• General Data Protection Regulation
• NIST SP 800-63A-4 identity proofing

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• EUDI readiness
• Procurement checklist
• Evidence report