Identity-verification RFP question bank

Ask questions that require scoped evidence, not yes/no marketing answers. Every response should identify the exact product, configuration, geography, version, test or contract term being offered.

For: Irish procurement, compliance, security, privacy and product teams. This is independent information, not legal, compliance or security advice.

Assurance and methods

• What does each supported method establish and at what assurance?
• Which Irish and international documents are supported, with what validation depth?
• How are evidence ownership, attended exceptions and reusable credentials handled?
• Which method combinations and thresholds are configurable?

Fraud and performance

• Which presentation, injection, replay and synthetic-identity attacks are tested?
• Provide current results at the proposed threshold and configuration.
• How are duplicate enrolment, device/session risk and recovery controlled?
• How are new bypasses communicated and mitigated?

Privacy, fairness and accessibility

• List every data category, purpose, role, location, subprocessor and retention period.
• Is material reused for model improvement or cross-client fraud?
• Provide accuracy/fairness evidence and appeal design.
• Describe accessible capture, alternatives and assisted flows.

Delivery and evidence

• Integration documentation, sandbox and supported platforms.
• SLAs, support, incident notice and service change.
• Pricing for attempts, retries, reviews, minimums and termination.
• Audit/certification scope, customer evidence rights and exit/deletion.

Scoring rule

Score evidence quality separately from claimed capability. Give higher confidence to production-specific, current, independently checkable material; mark roadmap, contract-dependent and unconfirmed responses explicitly.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• NIST SP 800-63A-4 identity proofing
• ENISA Remote Identity Proofing: Attacks and Countermeasures
• General Data Protection Regulation

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• Buying guide
• Procurement checklist
• Contract checklist