ID.me Obtains ISO and SOC Certification Amidst Layoffs

The embattled identity provider ID.me is celebrating a bit of good news while downplaying a bit of bad. The good news comes in the form of the company’s SOC 2 Type II and ISO/IEC 27001:2013 certifications, which were granted at the end of an independent audit. Both certifications attest to the company’s data protection capabilities, and indicate that ID.me’s technology and workflows live up to the latest best practices for cybersecurity.

In plain terms, that means that ID.me is able to safeguard any personal information that passes through its systems. The certifications should help quell some of the concerns that have cropped up in the past few months. The IRS had planned to make ID.me mandatory for people logging in online, but that idea was scrapped in response to pressure from regulators. Both the Senate and the House of Representatives are now investigating the company, with ID.me’s failure to disclose its use of one-to-many facial recognition technology standing as one of the key points of contention. The certifications may not fully override those concerns, but should at least offer some assurances as to the integrity of the company’s network.

The bad news is that those certifications are arriving in the midst of another round of layoffs. ID.me laid off half of its fraud review team at the end of tax season, and is now letting go of another 54 employees. The firings were effective as of June 7.

ID.me declined to provide more information about which jobs were being made redundant, but did stress that the 54-person tally did not include any Trusted Referees. The Trusted Referees are human agents who verify a customer’s identity through a video chat, and play a key role in the company insofar as they give customers a way to register for the service without needing to go through the more controversial face-based onboarding process. ID.me has emphasized its non-biometric options in response to the recent public backlash.

ID.me has held a FedRAMP Moderate Authority to Operate (ATO) since June of 2021. The FedRAMP approval clear’s ID.me’s solutions for use in a range of government applications.

Source: Virginia Business

–

June 22, 2022 – by Eric Weiss