The growing interest in verifiable digital credentials, such as mobile driver’s licenses or digital health passes, means companies and governments need new tools for managing risk in this decentralized infrastructure. “Risk management in financial services, such as banking and credit card networks, is a mature field,” said Scott Perry, co-chair of the ToIP Foundation Governance Stack Working Group. “But as we move into decentralized identity management, where individuals manage credentials in their own digital wallets, we need new risk management tools designed for this paradigm.”
To begin to fill this gap, today the Trust Over IP (ToIP) Foundation announced the release of the ToIP Risk Assessment Worksheet (Excel format) and Companion Guide (PDF). These new tools are intended to equip architects of digital governance frameworks — ”rulebooks” for establishing trust online—with the knowledge they need to perform a risk assessment grounded in generally accepted global standards and techniques, including:
- Proper consideration and identification of potential risks,
- Critical analysis of risks in terms of likelihood and severity,
- Calculating a systematic risk impact score,
- Triaging risks for further treatment,
- Risk mitigation requirements and strategies,
- Performance of an annual review to reassess existing risks and consider new ones.
The Risk Assessment Worksheet and Companion Guide provides a step-by-step method of performing a systematic risk assessment that conforms with industry-standard guidance such as ISO/IEC 27005 and NIST 800-30. This process identifies and categorizes risks by likelihood and severity in order to create a risk score that can be color-coded, and stack ranked to highlight the need for countermeasures as shown below. The Worksheet and Companion Guide include enough background and educational content that even risk assessment novices should be able to drive the risk assessment process. “A key missing piece of building open digital trust ecosystems has been a deep understanding of the various risks they introduce.
This can scare off key stakeholders“, said Darrell O’Donnell, CEO of Continuum Loop and Chair of the ToIP Governance Stack Working Group. “The Risk Assessment Worksheet is a powerful tool that helps create clarity about where the real risks are in an ecosystem and what to do about them.”
The Risk Assessment Worksheet and Companion Guide are the first deliverables from the ToIP Governance Stack Working Group (GSWG), whose mission is to produce a complete suite of tools, models, templates, and guides for digital governance frameworks. GSWG member Vikas Malhotra, CEO of WOPLLI Technologies, explained why risk assessment was at the top of the list: “Willingness to take risks is key to forming trust. A risk assessment process helps to qualify and quanfy the risk in a situation, so that the potential trustor can use the information to understand if they should take the risk or not.”
These new tools for risk assessment are already being put to use by digital trust ecosystems being incubated within the ToIP Ecosystem Foundry Working Group. An example is the YOMA governance framework for youth education and life skills credentials in Africa. “Designing a digital trust ecosystem without first assessing the specific risks it is intended to address is like laying underground pipes without testing them to determine the possibility of leakages” said Frednand Furia, who is leading the Yoma Trust Assurance Task Force. “The ToIP Risk Assessment Worksheet and Companion Guide have already proved to be very effective in architecting the YOMA Rules governance and trust framework.”