Guidance for policy makers

What the clause says

A policy maker sets the eligibility rule, the permitted assurance approaches, the criteria providers must meet and the authentication factors expected. It may stay technology neutral or approve and review specific approaches.

What it supplies to a comparison

The policy maker's choices are the reference against which a comparison is judged. Without them, an accuracy figure has no pass mark and a method has no required assurance level.

Evidence to keep

• The policy or authorisation that sets the age rule and the permitted approaches.
• The review date and the consultation record behind the policy.

What the evidence looks like

For 4.2, the first artefact is The policy or authorisation that sets the age rule and the permitted approaches.. The second is The review date and the consultation record behind the policy.. If 4.2 has no first artefact, the practice is unproven at 4.2, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Which policy sets the threshold this comparison is testing against?
2. Has the policy been reviewed since the systems in the comparison changed?

How it connects to the draft

Guidance for policy makers belongs to 4 characterisation, and it gives the analysis one fixed point: The policy maker's choices are the reference against which a comparison is judged. Without them, an accuracy figure has no pass mark and a method has . A comparison that cannot place a result against 4.2 is measuring something the framework has not defined, and the report should say so.

In the register, 4.2 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.