Multi-factor authentication (MFA) was once the golden practice, but even it is no longer enough. Its effectiveness depends on the strength of the identity being authenticated. Attackers know this, so they target enrollment, onboarding, and account recovery, posing as incoming students to obtain a “real” credential in the first place.
“Strengthening identity and security is fundamentally an institutional process challenge, and that’s what makes it both complicated and consequential,” West said.
For many campuses, the hard part is not agreeing if identity proofing is needed. The truly hard part is figuring out where identity proofing actually happens across campuses, who owns those processes, where current security gaps lie, and turning loose practices into a robust approach that keeps faculty, staff, and student data safe.
“Identity fraud in higher education is no longer an edge case. It’s a systemic risk that costs institutions hard dollars, compromises institutional brand, and undermines the integrity of research,” said West.
Because it can seem like a major undertaking to implement identity proofing systems while juggling the day-to-day, Internet2 and InCommon are making it easier by providing resources and opportunities to meet you at any point of your identity proofing journey.
These resources will help you get aligned, get specific, and get moving by enabling you to:
- Build a stronger understanding of identity proofing through key terminology, frameworks, NIH guidance, and community-shared resources.
- Identify meaningful use cases on your campus and better understand the operational and financial implications of identity proofing.
- Take practical steps through hands-on workshops, assessments, and an 8-week accelerator focused on creating a roadmap for identity proofing readiness.
- Apply community-informed guidance to better support researchers, institutional systems, and long-term strategy.
“Acting now means campuses can build toward prevention rather than scrambling to meet a hard deadline while managing a breach or an audit,” West explained, speaking about this community-driven support offered through both InCommon and Internet2.
West’s point underscores the challenge facing higher education: this is not simply about checking a box on a federal requirement by 2027. It’s about building a stronger, more coordinated approach to identity proofing that protects institutional operations, research, and trust before pressure turns into crisis.
Get Ahead of 2027
With 2027 approaching, institutions don’t have time to start from scratch or work in isolation. Explore the resources, guidance, and community support available now to assess your readiness and start building a smarter path toward compliance.
FAQs
In case you missed the January 2026 IAM Online, “Making it Easier for Researchers: NIH’s use of InCommon for Controlled-Access Data,” here are three questions from our session to help shape your understanding of the NIH and federal compliance.
Q:
Can campuses still use campus credentials for researcher access under the new NIH
model?
A: Yes. NIH’s federation model now includes the InCommon
Federation as an approved identity provider, meaning researchers can use their home
institution as long as it meets the stronger assurance requirements.
Q:
Does NIH offer any tools to help campuses check readiness?
A: Yes. NIH has developed a compliance check tool that campuses can use to verify
their identity provider’s signaling the required proofing, MFA, and attribute release.
Q:
What’s the difference between identity proofing and identity
assurance?
A: Identity proofing is the process of verifying
someone’s real-world identity (“Who are you really?”). Identity assurance is the confidence
level resulting from that proofing. It tells relying parties how confident they are
of that person’s identity. In other words, proofing is the work done to verify identities, and
assurance is the score or level of confidence.