FedRAMP
Trust Center
Public FedRAMP 20x Class C information for NextgenID User Interface as a Service (UIaaS).
// Overview
General Information
The NextgenID UIaaS is a SaaS offering that resides in the AWS East/West Infrastructure as a Service (IaaS) cloud environment. NextgenID UIaaS provides identity & credential management services utilizing Supervised Remote Identity Proofing (SRIP) services. NextgenID UIaaS provides clients with an identity-proofing solution meeting digital Identity Assurance Level 3 (IAL3), and lower, requirements. Applicants that have a requirement to provide evidence of their identity utilize the NextgenID UIaaS Identity Station and Identity as a Service software to self-enroll while being remotely supervised by a SRIP Agent so that the requirements for IAL3 are met. The NextgenID UIaaS Identity Station captures the applicant's biometrics and identity documentation, including biometrics (fingerprints and photo), documents (driver's license, passport, etc.), and other biographic information to verify the identity of the applicant. After the SRIP Agent has verified the applicant's identity, the NextgenID UIaaS transmits the package to the adjudicating agency.
Status. NextgenID UIaaS is pursuing FedRAMP 20x Class C authorization and is not yet FedRAMP authorized. The Digital Identity Level below describes authentication to the cloud service itself; identity proofing delivered through UIaaS is Kantara certified at IAL3 under NIST SP 800-63-3, a separate program that is current. Claims on this page last verified September 2026.
Provider
NextgenID, Inc.
Cloud Service Offering
NextgenID User Interface as a Service (UIaaS)
FedRAMP ID
Pending FedRAMP assignment
Certification Type
FedRAMP 20x Class C
Authorization Path
FedRAMP Agency
Service Model
Software as a Service (SaaS)
Deployment Model
Government-Only Cloud Community
Business Category
Identity and Access Management
FIPS 199 Security Categorization
Moderate
Digital Identity Level (access to the cloud service)
Level 2 (IAL2 / AAL2 / FAL2)
Identity Proofing Delivered
IAL3 (Kantara certified, NIST SP 800-63-3)
Kantara IAL3 Trust Mark
Granted 2024-06-10 (IAF-Approval-24.03-KI); renewed June 2025 and June 2026; triennial expiry 2027-06-30; KIAF 1430; Component Service; USA, all states
FedRAMP Authorization Status
FedRAMP 20x Class C authorization in progress; not yet FedRAMP authorized
Fully Operational Since
2023-08-23
Hosting Environment
AWS US East/West
UEI Number
MG92A8AJK343
Independent Assessor
To be engaged
Next Ongoing Certification Report
To be added
Company Address
10300 Eaton Place, Suite 105, Fairfax, VA 22030
Product Website
Product Logo
// Contacts
Contact Information
Sales Contact
Email: info@nextgenid.com
Phone: 1-888-373-8648
Security Contact
Mamoun Hayel — Security Contact
Email: mhayel@nextgenid.com
// Public Service List (CDS-CSO-SVC)
Services & Security Categories
The service list and security categories are documented in the System Security Plan. The FIPS 199 security categorization is Moderate. The listed availability date is 08/23/2023.
| Service | Description | Security Category (FIPS 199) | Available Since |
|---|---|---|---|
| Identity Station | Self-enrollment stations located in client facilities. The Identity Station captures the applicant's biometrics and identity documentation, including biometrics (fingerprints and photo), documents (driver's license, passport, etc.), and other biographic information to verify the identity of the applicant. No PII is persisted on the Identity Station. | Moderate | 2023-08-23 |
| Workflow Application | The workflow software application installed on the Identity Station packages and encrypts the enrollee's data (the enrollment package) for transmission. | Moderate | 2023-08-23 |
| Supervised Remote Identity Proofing (SRIP) System | Connects Identity Stations and Trust Agents for remotely supervised enrollment sessions, supporting screen sharing and video conferencing through a built-in WebRTC-based communication infrastructure. Comprises the SRIP Agent Console and the SRIP Management Server. | Moderate | 2023-08-23 |
| Command Center | Enterprise-level reporting, monitoring, and deployment management system for the Identity Stations, enabling workflow creation, deployment scheduling, telemetry collection, and infrastructure monitoring. Comprises the Command Center Management Server and the Management Console. | Moderate | 2023-08-23 |
| Transactional Gateway | Facilitates the secure exchange of verification information between validation partners via API connections, including address verification, face matching, and pre-enrollment and package submission. | Moderate | 2023-08-23 |
// Secure Configuration Guidance
Secure Configuration Guidance
User Guide
NextgenID UIaaS User Guide, maintained as Appendix D of the System Security Plan (SSP-Appendix_D-NextgenID UIaaS-User_Guide).
Baseline Configuration Guides
Configuration management for the offering is documented in the NextgenID UIaaS Configuration Management Plan (SSP Appendix H), which is available upon request. Baseline hardening aligns with the CIS Benchmarks published below.
CIS PostgreSQL 18 Benchmark
CIS consensus configuration hardening baseline for PostgreSQL 18 (v1.0.0), as applied to the offering. Per CIS terms of use, the benchmark is available directly from the Center for Internet Security.
CIS Docker Benchmark
CIS consensus configuration hardening baseline for Docker (v1.8.0), as applied to the offering. Per CIS terms of use, the benchmark is available directly from the Center for Internet Security.
// Security & Continuous Monitoring
Security & Continuous Monitoring
Internal Security
NextgenID maintains a comprehensive information security program supported by documented policies, standards, and procedures designed to protect customer information. These policies establish the security, privacy, and operational requirements that govern how employees and contractors perform their responsibilities while fostering a culture of security awareness, accountability, and ethical conduct.
Encryption
NextgenID protects sensitive information by implementing strong cryptographic controls for data both in transit and at rest. All communications containing customer or organizational data are secured using industry-standard encryption protocols and current cryptographic best practices. Cryptographic algorithms, protocols, and cipher suites are periodically reviewed and updated to align with recognized industry standards and emerging security guidance, ensuring the continued confidentiality and integrity of information processed by the platform.
Security Awareness and Training
NextgenID provides all personnel with security awareness and role-based training appropriate to their job functions and access privileges. Training is provided during onboarding and at regular intervals thereafter and covers topics including information security awareness, data protection, insider threat awareness, phishing and social engineering, incident reporting, and the protection of sensitive data.
Secure Software Development and Code Reviews
NextgenID follows secure software development practices throughout the Software Development Lifecycle (SDLC). Source code is maintained within a controlled version control repository, and all changes are subject to peer review prior to promotion into staging or production environments. Pull requests undergo technical and security review to validate code quality, adherence to secure coding standards, and compliance with established development practices before approval.
Network Security
NextgenID employs a layered network security architecture that uses logical segmentation and access controls to protect sensitive systems and information. Production environments are isolated from development, testing, and other non-production environments to reduce risk and prevent unauthorized access to production data. Network boundaries are enforced through secure routing, firewalls, access control mechanisms, and least-privilege principles.
Audit & Logging
AWS CloudTrail is utilized as the audit log solution to track user activity, and Amazon CloudWatch provides security and event monitoring for the NextgenID applications and infrastructure. Elasticsearch (Elastic Cloud, FedRAMP Agency authorization FR2004446306) is a leveraged FedRAMP-authorized service within the environment.
Role & Attribute-Based Access Control
Personnel roles and privileges are defined in the SSP User Summary Table (Appendix S), and separation of duties is documented in the Separation of Duties Matrix (Appendix R).
Federated Identity
The offering supports Digital Identity Level 2 (IAL2 / AAL2 / FAL2) for federal agency consumers, as documented in the SSP Digital Identity Worksheet (Appendix E).
Vanta API Documentation
Continuous, automated control validation evidence for the FedRAMP Key Security Indicators (KSI) is produced with the FedRAMP-authorized Vanta Governance, Risk, and Compliance (GRC) tool. Vanta API documentation for programmatic access to this evidence is available below.
Future Plans
NextgenID will engage in a formal assessment with a FedRAMP Authorized Third Party Assessor Organization (3PAO) to formally authorize the Cloud Service Offering (CSO). NextgenID will make the authorization decision available to federal customers via the Trust Center and API integrations, and will host collaborative Continuous Monitoring meetings to discuss open security items.
// Sub-processors
Third-Party Service Providers (Sub-processors)
To support the delivery, operation, and security of its Cloud Service Offering (CSO), NextgenID may engage carefully selected third-party service providers to perform specific business, operational, or technical functions on its behalf. When these providers process customer information in support of NextgenID's services, they operate as sub-processors under the direction and control of NextgenID.
This page identifies NextgenID's authorized sub-processors, their geographic locations, and the services they provide in support of our platform.
Prior to engaging any sub-processor, NextgenID conducts a comprehensive due diligence review that includes technical, security, privacy, legal, operational, and compliance assessments. Each provider is evaluated to ensure it meets NextgenID's security, privacy, and risk management requirements, as well as applicable contractual and regulatory obligations, including those supporting FedRAMP and other federal compliance frameworks.
NextgenID engages sub-processors only after they have successfully satisfied our vendor risk management process. All approved sub-processors are contractually required to implement appropriate administrative, technical, and physical safeguards to protect customer information and to maintain security controls that are commensurate with the services they provide. NextgenID continuously monitors the performance and security posture of its sub-processors throughout the duration of the business relationship to ensure ongoing compliance with our security and privacy standards.
| Sub-processor | Headquarters / Primary Processing Location | Services Provided |
|---|---|---|
| Amazon Web Services (AWS) | Seattle, Washington, USA (AWS US East/West commercial regions; AWS GovCloud (US) available for High-impact programs) | Provides secure cloud infrastructure, compute, networking, storage, database services, encryption services, backup, monitoring, and disaster recovery capabilities that support the hosting and operation of the NextgenID Cloud Service Offering (CSO). |
| Microsoft Azure | Redmond, Washington, USA (commercial Azure regions in the United States only; Azure Government is not used) | Provides cloud platform services supporting identity integration, application hosting, secure networking, and infrastructure services. Microsoft services support development and test environments and enterprise productivity functions. No production enrollment data or enrollee personal information is processed or stored in Azure. |
| BeyondTrust | Johns Creek, Georgia, USA | Provides Privileged Access Management (PAM), privileged remote access, credential vaulting, session monitoring, and privileged account security to control and audit administrative access to NextgenID information systems. |
| Smarty | Provo, Utah, USA | Address validation and standardization. Receives address data transiently during identity proofing; does not retain enrollment records. |
| IDScan.net | Louisiana, USA | Identity document parsing and validation. Receives document data transiently during identity proofing; does not retain enrollment records. |
| Remove.bg (Kaleido AI GmbH) | EU, GDPR; being retired | Background removal for enrollment photographs. Receives image data transiently during credential photo processing; does not retain enrollment records. |
// Resources (CDS-CSO-IRP)
Resources
Policies, statements, and related documents for the offering. Word counts are approximate.
| Policy / Procedure | Summary | Version | Last Updated | Words | Availability |
|---|---|---|---|---|---|
| Code of Conduct Policy | Company-wide conduct standards covering trust and credibility, respect for the individual, equal employment and anti-harassment commitments, and reporting channels. | 1.0 | 2021-12-01 | 4,056 | Available on request. |
| NextgenID Rules of Behavior | Appropriate-use rules for NextgenID and client information technology resources, acknowledged by system users. | 1.1 | 2026-01 | 1,454 | Available on request. |
| Website Privacy Policy | Public privacy policy for the NextgenID website, covering information collected, use, and visitor choices. The website does not collect biometric data; biometric capture occurs only within supervised enrollment services. | — | 2026-07-15 | 881 | Public. |
| Accessibility Statement | NextgenID's commitment to an accessible, inclusive, and user-friendly experience for all users, designed to support Section 508 of the Rehabilitation Act, the Web Content Accessibility Guidelines (WCAG) where applicable, and the Americans with Disabilities Act (ADA). Covers accessibility standards, continuous improvement through manual and automated accessibility testing, keyboard-only navigation and screen reader compatibility testing, and how to request assistance or report an accessibility barrier (support@nextgenid.com). | — | 2026-07 | 308 | Public. |
| Information Security Policy | Governing policy for the NextgenID information security program, covering roles, control objectives, and enforcement. | — | — | — | Available on request (NDA). |
| Incident Response Procedure | Procedure for detecting, reporting, triaging, containing, and resolving security incidents, including customer and federal notification steps. | — | — | — | Available on request (NDA). |
| Contingency Planning Procedure | Procedure for backup, recovery, and continuity of the UIaaS cloud service offering. | — | — | — | Available on request (NDA). |
| Media Protection Policy | Policy for handling, marking, storage, transport, and sanitization of media containing enrollment or system data. | — | — | — | Available on request (NDA). |
// Access
Accessing TrustCenter Information
Public Information
This page is public and does not require authentication. It is updated when certification details change.
Machine-Readable Data
The JSON version uses the same data as this page.
Full Certification Package
Federal agencies and other necessary parties may request access to the full FedRAMP Certification Data package by contacting the security contact above. NextgenID also maintains a secure Trust Center that provides public security documentation and controlled access to restricted FedRAMP 20x Class C authorization artifacts for authorized government stakeholders.
TrustCenter Navigation Instructions
The NextgenID Trust Center is the central repository for security, privacy, compliance, and FedRAMP 20x Class C documentation for the NextgenID Cloud Service Offering (CSO). Publicly available resources can be accessed by visiting https://www.nextgenid.com and selecting Trust Center from the Resources menu. Certain FedRAMP 20x authorization artifacts, security documentation, and assessment materials contain controlled or sensitive information and are available only through the Private Trust Center. Federal agencies, authorized government personnel, prospective government customers, and other approved stakeholders may request access by selecting Request Access from the upper-right corner of the Trust Center portal and providing the required request information. Each request is reviewed by NextgenID to verify the requestor's identity, organizational affiliation, and legitimate business need before access is granted.