FedRAMP
Trust Center
Public FedRAMP 20x Class C information for NextgenID User Interface as a Service (UIaaS).
// Overview
General Information
The NextgenID UIaaS is a SaaS offering that resides in the AWS East/West Infrastructure as a Service (IaaS) cloud environment. NextgenID UIaaS provides identity & credential management services utilizing Supervised Remote Identity Proofing (SRIP) services. NextgenID UIaaS provides clients with an identity-proofing solution meeting digital Identity Assurance Level 3 (IAL3), and lower, requirements. Applicants that have a requirement to provide evidence of their identity utilize the NextgenID UIaaS Identity Station and Identity as a Service software to self-enroll while being remotely supervised by a SRIP Agent so that the requirements for IAL3 are met. The NextgenID UIaaS Identity Station captures the applicant's biometrics and identity documentation, including biometrics (fingerprints and photo), documents (driver's license, passport, etc.), and other biographic information to verify the identity of the applicant. After the SRIP Agent has verified the applicant's identity, the NextgenID UIaaS transmits the package to the adjudicating agency.
Provider
NextgenID, Inc.
Cloud Service Offering
NextgenID User Interface as a Service (UIaaS)
FedRAMP ID
Pending FedRAMP assignment
Certification Type
FedRAMP 20x Class C
Authorization Path
FedRAMP Agency
Service Model
Software as a Service (SaaS)
Deployment Model
Government-Only Cloud Community
Business Category
Identity and Access Management
FIPS 199 Security Categorization
Moderate
Digital Identity Level
Level 2 (IAL2 / AAL2 / FAL2)
Fully Operational Since
2023-08-23
Hosting Environment
AWS US East/West
UEI Number
MG92A8AJK343
Independent Assessor
To be engaged
Next Ongoing Certification Report
To be added
Company Address
10300 Eaton Place, Suite 105, Fairfax, VA 22030
Product Website
Product Logo
// Contacts
Contact Information
Sales Contact
Email: info@nextgenid.com
Phone: 1-888-373-8648
Security Contact
Jaafar Abdeen — Security Contact
Email: jabdeen@nextgenid.com
// Public Service List (CDS-CSO-SVC)
Services & Security Categories
The service list and security categories are documented in the System Security Plan. The FIPS 199 security categorization is Moderate. The listed availability date is 08/23/2023.
| Service | Description | Security Category (FIPS 199) | Available Since |
|---|---|---|---|
| Identity Station | Self-enrollment stations located in client facilities. The Identity Station captures the applicant's biometrics and identity documentation, including biometrics (fingerprints and photo), documents (driver's license, passport, etc.), and other biographic information to verify the identity of the applicant. No PII is persisted on the Identity Station. | Moderate | 2023-08-23 |
| Workflow Application | The workflow software application installed on the Identity Station packages and encrypts the enrollee's data (the enrollment package) for transmission. | Moderate | 2023-08-23 |
| Supervised Remote Identity Proofing (SRIP) System | Connects Identity Stations and Trust Agents for remotely supervised enrollment sessions, supporting screen sharing and video conferencing through a built-in WebRTC-based communication infrastructure. Comprises the SRIP Agent Console and the SRIP Management Server. | Moderate | 2023-08-23 |
| Command Center | Enterprise-level reporting, monitoring, and deployment management system for the Identity Stations, enabling workflow creation, deployment scheduling, telemetry collection, and infrastructure monitoring. Comprises the Command Center Management Server and the Management Console. | Moderate | 2023-08-23 |
| Transactional Gateway | Facilitates the secure exchange of verification information between validation partners via API connections, including address verification, face matching, and pre-enrollment and package submission. | Moderate | 2023-08-23 |
// Secure Configuration Guidance
Secure Configuration Guidance
User Guide
NextgenID UIaaS User Guide, maintained as Appendix D of the System Security Plan (SSP-Appendix_D-NextgenID UIaaS-User_Guide).
Baseline Configuration Guides
Configuration management for the offering is documented in the NextgenID UIaaS Configuration Management Plan (SSP Appendix H), which is available upon request. Baseline hardening aligns with the CIS Benchmarks published below.
CIS PostgreSQL 18 Benchmark
CIS consensus configuration hardening baseline for PostgreSQL 18 (v1.0.0), as applied to the offering. Per CIS terms of use, the benchmark is available directly from the Center for Internet Security.
CIS Docker Benchmark
CIS consensus configuration hardening baseline for Docker (v1.8.0), as applied to the offering. Per CIS terms of use, the benchmark is available directly from the Center for Internet Security.
// Security & Continuous Monitoring
Security & Continuous Monitoring
Internal Security
NextgenID maintains a comprehensive information security program supported by documented policies, standards, and procedures designed to protect customer information. These policies establish the security, privacy, and operational requirements that govern how employees and contractors perform their responsibilities while fostering a culture of security awareness, accountability, and ethical conduct.
Encryption
NextgenID protects sensitive information by implementing strong cryptographic controls for data both in transit and at rest. All communications containing customer or organizational data are secured using industry-standard encryption protocols and current cryptographic best practices. Cryptographic algorithms, protocols, and cipher suites are periodically reviewed and updated to align with recognized industry standards and emerging security guidance, ensuring the continued confidentiality and integrity of information processed by the platform.
Security Awareness and Training
NextgenID provides all personnel with security awareness and role-based training appropriate to their job functions and access privileges. Training is provided during onboarding and at regular intervals thereafter and covers topics including information security awareness, data protection, insider threat awareness, phishing and social engineering, incident reporting, and the protection of sensitive data.
Secure Software Development and Code Reviews
NextgenID follows secure software development practices throughout the Software Development Lifecycle (SDLC). Source code is maintained within a controlled version control repository, and all changes are subject to peer review prior to promotion into staging or production environments. Pull requests undergo technical and security review to validate code quality, adherence to secure coding standards, and compliance with established development practices before approval.
Network Security
NextgenID employs a layered network security architecture that uses logical segmentation and access controls to protect sensitive systems and information. Production environments are isolated from development, testing, and other non-production environments to reduce risk and prevent unauthorized access to production data. Network boundaries are enforced through secure routing, firewalls, access control mechanisms, and least-privilege principles.
Audit & Logging
AWS CloudTrail is utilized as the audit log solution to track user activity, and Amazon CloudWatch provides security and event monitoring for the NextgenID applications and infrastructure. Elasticsearch (Elastic Cloud, FedRAMP Agency authorization FR2004446306) is a leveraged FedRAMP-authorized service within the environment.
Role & Attribute-Based Access Control
Personnel roles and privileges are defined in the SSP User Summary Table (Appendix S), and separation of duties is documented in the Separation of Duties Matrix (Appendix R). Okta Directory (FedRAMP Agency authorization F1512167750) is leveraged for directory services.
Federated Identity
The offering supports Digital Identity Level 2 (IAL2 / AAL2 / FAL2) for federal agency consumers, as documented in the SSP Digital Identity Worksheet (Appendix E). Okta IDaaS (Regulated Cloud) is a leveraged FedRAMP-authorized identity service.
Vanta API Documentation
Continuous, automated control validation evidence for the FedRAMP Key Security Indicators (KSI) is produced with the FedRAMP-authorized Vanta Governance, Risk, and Compliance (GRC) tool. Vanta API documentation for programmatic access to this evidence is available below.
Future Plans
NextgenID will engage in a formal assessment with a FedRAMP Authorized Third Party Assessor Organization (3PAO) to formally authorize the Cloud Service Offering (CSO). NextgenID will make the authorization decision available to federal customers via the Trust Center and API integrations, and will host collaborative Continuous Monitoring meetings to discuss open security items.
// Sub-processors
Third-Party Service Providers (Sub-processors)
To support the delivery, operation, and security of its Cloud Service Offering (CSO), NextgenID may engage carefully selected third-party service providers to perform specific business, operational, or technical functions on its behalf. When these providers process customer information in support of NextgenID's services, they operate as sub-processors under the direction and control of NextgenID.
This page identifies NextgenID's authorized sub-processors, their geographic locations, and the services they provide in support of our platform.
Prior to engaging any sub-processor, NextgenID conducts a comprehensive due diligence review that includes technical, security, privacy, legal, operational, and compliance assessments. Each provider is evaluated to ensure it meets NextgenID's security, privacy, and risk management requirements, as well as applicable contractual and regulatory obligations, including those supporting FedRAMP and other federal compliance frameworks.
NextgenID engages sub-processors only after they have successfully satisfied our vendor risk management process. All approved sub-processors are contractually required to implement appropriate administrative, technical, and physical safeguards to protect customer information and to maintain security controls that are commensurate with the services they provide. NextgenID continuously monitors the performance and security posture of its sub-processors throughout the duration of the business relationship to ensure ongoing compliance with our security and privacy standards.
| Sub-processor | Headquarters / Primary Processing Location | Services Provided |
|---|---|---|
| Amazon Web Services (AWS) | Seattle, Washington, USA (Cloud services hosted in AWS GovCloud (US)) | Provides secure cloud infrastructure, compute, networking, storage, database services, encryption services, backup, monitoring, and disaster recovery capabilities that support the hosting and operation of the NextgenID Cloud Service Offering (CSO). |
| Microsoft Azure | Redmond, Washington, USA (U.S. Azure and Azure Government regions, as applicable) | Provides cloud platform services supporting identity integration, application hosting, secure networking, and infrastructure services. Microsoft services may also support development, testing, and enterprise productivity functions where applicable. |
| GitHub | San Francisco, California, USA | Provides secure source code repository, version control, software collaboration, issue tracking, and DevSecOps workflow management to support the secure software development lifecycle (SDLC). GitHub Enterprise security features are used to protect source code and support secure development practices. |
| BeyondTrust | Johns Creek, Georgia, USA | Provides Privileged Access Management (PAM), privileged remote access, credential vaulting, session monitoring, and privileged account security to control and audit administrative access to NextgenID information systems. |
| Okta | San Francisco, California, USA | Provides Identity and Access Management (IAM), Single Sign-On (SSO), Multi-Factor Authentication (MFA), lifecycle management, and identity federation services for secure authentication and access to NextgenID systems and applications. |
// Resources (CDS-CSO-IRP)
Resources
Policies, statements, and related documents for the offering. Word counts are approximate.
| Policy / Procedure | Summary | Version | Last Updated | Words | Availability |
|---|---|---|---|---|---|
| Code of Conduct Policy | Company-wide conduct standards covering trust and credibility, respect for the individual, equal employment and anti-harassment commitments, and reporting channels. | 1.0 | 2021-12-01 | 4,056 | Available on request. |
| NextgenID Rules of Behavior | Appropriate-use rules for NextgenID and client information technology resources, acknowledged by system users. | 1.1 | 2026-01 | 1,454 | Available on request. |
| Website Privacy Policy | Public privacy policy for the NextgenID website, covering information collected, use, and visitor choices. The website does not collect biometric data; biometric capture occurs only within supervised enrollment services. | — | 2026-07-15 | 881 | Public. |
| Accessibility Statement | NextgenID's commitment to an accessible, inclusive, and user-friendly experience for all users, designed to support Section 508 of the Rehabilitation Act, the Web Content Accessibility Guidelines (WCAG) where applicable, and the Americans with Disabilities Act (ADA). Covers accessibility standards, continuous improvement through manual and automated accessibility testing, keyboard-only navigation and screen reader compatibility testing, and how to request assistance or report an accessibility barrier (support@nextgenid.com). | — | 2026-07 | 308 | Public. |
// Access
Accessing TrustCenter Information
Public Information
This page is public and does not require authentication. It is updated when certification details change.
Machine-Readable Data
The JSON version uses the same data as this page.
Full Certification Package
Federal agencies and other necessary parties may request access to the full FedRAMP Certification Data package by contacting the security contact above. NextgenID also maintains a secure Trust Center that provides public security documentation and controlled access to restricted FedRAMP 20x Class C authorization artifacts for authorized government stakeholders.
TrustCenter Navigation Instructions
The NextgenID Trust Center is the central repository for security, privacy, compliance, and FedRAMP 20x Class C documentation for the NextgenID Cloud Service Offering (CSO). Publicly available resources can be accessed by visiting https://www.nextgenid.com and selecting Trust Center from the Resources menu. Certain FedRAMP 20x authorization artifacts, security documentation, and assessment materials contain controlled or sensitive information and are available only through the Private Trust Center. Federal agencies, authorized government personnel, prospective government customers, and other approved stakeholders may request access by selecting Request Access from the upper-right corner of the Trust Center portal and providing the required request information. Each request is reviewed by NextgenID to verify the requestor's identity, organizational affiliation, and legitimate business need before access is granted.