IICTI Certified Digital Identity Security Professional

Holders demonstrate that they can apply and evaluate digital identity risk management and assurance frameworks, remote identity proofing, biometric PAD and injection attack defence, phishing-resistant authentication, passkeys and FIDO2 architecture and credential, session and account recovery lifecycle engineering, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Digital Identity Security Professional.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Digital identity risk management and assurance frameworks8% of the exam

   • Evaluate identity risk and select, tailor and justify assurance levels and compensating controls across regulatory and trust-framework requirements.
   • Scope: NIST SP 800-63-4 digital identity risk management (DIRM), IAL/AAL/FAL selection and tailoring, eIDAS 2.0 and ISO/IEC 29115 levels of assurance, PSD2 SCA, PCI DSS v4.0.1 and NIS2 identity obligations, trust frameworks and conformity assessment.
2. 02Remote identity proofing, biometric PAD and injection attack defence8% of the exam

   • Design and assess remote identity proofing pipelines that resist document, presentation, injection and deepfake attacks while remaining inclusive.
   • Scope: IAL2/IAL3 evidence strength and validation, eMRTD NFC chip authentication, ETSI TS 119 461, ISO/IEC 30107-3 presentation attack detection, CEN/TS 18099 injection attack detection, face-match error rates, trusted referees and supervised remote proofing.
3. 03Phishing-resistant authentication, passkeys and FIDO2 architecture9% of the exam

   • Architect phishing-resistant authentication and step-up schemes and evaluate authenticator choices against assurance and usability requirements.
   • Scope: WebAuthn Level 3 and CTAP 2.x mechanics, synced versus device-bound passkeys, attestation and FIDO MDS, AAL2/AAL3 authenticator requirements, verifier impersonation resistance, certificate-based and step-up authentication.
4. 04Credential, session and account recovery lifecycle engineering8% of the exam

   • Engineer credential, session and recovery lifecycles that preserve assurance from enrolment through revocation and resist takeover.
   • Scope: Authenticator binding and recovery, NIST SP 800-63B-4 password rules, breached-credential screening and password hashing, session cookie and token lifetimes, refresh token rotation, continuous access evaluation and device-bound sessions.
5. 05OAuth 2.x, OpenID Connect and SAML federation security9% of the exam

   • Evaluate and harden federation deployments by analysing protocol flows, token validation logic and trust configuration for exploitable flaws.
   • Scope: RFC 9700 OAuth security BCP, PKCE, PAR, JAR, DPoP and mTLS sender-constrained tokens, FAPI 2.0, OIDC token validation and logout, JWT pitfalls (RFC 8725), SAML signature wrapping and FAL selection.
6. 06Verifiable credentials, mDL and digital identity wallets8% of the exam

   • Architect credential issuance, presentation and verification ecosystems that balance assurance, holder binding, revocation and unlinkability.
   • Scope: W3C VC Data Model 2.0, IETF SD-JWT VC, ISO/IEC 18013-5/-7 mdoc, OpenID4VCI and OpenID4VP with DCQL, status lists, holder binding, unlinkability, EUDI Wallet ARF and trust lists.
7. 07PKI architecture, certificate automation and post-quantum migration9% of the exam

   • Design and govern PKI and certificate automation and lead crypto-agile migration to post-quantum algorithms with minimal service risk.
   • Scope: CA/Browser Forum validity reductions (SC-081), ACME and ARI automation, CT, CAA and MPIC, CRL versus OCSP, private PKI and name constraints, HSM key ceremonies, FIPS 203/204/205 and hybrid PQC migration planning.
8. 08Identity threat detection and response (ITDR)9% of the exam

   • Lead detection engineering and incident response for identity-centric attacks across on-premises directories, cloud IdPs and SaaS.
   • Scope: AiTM and device-code phishing, token and cookie theft, MFA fatigue, Kerberos and AD CS attacks, Golden SAML and federation trust tampering, OAuth app abuse, detection engineering, Shared Signals (CAEP/RISC) and identity incident response.
9. 09Identity fraud analytics, synthetic identities and deepfake risk8% of the exam

   • Evaluate fraud signals and models and design layered, measurable controls against synthetic identity, takeover and AI-enabled impersonation.
   • Scope: Synthetic identity and bust-out patterns, account opening and takeover fraud, device and behavioural signals, graph analytics, deepfake and voice-clone social engineering, fraud model metrics, label delay, drift and friction trade-offs.
10. 10Privacy engineering, consent and identity data protection8% of the exam

    • Design identity services that embed privacy by design and defend lawful-basis, minimisation and retention decisions under scrutiny.
    • Scope: GDPR lawful bases and Article 9 biometrics, DPIA, data minimisation and selective disclosure, pairwise identifiers, ISO/IEC 27560 consent records, ISO/IEC 27701, EU AI Act biometric provisions, retention conflicts and FedCM.
11. 11Workload, machine and AI agent identity security8% of the exam

    • Architect non-human and AI agent identity controls that replace static secrets with attested, short-lived and least-privilege credentials.
    • Scope: SPIFFE/SPIRE attestation and SVIDs, cloud workload identity federation, CI/CD OIDC trust policies, Kubernetes service account tokens, secrets elimination, RFC 8693 token exchange, MCP authorisation and delegated authority for AI agents.
12. 12Identity governance, privileged access and Zero Trust leadership8% of the exam

    • Lead an identity governance and Zero Trust programme, prioritising controls, metrics and investments by measurable risk reduction.
    • Scope: IGA joiner-mover-leaver automation, certifications and SoD, RBAC/ABAC/ReBAC and policy-as-code, PAM and just-in-time elevation, tiered admin models, NIST SP 800-207 and CISA ZTMM 2.0, IdP resilience, programme metrics and roadmap leadership.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner