If your institution can’t confidently verify who’s accessing its systems, everything else you secure is subject to breach.
That’s the challenge more campuses are facing now. Fraud is getting more sophisticated.
Federal expectations are rising. And the question for many institutions is no longer whether identity proofing matters, but how quickly they can refine their practice and increase the rigor of identity assurance.
That’s where Internet2 and InCommon come in. Together, they’re helping research and education (R&E) take a more practical, coordinated approach to identity proofing and identity assurance by providing guidance, shared resources, and opportunities to learn from peer institutions already doing the work.
Why is Identity Proofing Critical?
Colleges and universities are dealing with multifaceted pressures. Ghost students, account recovery abuse, and fraud attempts at the help desk are creating real operational and financial strain.
At the same time, institutions are preparing for more rigorous federal identity assurance requirements from agencies like the National Institutes of Health (NIH) and the Department of Education.Internet2’s fall 2025 identity proofing survey highlighted three areas where campuses are feeling that pressure most:
- access to federally supported research
- financial aid fraud prevention
- credential issuance and recovery
In addition to daily challenges, federal agencies like the National Institutes of Health (NIH) and the Department of Education are raising identity assurance standards, adding more rigor to the process, and making identity proofing a priority in 2026. And that increased rigor is pushing institutions to look beyond login security and toward identity confidence. Authentication proves access to an account; identity assurance proves the person holding it is who they claim to be.
MFA Is Not the Fix
Multi-factor authentication still matters, but it’s only as strong as the identity behind the login. If a person can slip through enrollment, onboarding, or account recovery using a convincing false identity, they can end up with credentials that look legitimate.
That’s why identity proofing has become such an important part of the conversation. It helps institutions strengthen trust at the front end, before access is granted and before the damage is done.
As Ann West, senior director of Strategic Partnerships & Research at InCommon, points out, this isn’t just an IT issue. “It’s a business problem that touches admissions, HR, the registrar, financial aid, and research administration all at once,” she said.
Where the Challenge Begins
Most institutions don’t need to be convinced that identity proofing is important. The harder part is figuring out what’s already happening across campus, where gaps exist, who owns which processes, and how to turn already-existing practices into a coordinated and rigorous system that meets the standards set by the federal government.
That kind of work takes time. “It’s fundamentally an institutional process challenge, and that’s what makes it both complicated and consequential,” stated West, pointing out that identity proofing practices that meet federal standards require shared systems, extensive conversation, use-case implementation, and a central plan to begin and implement a sustainable strategy.
How Internet2 and InCommon Can Help
Internet2 and InCommon are making that path easier to navigate by offering resources and support for institutions at different stages of the journey.
These resources can help campuses:
- better understand identity proofing standards, terminology, and approaches
- explore institution-level use cases and risk areas
- assess current practices and identify gaps
- build a more intentional roadmap for identity assurance
This isn’t merely about charging towards a 2027 federal deadline. It’s about strengthening infrastructure that protects research, systems, and sensitive institutional data, while reinforcing the work institutions are already doing to build trust, reduce risk, and support secure access.
Begin Today
As 2027 draws closer, institutions will have less and less room to figure this out in real time. Starting now creates space to assess current practices, close critical gaps, and make thoughtful decisions before urgency becomes disruption.
