CCC ISTI 26-300-01 Digital Identity Verification

Citation

Ferguson, Chris, Jory Hadsell and Craig Hayward. “Implementation of Required Digital Identity Verification.” Memorandum ISTI 26-300-01. California Community Colleges Chancellor’s Office, July 23, 2026. https://www.cccco.edu/wp-content/uploads/2026/08/isti-26-300-01-implementation-of-required-digital-identity-verification-a11y.pdf. Copy: raw/shared/2026-10-13 CCC ISTI 26-300-01 Digital Identity Verification.md (original: .pdf beside it), fetched 2026-10-13. Read 2026-10-15.

Bottom line

• From Aug. 11, 2026, every applicant to a California community college must verify identity before the application reaches the college. The standard is the National Institute of Standards and Technology (NIST) Special Publication 800-63, Identity Assurance Level 2 (IAL2).
• The California Community Colleges (CCC) system now holds verified digital identities for its applicants.
• The memo also shows the equity cost of identity checks. It sets out other paths for minors, students without technology and students with unusual documents.

Background

Since 2020, the CCC system has faced “increasingly sophisticated fraud activity affecting admissions, enrollment, and financial aid processes” (p. 1). The memo moves the system from opt-in to required identity verification. It names the vendors and tools in use and the dates of each step.

Key claims

• Required verification is effective Aug. 11, 2026. The application is delivered to the college only after verification “through an approved online process or via local in-person verification steps”. (p. 1)
• Online methods now are the California DMV Mobile Wallet and ID.me. Other paths include data sharing with trusted bodies, special admission and in-person checks. (p. 4)
• Proofing aligns with “NIST Special Publication 800-63 Digital Identity Guidelines, including Identity Assurance Level 2 (IAL2)”. The office may use “IAL2-equivalent profiles that are risk-adjusted for specific use cases (e.g., dual enrollment)”. (p. 3)
• The approach also draws on five other frameworks. They are the NIST Cybersecurity Framework, the NIST AI Risk Management Framework, the California Digital ID Framework, the CIS Critical Security Controls and the GAO fraud risk framework. (p. 3)
• Verification is “intended to authenticate identity, not to determine immigration or citizenship status. The California Community Colleges do not collect or store information regarding citizenship.” (p. 2)
• Colleges using CCCStart “will gain access to Socure for identity verification and Lightleap AI to detect and mitigate fraud”. (p. 7)
• Target date for system-wide cutover to CCCStart and the end of CCCApply: June 30, 2027. (p. 7)
• Multi-factor authentication on OpenCCC login has been in full production since June 22, 2026. (p. 5)
• Colleges must submit monthly fraud reports “as a condition of receiving Local and Systemwide Technology and Data Security (LSTADS) funds”. (p. 6)

Evidence and method

Policy guidance. It lists earlier memos from 2021 to 2025 but gives no fraud figures.

Limits

• No data on fraud volume, verification failure rates or effects on enrollment.
• Technical details go to colleges “through appropriate secure operational channels” and are not public. (p. 4)
• The memo is about admissions. It does not discuss AI compute.