Do all four sub-models of eCH-0170 always have to be applied together?

No: the sub-models are composed according to the type of IAM system, and each can also be used alone to rate a single IAM actor, for example the registration model to rate a registration authority; the federation sub-model applies only to federated systems.

The four sub-models are building blocks:

• Composition by system type. A company's internal login without any federation has no authentication confirmation travelling between parties, so the federation sub-model (VSF) simply does not apply. A federated system with an identity provider and many relying parties needs all four.
• Rating one actor. Many IAM ecosystems split roles between organisations. A registration authority (RA), the office that checks identity documents and enrols people, can be rated with the registration sub-model alone, independently of who later runs the authentication.

This modularity is what makes the model useful for federations: each participant can be assessed for the part it actually performs, and the overall level of a concrete login is then put together from the parts.