- Wg-ancr - mailman.kantarainitiative.org

Fwd: Kantara ANCR WG CSF 2.0 Comments
by Salvatore D'Agostino 03 Nov '23

03 Nov '23

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 https://IDmachines.com ________________________________ From: Salvatore D'Agostino <sal(a)idmachines.com> Sent: Friday, November 3, 2023 4:09 PM To: cyberframework(a)nist.gov <cyberframework(a)nist.gov> Subject: Kantara ANCR WG CSF 2.0 Comments Thanks you for the opportunity to submit comments on the Cybersecurity Framework Interim Draft. We would be happy to follow up on these, Sincerely, Sal D'Agostino On behalf of the Kantara Initiative ANCR WG. IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

ANCR WG
by Gigi 31 Oct '23

31 Oct '23

Hello all. Please find below the agenda for the points to speak tomorrow: * TPI revision (comments) https://github.com/KantaraInitiative/WG-ANCR/tree/main/TPI * TPI report Ps. If you won't be able to attend the meeting, please send an email mentioning it. Thank you. ________________________________________________________________________________ Microsoft Teams meeting Join on your computer, mobile app or room device Click here to join the meeting<https://teams.microsoft.com/l/meetup-join/19%3ameeting_YmZlY2FjNjYtNjFhOS00…> Meeting ID: 222 884 446 396 Passcode: Xo3S5q Download Teams<https://www.microsoft.com/en-us/microsoft-teams/download-app> | Join on the web<https://www.microsoft.com/microsoft-teams/join-a-meeting> Learn More<https://aka.ms/JoinTeamsMeeting> | Meeting options<https://teams.microsoft.com/meetingOptions/?organizerId=388a1bdd-70d7-4c45-…> ________________________________________________________________________________

1 0

call today
by Salvatore D'Agostino 25 Oct '23

25 Oct '23

I am doing a training in Toronto today so it will be hard to make the call. Please go ahead without me. Still time to review the TPS&I. Expanding code of conduct and glossary, as other items for review. Also I have NIST comments in process for the 2.0 Cybersecurity Framework. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

FW: Register Now! NIST Personal Identity Verification Webinar
by Salvatore D'Agostino 19 Oct '23

19 Oct '23

Just received this. From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Thursday, October 19, 2023 2:30 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Register Now! NIST Personal Identity Verification Webinar Register Now! <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248 7463/2805250/nist_crop.png> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vY29udGVudC5nb3ZkZWxpdmVyeS5jb20vYWNj b3VudHMvVVNOSVNUL2J1bGxldGlucy8zNzY0MmExIiwiYnVsbGV0aW5faWQiOiIyMDIzMTAxOS44 NDMyNTUzMSJ9.iGdqCjUnqBleb6eOa76GppVQURGiYY0jmUhu-w4HLIg/s/15856856/br/22862 0664378-l> View As Web Page <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280 0392/cyber-header_original.png> NIST Cybersecurity and Privacy Program Register for our NIST Webinar! Learn about Revisions to Two of our Identity Special Publications Event Date: November 8, 2023 Time: 1:00 PM-2:30 PM ET Description: The National Institute of Standards and Technology (NIST) will be hosting a webinar to introduce two recently published Public Draft Special Publications (SPs): The 3-part <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vY3NyYy5uaXN0Lmdvdi9wdWJzL3NwLzgwMC83 My9wdDEvNS9pcGQiLCJidWxsZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.seMJhhNw-U2c --Vv9Sz2tE2BOO-9LRMBHes-MrOuKRQ/s/15856856/br/228620664378-l> Drafts of SP 800-73 Revision 5, Interfaces for Personal Identity Verification (PIV) and <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vY3NyYy5uaXN0Lmdvdi9wdWJzL3NwLzgwMC83 OC81L2lwZCIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.SUXxWpKf0ol1P7YrP v2vA8r3mschS0E1dPXaRnyCskY/s/15856856/br/228620664378-l> Draft SP 800-78 Revision 5, Cryptographic Algorithms and Key Sizes for Personal Identity Verification. These publications are complements to FIPS 201-3, which defines the requirements and characteristics of government-wide interoperable identity credentials used by federal employees and contractors. The workshop will discuss the necessary changes made to the PIV card, its credentials, and cryptographic capability to align with FIPS 201-3. Full Agenda: 1:00 PM-1:05 PM - Introduction and Welcome 1:05 PM-1:15 PM - Introduction to the PIV Standard 1:15 PM-1:45 PM - Changes to Draft SP 800-73 Revision 5 1:45 PM-2:15 PM - Changes to Draft SP 800-78 Revision 5 2:15 PM-2:30 PM - Key Dates/Next Steps/Closing Visit the event page to register and learn more about the workshop. If you have any questions, please reach out to our team at <mailto:piv_comments@nist.gov> piv_comments(a)nist.gov. <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3Lm5jY29lLm5pc3QuZ292L2dldC1pbnZv bHZlZC9hdHRlbmQtZXZlbnRzL3BlcnNvbmFsLWlkZW50aXR5LXZlcmlmaWNhdGlvbi13ZWJpbmFy IiwiYnVsbGV0aW5faWQiOiIyMDIzMTAxOS44NDMyNTUzMSJ9._nMm1VHJrw9Uhpqc62B_thJQagt qnBQ-JE8pRAVfzec/s/15856856/br/228620664378-l> Register Now NIST Cybersecurity and Privacy Program Questions/Comments about this notice: <mailto:piv_comments@nist.gov> piv_comments(a)nist.gov NCCoE Website questions: <mailto:nccoe@nist.gov> nccoe(a)nist.gov Connect with us <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3LmZhY2Vib29rLmNvbS9OSVNUIiwiYnVs bGV0aW5faWQiOiIyMDIzMTAxOS44NDMyNTUzMSJ9.qaJ4eZw_SnEKtyv-qr55XroaE-Hqvb3hP7V 5DVDnOGU/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vdHdpdHRlci5jb20vTklTVCIsImJ1bGxldGlu X2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.ankJWpMpZIcGzigZC360Vx7Oq-QZ83TTJKmyv2eHN tk/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL05JU1QiLCJidWxs ZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.nDNbFKcS6tcIzUNkesJUykjc6vX7bJq4yMY2 FSe3dys/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9jb21wYW55L25p c3QiLCJidWxsZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.rE5a_oupVR1rFt--KtDuUtqP pMCRn8vU5MtxnoVsVnY/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3Lmluc3RhZ3JhbS5jb20vbmlzdC8iLCJi dWxsZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.jYA7j9lArNiOjucwTovtAzLCs091I4eT YZoYeRjJZYU/s/15856856/br/228620664378-l> Received this email from a friend? <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vcHVibGljLmdvdmRlbGl2ZXJ5LmNvbS9hY2Nv dW50cy9VU05JU1Qvc3Vic2NyaWJlci9uZXc_dG9waWNfaWQ9VVNOSVNUXzEiLCJidWxsZXRpbl9p ZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.DDxB_yWmqHL8BemJUuc9p7Prs3p8-I3wXTqDMc0CUq4/ s/15856856/br/228620664378-l> Subscribe here. <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3Lm5pc3QuZ292L2l0bCIsImJ1bGxldGlu X2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.8EaTVnyEWPKfBR5gBfqoSIouIMxubKpOGsse6sr5P Iw/s/15856856/br/228620664378-l> Subscriber services: <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vcHVibGljLmdvdmRlbGl2ZXJ5LmNvbS9hY2Nv dW50cy9VU05JU1Qvc3Vic2NyaWJlci9lZGl0P3ByZWZlcmVuY2VzPXRydWUjdGFiMSIsImJ1bGxl dGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.I96vs7GTxOcGZK11UTrj535SrnJNZm-F8uRj1 xmAwYk/s/15856856/br/228620664378-l> Manage Preferences | <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vcHVibGljLmdvdmRlbGl2ZXJ5LmNvbS9hY2Nv dW50cy9VU05JU1Qvc3Vic2NyaWJlci9lZGl0P3ByZWZlcmVuY2VzPXRydWUjdGFiMSIsImJ1bGxl dGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.S0MWx6TLC2NjpNDAW6jRfTjnM7ZxsC5W7H81e xyP5_U/s/15856856/br/228620664378-l> Unsubscribe | <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vc3Vic2NyaWJlcmhlbHAuZ292ZGVsaXZlcnku Y29tLyIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.i0lA5WdBqz7ec4eNkP-VR fFZuI8iV-mo3cDomH11yCM/s/15856856/br/228620664378-l> Help _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vc3Vic2NyaWJlcmhlbHAuZ292ZGVsaXZlcnku Y29tLyIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.zaakIPw4S07-6Nkab9_CP zXLivQbPqGcOqOqCwS_sdo/s/15856856/br/228620664378-l> . Technical questions? Contact inquiries(a)nist.gov <mailto:inquiries@nist.gov> . (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 . Gaithersburg, MD 20899 . 301-975-6478 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTUsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vc3Vic2NyaWJlcmhlbHAuZ3JhbmljdXMuY29t LyIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.jgG9eFCvmWRqMFlaK1YLCgCSP _imR-4XIT2ZsBugI_Y/s/15856856/br/228620664378-l> <https://links.govdelivery.com/track?enid=ZWFzPTEmYnVsbGV0aW5yZWNpcGllbnRpZD 0yMjg2MjA2NjQzNzgtbCZzdWJzY3JpYmVyaWQ9MTU4NTY4NTYmbXNpZD0mYXVpZD0mbWFpbGluZ2 lkPTIwMjMxMDE5Ljg0MzI1NTMxJm1lc3NhZ2VpZD1NREItUFJELUJVTC0yMDIzMTAxOS44NDMyNT UzMSZkYXRhYmFzZWlkPTEwMDEmdHlwZT1vcGVuJnNlcmlhbD0xNjg2MjIwNCZlbWFpbGlkPXNhbE BpZG1hY2hpbmVzLmNvbSZ1c2VyaWQ9c2FsQGlkbWFjaGluZXMuY29tJnRhcmdldGlkPSZmbD0mbX ZpZD0mZXh0cmE9JiYm>

1 0

Meeting reminder Noon Eastern
by Salvatore D'Agostino 11 Oct '23

11 Oct '23

Hi WG, A lot underway and some momentum building. https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Last minutes from GitHub https://github.com/KantaraInitiative/WG-ANCR/blob/main/AuthC/Minutes/AuthC-… Agenda Roll (5 min) IPR (2 min) Agenda Approval (5 Min) Administration, GitHub min, etc, WG funding (10 Min) TPS and I LC Vote and Actions (20 Min) Other Activity (10 Min) Actions (5 min) Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Please note our new address. Email, phones, and other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation to the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

call at Noon Eastern reminder
by Salvatore D'Agostino 11 Oct '23

11 Oct '23

Hi WG, A lot underway and some momentum building. https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09 Last minutes from GitHub https://github.com/KantaraInitiative/WG-ANCR/blob/main/AuthC/Minutes/AuthC-0 9-14-23.md Agenda Roll (5 min) IPR (2 min) Agenda Approval (5 Min) Administration, GitHub min, etc, WG funding (10 Min) TPS and I LC Vote and Actions (20 Min) Other Activity (10 Min) Actions (5 min) Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Call Today
by Salvatore D'Agostino 04 Oct '23

04 Oct '23

I am at a conference in Kansas City today giving a privacy keynote. I will leave it to you to work the agenda, sorry for the late notice. We can expect the TPS/I to be approved in 2 weeks so we should make sure we are happy with it. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 https://IDmachines.com

1 0

Fwd: Submission amended
by Mark Lizar 01 Oct '23

01 Oct '23

Hello All, FYI - On submitting Consent Receipts for a DSA conference (for international platform regulation) Very last minute. Begin forwarded message: From: DSAC2024 <no-reply(a)oxfordabstracts.com> Subject: Submission amended Date: October 1, 2023 at 12:50:38 AM EDT To: info(a)0pn.org Reply-To: R.F.Fahy(a)uva.nl Submission amended Dear Mark Lizar, You have amended your submission. Your reference number for this submission is 82. Your submission is currently complete. Completed abstracts will be reviewed and you will be informed by Tuesday, 31st October, 2023 whether or not your abstract has been accepted for presentation. Follow the link below to view the information that will appear in the abstract book, if accepted. https://app.oxfordabstracts.com/events/4796/submissions/628893/abstract-boo… Sent by Oxford Abstracts<https://click.pstmrk.it/3/www.oxfordabstracts.com/jD81/A06zAQ/AQ/6b3e1702-c…>. For abstract management and many other academic conference services, please visit us at www.oxfordabstracts.com<https://click.pstmrk.it/3/www.oxfordabstracts.com/jD81/A06zAQ/AQ/6b3e1702-c…> [Oxford Abstracts]<https://click.pstmrk.it/3s/www.oxfordabstracts.com/jD81/A06zAQ/AQ/6b3e1702-…> Powered by Oxford Abstracts<https://click.pstmrk.it/3s/www.oxfordabstracts.com/jD81/A06zAQ/AQ/6b3e1702-…>

1 0

Australian Government releases response to the Privacy Act Review Report
by Paul Templeman 28 Sep '23

28 Sep '23

Hi ANCR WG Thanks Mark and Sal for the opportunity to share the Australian perspective at 0PN Digital - Implementing Transparency & Consent to enable the Digital Commons last week. I have a bit of an update. The Australian Government has responded to the Privacy Act Review Report. See https://www.ag.gov.au/rights-and-protections/publications/government-respon…. Chapter 4 of the response is "Improve transparency and control" including consent, privacy policies and collection notices, individual rights, and ability for individuals to seek redress for interferences with privacy. An overview is below or the full report is available at https://www.ag.gov.au/rights-and-protections/publications/government-respon…. Privacy Reform - what is it? Consultation The Privacy Act Review was undertaken by the Attorney-General's Department and involved nearly three years of extensive consultation. The Report concluded that it is necessary to overhaul Australia's privacy laws, as many other countries have done, to ensure they remain fit-for-purpose in the digital age. Feedback following the release of the Report has reiterated a clear expectation that Government will strengthen privacy laws to ensure the collection, use and disclosure of people's personal information is reasonable, reflects community expectations and is adequately protected from unauthorised access and misuse. Industry and other stakeholders have acknowledged the importance of privacy reform and emphasised the need for reforms to strike an appropriate balance between enhanced privacy protections and impacts on regulated entities. What's next? The Government's response to the Privacy Act Review Report sets out the pathway for privacy reforms. The Government is committed to introducing legislation to protect the personal information of Australians in 2024. Of the 116 proposals in the Privacy Act Review Report, the Government response agrees to 38 proposals, agrees in-principle to 68 proposals and notes 10 proposals. 'Agrees in-principle' indicates that further engagement with entities and a comprehensive impact analysis is needed before the Government makes a final decision on implementation of a proposal. The Attorney-General's Department will lead the next stage of work, which will involve the development of legislative amendments informed by a detailed impact analysis and targeted consultations with stakeholders. This measured approach will ensure Government is informed of potential compliance costs for regulated entities and other potential economic costs or benefits (including for consumers) in finalising its decisions. The Government will also consider appropriate transition periods as part of the development of any legislation. While this work is underway the Attorney-General's Department will also progress implementation of non-legislative proposals, for example to develop a Children's Online Privacy Code and additional guidance to assist entities to meet their obligations. The Government will ensure there are meaningful opportunities to engage in this next phase of privacy reforms, noting there has been extensive consultation to date on many issues. Overview of themes The privacy reforms will complement other reforms being progressed by the Government, including Digital ID, the 2023-2030 Australian Cyber Security Strategy, the National Strategy for Identity Resilience, and Supporting Responsible AI in Australia The privacy reforms will be progressed under the following focus areas: Bring the Privacy Act into the digital age The reforms will bring the scope and application of the Privacy Act into the digital age by recognising the public interest in protecting privacy and exploring further how best to apply the Act to a broader range of information and entities which handle this information. Uplift protections The reforms will uplift the protections afforded by the Privacy Act by requiring entities to be accountable for handling individuals' information within community expectations, and enhancing requirements to keep information secure and destroy it when it is no longer needed. Reforms to the Notifiable Data Breaches scheme will assist with reducing harms which may result from data breaches and introduce new organisational accountability requirements to encourage entities to incorporate privacy-by-design into their operating processes. New specific protections will also apply to high privacy risk activities and more vulnerable groups including children. Increase clarity and simplicity for entities and individuals The reforms will provide entities with greater clarity on how to protect individuals' privacy, and simplify the obligations that apply to entities which handle personal information on behalf of another entity. The reforms will increase the flexibility of code-making under the Act, reduce inconsistency and improve coherence across different legal frameworks with privacy protections, and simplify requirements for transferring personal information overseas, particularly to those countries with substantially similar privacy laws. Improve control and transparency for individuals over their personal information The reforms will provide Individuals with greater transparency and control over their information through improved notice and consent mechanisms. The reforms will also explore the scope and application of new rights in relation to personal information and increased avenues to seek redress for interferences with privacy, through a direct right of action permitting individuals to apply to the courts for relief for interferences with privacy under the Privacy Act and a new statutory tort for serious invasions of privacy. Strengthen enforcement The reforms will increase enforcement powers for the OAIC, expand the scope of orders the court may make in civil penalty proceedings and empower the courts to consider applications for relief made directly by individuals. A strategic review of the OAIC and further consideration of its resourcing requirements, including investigating the effectiveness of an industry funding model and establishing litigation funds, will enhance the effectiveness of Australia's privacy regulator. Best Paul ... Paul Templeman paul(a)templeman.co

2 1

CSF call for comments
by Salvatore D'Agostino 27 Sep '23

27 Sep '23

https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-20/ipd We mentioned this on the call today. So I did the normal thing, a word search, and a few other comments. Transparency 0 mentions Transparent 0 mentions Consent 0 mentions Notice 0 mentions Authority 0 mentions Authorization 2 mentions Only one control Identity Management, Authentication, and Access Control (PR.AA): Access to physical and logical assets is limited to authorized users, services, and hardware, and is managed commensurate with the assessed risk of unauthorized access (formerly PR.AC) PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties (formerly PR.AC-01, PR.AC-03, PR.AC-04) (There needs to be a notice created from the assessed risk, what is assessed in this case would also be a gap, as it is information risk, and not, for example, a control impact assessment.) Also interestingly is that they do have a concentric view, all we need to do is change what is at the center. [image: image.png] Best, Sal

1 0