July 2023 - WG-IDAssurance - mailman.kantarainitiative.org

Canceled event with note: Identity Assurance Work Group Call @ Thu Jul 27, 2023 12pm - 1pm (EDT) (wg-idassurance@kantarainitiative.org)
by lynzie＠kantarainitiative.org 27 Jul '23

27 Jul '23

This event has been canceled with a note: "No meeting July 27" Identity Assurance Work Group Call Thursday Jul 27, 2023 ⋅ 12pm – 1pm Eastern Time - New York Location Zoom https://www.google.com/maps/search/Zoom?hl=en Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

No IAWG Meeting on July 27
by Lynzie Adams 26 Jul '23

26 Jul '23

Dear IAWG Members, We will take another week of summer hiatus as many people are unavailable for tomorrow's meeting. I hope to get back to meeting routinely in August. We look forward to seeing you then. Please watch for my updates next week. Lynzie Adams Assurance Program Manager

1 0

Reminder: No IAWG Call Today
by Lynzie Adams 20 Jul '23

20 Jul '23

Dear IAWG Members, There is no IAWG call today, Thursday, July 20. Please take a moment to review the July 13th meeting minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/227311673/2023-07-13+D…>. I will send an agenda for our next meeting next week. In the meantime, take a moment to complete the *2023 Kantara Initiative DEIA survey.* Please consider completing the survey, even if you completed the 2022 survey. The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. Lynzie Adams Assurance Program Manager

1 0

DHS announcement - Digital Identity Testbed: Understanding Digital Attacks on Remote Identity Proofing Collaboration Event (CE)
by Andrew Hughes 19 Jul '23

19 Jul '23

Heads up The Department of Homeland Security (DHS) HSWERX pilot innovation hub, a partnership between the DHS Science and Technology Directorate (S&T) and DEFENSEWERX (DWX), will host a Collaboration Event (CE) to identify needs and define requirements for a testbed to evaluate capabilities that would detect, deter, and mitigate digital attacks on remote identity proofing technologies and processes. The purpose of the CE is to identify current limitations and ideate mechanisms to overcome limiting factors. During this open forum, participants from government, industry, academia, and national laboratories will consider specific challenge areas and develop potential paths forward with actionable plans for implementation. Information about the event and registration is here: https://go.ratio.exchange/opps/challenge.cfm?i=C802E970-3DCE-47C4-9932-0CFC… *Andrew Hughes *CISM CISSP mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

No IAWG Call This Week (July 20)
by Lynzie Adams 17 Jul '23

17 Jul '23

Dear IAWG Members, There will not be an IAWG call on Thursday, July 20. I will send out an agenda and the minutes from the July 13 meeting next week. In the meantime, take a moment to complete the *2023 Kantara Initiative DEIA survey.* Please consider completing the survey, even if you completed the 2022 survey. The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. Lynzie Adams Assurance Program Manager

1 0

Join Us in 1 Hour - IAWG Call Today 2023-07-13
by Lynzie Adams 13 Jul '23

13 Jul '23

Dear IAWG Members, Please join us at *12pm* US Eastern Time for our next IAWG meeting. We'll be skipping our admin updates this week to allow more time to hear from our invited CSPs and others on the proposed changes to some areas of the criteria. You may have seen in our recent newsletter that the *2023 Kantara Initiative DEIA survey is now live.* Please consider completing the survey, even if you completed the 2022 survey. The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-07-13* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - June 29 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/223576065/2023-06-29+D…> 2. *Discussion: * - 800-63-3 Criteria Issues to Resolve <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/May+2023+Mee…> - 63a#0490-0580 supervised remote identity proofing applicable to IAL2 and IAL 3 currently. Proposing updates. - 63a#0670 - T5-1 update 3. *Any Other Business* Lynzie Adams Assurance Program Manager

1 0

Invitation & Agenda for IAWG Call 2023-07-13
by Lynzie Adams 11 Jul '23

11 Jul '23

Dear IAWG Members, Please join us at *12pm* on Thursday, July 13 US Eastern Time for our next IAWG meeting. We'll be skipping our admin updates this week to allow more time to hear from our invited CSPs and others on the proposed changes to some areas of the criteria. You may have seen in our recent newsletter that the *2023 Kantara Initiative DEIA survey is now live.* Please consider completing the survey, even if you completed the 2022 survey. The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-07-13* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - June 29 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/223576065/2023-06-29+D…> 2. *Discussion: * - 800-63-3 Criteria Issues to Resolve <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/May+2023+Mee…> - 63a#0490-0580 supervised remote identity proofing applicable to IAL2 and IAL 3 currently. Proposing updates. - 63a#0670 - T5-1 update 3. *Any Other Business* Lynzie Adams Assurance Program Manager

1 0

Canceled event with note: Identity Assurance Work Group Call @ Thu Jul 6, 2023 12pm - 1pm (EDT) (wg-idassurance@kantarainitiative.org)
by kantarainitiative＠gmail.com 05 Jul '23

05 Jul '23

This event has been canceled with a note: "No call July 6. Next meeting: July 13 at 12pm ET." Identity Assurance Work Group Call Thursday Jul 6, 2023 ⋅ 12pm – 1pm Eastern Time - New York Location Zoom https://www.google.com/maps/search/Zoom?hl=en Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

No IAWG Call on July 6
by Lynzie Adams 05 Jul '23

05 Jul '23

Hello IAWG, There will be no IAWG call on Thursday, July 6. We plan to meet on Thursday, July 13 where we have invited CSPs to join us to discuss updates to the Supervised Remote Identity Proofing criteria at IAL2 and the T5-1 proposed updates. I will send a formal agenda next week. You can review the other proposed updates and areas of discussion on our IAWG wiki page <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/Summer+2023+…> . Lynzie Adams Assurance Program Manager

1 0

Re: Letter from ARB and Updated Kantara Service Approval Handbook
by Richard G. WILSHER (＠Zygma Inc.) 04 Jul '23

04 Jul '23

Dear Leif, ARB, Lynzie, Regarding the changes being implemented in SAH v4.0, I’d like to make a few observations on process and potential consequences of the changes made, for your consideration. As I understand Kantara’s organization: a) The IAWG owns and sets the assessment criteria – it effectively owns the ‘scheme’; b) Assessors review CSPs’ evidence to determine whether (or not) conformity is found against the assessment criteria; c) The ARB exists to ensure that assessments executed against the assessment criteria are performed correctly and at a consistent level across all Assessors / Classes of Approval; d) The ARB is entitled to ask Assessors to present their findings in a particular fashion to help the ARB in its assigned responsibilities and to foster consistency in the application of the assessment criteria; e) This reflects the principals of IS17065. On the basis of the above, I see some problems arising from the SAH revisions: 1) The ARB (rather than the IAWG) appears to be setting rules for the creation by Assessors of assessment criteria (the ‘tests’, per the SAH). This fractures the IAWG / ARB division of responsibilities; 2) It leads to different Assessors potentially (likely, I would say) determining different tests for the same or a very similar subject, such that: a. for any test subject supporting CSPs, there will be no consistency; b. not having a single ‘spec’ for testing any specific supporting service will lead to inefficiency; 3) Providers of the potential test subjects are unlikely to want to play the game so any testing will be of a ‘black box’ nature; 4) Assessors now start to rely on tests (read ‘assessment criteria’) and implicitly on expected test results which they have themselves drafted and which therefore are perfectly good, couldn’t possibly fail [insert preferred sarcasm emoticon here]. This seems to be a potential transgression of the assessors’ need to not be assessing their own work; 5) Such tests can only reasonably be applied within the scope of the requirement of any applicable assessment criteria – I really don’t think that assessors should go about creating ‘new’ tests/criteria or ‘layering’ existing criteria upon those test subject providers; 6) There are cost implications for assessors to define the tests, to conduct the tests and for CSPs to support the tests. Noting the ARB’s short-term expectation of when the changes should become effective, assessments which have already been contracted will almost certainly need to be renegotiated. This will not be welcomed by CSPs, and I daresay nor by assessors; I think it unfortunate that there was no consultation of these changes with assessors or the IAWG at large. Had there been, perhaps some of these points could have been addressed and potential problems mitigated before a definitive document was produced. I note also that the email of June 21st was sent only to assessors. Furthermore, IF these sorts of ideas are to be established then CSPs need fair notice from KI, NOT from the Assessors (let KI be the purveyor of this news ;-). As far as I am aware, CSPs have yet to be advised of these new expectations, which restricts everyone’s ability to address/react to the changes. May I suggest that a more stable solution to the need identified by the ARB (and I don’t disagree with the principle point being raised) would be the development of additional criteria which can be uniformly understood and applied, and that such criteria be developed by the ARB? The matter of when such criteria should come into force should also be addressed where the work associated with assessments is being increased, rather than only ‘tweaking’ criteria interpretations or their applicability. Thank you for considering this ten cents-worth. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Lynzie Adams [mailto:lynzie@kantarainitiative.org] Sent: Wednesday, June 21, 2023 19:19 To: Jimmy Jung; Richard G. WILSHER (@Zygma); Scott Perry; Ray Kimble; beltus.ikechi(a)kuma.pro Subject: Letter from ARB and Updated Kantara Service Approval Handbook Hello Assessors, The ARB recently approved an update to the Service Approval Handbook <https://kantarainitiative.org/download/7590/> . I uploaded it to Kantara's website today and it will be the required version on October 1. Please take an opportunity to review the updates, which include: This revision incorporates these material changes: * removed “-fulfilled by a pre-approved service” as an Assessor’s SoC finding and corresponding guidance (§3.4.1); * introduced “Registered Applicant Fee” (§5.1, §5.2.3); * added special provision for Non-Kantara Approved Services (§6.1.1.3) (see attached letter) * increased duration that a service must be operating before a Fully Operational Service Assessment shall be completed (§6.1.2.1; §6.1.2.3); (from 60 to 90 days) * redefined a Fully Operational Assessment once RTO status lapses (§6.1.2.3); (it's now a triennial assessment after the RTO lapses) * requirements for Assessor on-site visits (§6.1.3; §8.1.3); and (now a SHOULD with justification if site visit does not occur) * updated the due date of renewal applications for Triennial or ACR assessments (§8.2). (due at the beginning of the month, rather than the end) Additionally, the following non-material changes have been embodied: * changed “Registered Service” status to “Registered Applicant” (§5); * relaxed target completion date for ARB reviews (§6.2.1.1); and * revisions throughout to increase clarity of the process. I'm also happy to answer any questions about what the updates include. I will be sharing the new version and updates with my CSP contacts as well. Further, please see the attached letter from the ARB about the use of non-Kantara Approved services, which is also referenced in the SAH update. Additionally, the ARB's next task is to update the Assessor Accreditation Handbook. I'll reach out when those updates are complete. Lynzie Adams Assurance Program Manager https://docs.google.com/uc?export=download&id=1f_FyEBepOKYcAfkyIsaSFzguA7Tg…

1 0