September 2023 - WG-IDAssurance - mailman.kantarainitiative.org

Invitation & Agenda for IAWG Call 2023-09-28
by Amanda Gay 28 Sep '23

28 Sep '23

Dear IAWG Members, Please join us at *12pm *US Eastern Time on Thursday, September 28 for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-08-24* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - 2023-09-21 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/264339457/2023-9-21+Me…> - Kantara Updates - Assurance Updates 2. *Discussion: * - Charter and Structure Discussion 3. *Any Other Business* Reach out with any concerns/questions! Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 1

Improper amendment to 63B#1900
by Richard G. WILSHER (＠Zygma Inc.) 26 Sep '23

26 Sep '23

A few weeks ago, during our IAWG call, we agreed to amend 63B#1900 as shown below: 63B#1900 The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity, unless prohibited by any legal instrument, and give notice of such to the Subject, when any one of the following occurs: 63B#1900 a) the Subject's online identity ceases to exist; OR 63B#1900 b) the Subject requests revocation; OR 63B#1900 c) the CSP determines that the Subject no longer meets its eligibility requirements; OR 63B#1900 d) the CSP is obligated to do so in response to a legal instrument. This time the baby went out with the bath water. Whilst I find the revision to the main clause to be acceptable (well, a minor tweak to the grammar, see below), we should NOT have eliminated sub-clause d). This clause actually requires the CSP to respond to a legal instrument requiring that they revoke, so must be retained. The introduced clause should be taken to be a broad reference to ANY legal prohibition, whereas d) applies to an express order or instruction. I therefore suggest that the change should be only as shown below (purple text just to be clear about differentiation): 63B#1900 The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity and, unless prohibited by any legal instrument, and give notice of such to the Subject, when any one of the following occurs: 63B#1900 a) the Subject's online identity ceases to exist; OR 63B#1900 b) the Subject requests revocation; OR 63B#1900 c) the CSP determines that the Subject no longer meets its eligibility requirements; OR 63B#1900 d) the CSP is obligated to do so in response to a legal instrument. Lessons? Maybe always allow a little breathing time between what look like good changes but may deserve more consideration before pouring the concrete (not sure what that has to do with babies and bathwater, but . subject for discussion this week?) Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Request: CO_SAC Review Against ISMS Schemes
by Lynzie Adams 22 Sep '23

22 Sep '23

Hello IAWG, This is a follow-up to Richard Wilsher's email below from 9/16. During the IAWG call yesterday, the group reviewed his suggestions and felt as though they were appropriate. We are requesting individuals in IAWG to review Richard's first cut analysis and examine in light of FEDRAMP and 27001 - and anyone with specialized knowledge of other potential ISMS schemes is requested to do a similar analysis using those schemes (i.e., SOC2 Type 2). The IAWG will revisit this on October 5. Please plan to attend that call if you are able to do an analysis. Lynzie Adams Assurance Program Manager On Sat, Sep 16, 2023 at 8:40 PM Richard G. WILSHER (@Zygma Inc.) < RGW(a)zygma.biz> wrote: > As actioned (by myself!) during the most recent IAWG mtg, herewith a first > stab at how the CO_SAC could/should be reviewed for potential revisions to > accomplish at least the following objectives: > > 1) Aligning requirements between CO and 63x, where there is overlap > and non-uniformity (col. Q)*; > > 2) How a ‘free pass’ might be given for CSPs whose service(s) fall > within scope of some InfoSec Management scheme (col. R); > > 3) And any other ideas which occurred to me whilst making this > initial pass … (col.S). > > Hopefully any notes will be sufficiently helpful, but you can badger me > next Thursday if that isn’t so. This is a first stab, so chip in if you > can. > > * Just a minor caveat. Potentially, 63A/B criteria may need to change to > ensure uniformity, of terms at least, though I think the real changes need > to be in the CO_SAC (e.g. remove ‘Service Defn’, stick to ‘CrP’). > > > > > > > *Richard G. WILSHERCEO & Founder, Zygma Inc.www.Zygma.biz > <http://www.Zygma.biz>+1 714 797 9942* > > > _______________________________________________ > A Community Group mailing list of KantaraInitiative.org > WG-IDAssurance mailing list -- wg-idassurance(a)kantarainitiative.org > To unsubscribe send an email to staff(a)kantarainitiative.org > List archives -- > https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantar… > ______ > Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance > >

1 0

Join Us in 1 Hour - IAWG Call - 2023-09-21
by Lynzie Adams 21 Sep '23

21 Sep '23

Dear IAWG Members, Please join us at *12pm *US Eastern Time for our next IAWG meeting. The public comment period for the 63A_SAC is open. You can view the information here <https://kantara.atlassian.net/wiki/spaces/GI/pages/252837889/PCIPR20230905> . If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey <https://www.surveymonkey.com/r/KI_DEIA>* on behalf of your organization. Feel free to forward the link to an appropriate contact within your organization. They will be closing the survey soon. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-09-21* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - Kantara Updates - Assurance Updates 2. *Discussion: * - CO_SAC updates <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> as we continue the work toward removing Technical class of approval - Richard's first stab is linked. 3. *Any Other Business* Lynzie Adams Assurance Program Manager

1 0

Invitation & Agenda for IAWG Call 2023-09-21
by Lynzie Adams 20 Sep '23

20 Sep '23

Dear IAWG Members, Please join us at *12pm *US Eastern Time on Thursday, September 21 for our next IAWG meeting. The public comment period for the 63A_SAC is open. You can view the information here <https://kantara.atlassian.net/wiki/spaces/GI/pages/252837889/PCIPR20230905> . If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey <https://www.surveymonkey.com/r/KI_DEIA>* on behalf of your organization. Feel free to forward the link to an appropriate contact within your organization. They will be closing the survey soon. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-09-21* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - Kantara Updates - Assurance Updates 2. *Discussion: * - CO_SAC updates <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> as we continue the work toward removing Technical class of approval - Richard's first stab is linked. 3. *Any Other Business* Lynzie Adams Assurance Program Manager

1 0

2023-09-07 action fulfilled
by Richard G. WILSHER (＠Zygma Inc.) 16 Sep '23

16 Sep '23

As actioned (by myself!) during the most recent IAWG mtg, herewith a first stab at how the CO_SAC could/should be reviewed for potential revisions to accomplish at least the following objectives: 1) Aligning requirements between CO and 63x, where there is overlap and non-uniformity (col. Q)*; 2) How a 'free pass' might be given for CSPs whose service(s) fall within scope of some InfoSec Management scheme (col. R); 3) And any other ideas which occurred to me whilst making this initial pass . (col.S). Hopefully any notes will be sufficiently helpful, but you can badger me next Thursday if that isn't so. This is a first stab, so chip in if you can. * Just a minor caveat. Potentially, 63A/B criteria may need to change to ensure uniformity, of terms at least, though I think the real changes need to be in the CO_SAC (e.g. remove 'Service Defn', stick to 'CrP'). Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Reminder: No IAWG Call Today
by Lynzie Adams 14 Sep '23

14 Sep '23

Hello all, Just a reminder we will NOT meet today. Watch for an agenda next week! Lynzie Adams Assurance Program Manager

1 0

No September 14 IAWG Call
by Lynzie Adams 12 Sep '23

12 Sep '23

Hello IAWG, There will be no call on Thursday, September 14. We will reconvene next week, September 21. Please watch for an agenda with more information. Lynzie Adams Assurance Program Manager

1 0

Canceled event with note: Identity Assurance Work Group Call @ Thu Sep 14, 2023 12pm - 1pm (EDT) (wg-idassurance@kantarainitiative.org)
by lynzie＠kantarainitiative.org 12 Sep '23

12 Sep '23

This event has been canceled with a note: "No September 14 IAWG call." Identity Assurance Work Group Call Thursday Sep 14, 2023 ⋅ 12pm – 1pm Eastern Time - New York Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

Join Us in 1 Hour - IAWG Call Today! 2023-09-07
by Lynzie Adams 07 Sep '23

07 Sep '23

Dear IAWG Members, Please join us at *12pm *US Eastern Time for our next IAWG meeting. The public comment period for the 63A_SAC is open. You can view the information here <https://kantara.atlassian.net/wiki/spaces/GI/pages/252837889/PCIPR20230905> . If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey <https://www.surveymonkey.com/r/KI_DEIA>* on behalf of your organization. Feel free to forward the link to an appropriate contact within your organization. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-09-07* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-08-31 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/254738433/2023-08-31+M…> - Kantara Updates - Assurance Updates 2. *Discussion: * - IAWG recommendations <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/Summer+2023+…> - specifically #3-4 regarding technical class of approval and CO_SAC updates. 3. *Any Other Business* Lynzie Adams Assurance Program Manager

1 0