February 2025 - WG-IDAssurance - mailman.kantarainitiative.org

Election Results & Feb. 27 Meeting Cancelation
by Yehoshua Silberstein 24 Feb '25

24 Feb '25

Hi everyone, Following our recent elections, I’m honored to serve as the new Chair of the IAWG, with Andrew as Vice-Chair. We look forward to working with all of you in our new roles. In the meantime, we’re canceling this week’s IAWG meeting (and potentially next week’s) as we work with Carol and Kay to better understand and clarify the roles, responsibilities, and structure of the new program. Our goal is to gather the necessary details to help you understand how this will take shape, and we’ll follow up once we have more to share and confirm the next meeting date. Thanks, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

Meeting notes from 2025-02-13 IAWG call
by Andrew Hughes 20 Feb '25

20 Feb '25

Hello IAWG! Here are the notes from today - please let me know of errors and omissions. Thanks! https://kantara.atlassian.net/wiki/spaces/IAWG/pages/872742914/2025-02-13+I… *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 1

IAWG Meeting agenda 2025-02-13
by Andrew Hughes 13 Feb '25

13 Feb '25

Hi IAWG Agenda for this week's call: - Regular standing items - Refinement on proposed Purpose/Scope text for the 2025 IAWG Charter - hope to complete on this call if possible - Leadership candidates/election completion - if we have quorum we can elect or seat leadership candidates by acclimation. Nomination period is still open. So far we have Yehoshua Silberstein for Chair and Andrew Hughes for Vice-Chair. We really could use an active Secretary to take notes, post stuff and maintain the action items log. See you on Thursday February 13, 2025 Noon Eastern Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

4 7

Relying parties
by mhaeaking＠freeuk.com 10 Feb '25

10 Feb '25

It's hard to follow all the things done in the name of user control and privacy that are anything but. An EU barrier to trade and reduction in user control in the name of security has been to control all the relying parties. https://epicenter.works/en/content/eidas-one-step-forward-two-steps-back also laments the unique identifier being genuinely unique for good anti-fraud reasons, ingoring that a unique identifier is a fundamental requirement of the world bank model. (Which the UK is both supporting and refusing, although at least the UK relying party policy has been changed to be sensible, perhaps only because the relying party is paying for the 'service'.) Given that we would all complain were the US to expect everyone to register in the US if they wanted US customers (including US tourists), it's odd that there has been little consideration of the international implications. Or is nobody seriously thinking it will fly? Meanwhile, many will recall the Swiss plebiscite which required a public sector provider to support public sector applications, whatever other options were available. A recent UK change has gone further and upturned the commercial model https://www.computerweekly.com/blog/Computer-Weekly-Editors-Blog/A-driving-… although with 50 suppliers more than half will each get less than 2% of any market. I have not heard of any of the 50 getting or predicting a return any time soon. The one bit of bright news - whatever you think of the framework - is that the UK government system has indeed been independently blessed - by Kantara this time. (tScheme looked at the PKI root that was never used, so it's not unprecedented, but still good news.) Mark

1 0

A new Assessor ??
by Richard G. WILSHER (＠Zygma Inc.) 08 Feb '25

08 Feb '25

Kay, Andrew et al., It has been brought to my attention that there is a new 'Accredited Assessor' posted on the TSL, namely KI! I have to say, this causes great surprise and great concern, firstly as one with a deeply-vested interest in KI and secondly as an accredited assessor. There are a few significant ethical problems about this (quotes below taken from the TSL entry), amongst which are: 1) How can KI's ARB perform an unbiased assessment of itself in order to find itself worthy of accreditation UNDER PRESENT ARRANGEMENTS? 2) IF KI were to perform an assessment under the present operational arrangements, wouldn't review by the ARB also present a massive conflict of interest (I note that the ARB has expressly required, as a unique condition of its accreditation, that Zygma performs and gets client approval of an Impartiality Risk Identification prior to each assessment. Why wouldn't this be applied in this case, and what would be the outcome)? 3) Is this posting based on self-attestation ("Our internal auditors have undertaken a rigorous assessment of their skills, competencies and qualifications" - my emphasis)? 4) Where did its assessors gain their experience performing assessments under present arrangements, as claimed ("Each [auditor] is experienced in Kantara Initiative's existing assurance process")? 5) Until now TSL postings have been diligently arranged in alphabetic order - in which alphabet does 'G' conveniently come after 'Z'? This appears to be incredibly precipitous, one can only assume it being based on the expectation of accreditation under IS17065 at some future point ("and also in audits, assessments and evaluations in line with the ISO 17065 process" - what is the present relevance of IS17065? And what is the relevance of "We also undertake certification for the UK DIATF" if there is a separate UK-facing TSL - it doesn't fall within the scope of assessments for which the 'US' TSL is published? In fact, this shouldn't be the 'US' TSL, it should be the 'International' TSL. I would urge the immediate withdrawal of this entry in the TSL. I don't believe that it does Kantara Initiative any credit whatsoever. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

KI's path towards IS17065 Accreditation
by Richard G. WILSHER (＠Zygma Inc.) 08 Feb '25

08 Feb '25

Kay, Carol, Andrew et al., I found the 'special invitation' meeting on Feb 3rd interesting but lacking in substance as to how Kantara's proposed Certification Body (KCB) is actually going to function. I say this as one who has a long term participation in and care for KI in all its phases and of course particularly from my perspective as a presently-Approved Assessor. It would be helpful to have a clearer exposition of the relationship between the KI Board, KCB, the ARB, the IAWG and the scheme(s) against which it proposes to offer certification audit services. In discussions to date I sense suggestions that IS17065 imposes certain requirements which, with some experience of IS17065 and ISO standards in particular, I feel are a bit of a stretch. These need to be fully in the open. A schematic would be very helpful (for the sake of discussion/comparison I attach the one I produced in late 2020 as part of the substantial work I undertook obo KI re. IS17065 accreditation). I'm not suggesting this is the only way to establish a CB worthy of accreditation under, but it's the kind of product which I think would be hugely useful). What I also think would be of great value to Assessors in particular but nonetheless, I would anticipate, to a wider audience, would be the proposals for, inter alia: a) determining the eligibility of auditors and the contractual arrangements for auditors; b) how audit costs will be determined and what role in that auditors will have; c) the duration of audits, etc. Also, noting much confusion during this week's IAWG call about what are the provisions IS17065 I'm requesting that copy of the standard be made available without undue delay to all interested Kantara parties. Yes, this may be a technical breach of ISO copyright, depending on the form of licence held by Kantara, but it is important that all involved have the means to understand its requirements and entitlements, and let's face it, only KI actually needs the standard for the purposes of implementation. We've previously shared ISO documents amongst KI participants for informational/review purposes so we could surely do that again? Having some in-depth sessions and access to the standard without delay would, I am sure, be very much appreciated by all KI members and perhaps iron out any misconceptions. I have addressed this to the IAWG since IS17065 accreditation was a hot topic during this week's call, and I believe that list includes all who participated in the Feb 3rd call. In full disclosure, I am also forwarding this to those KI Board members with whom I have a 1-1 relationship. The Board needs to understand the concerns that exist and also should have access to 17065 to help them make their own determinations on this topic. I'd also like to stress the point that any present work on the IAWG Charter should be a completely independent exercise to anything to do with IS17065, since we're probably only third-guessing (not even second) what the final KCB roll-out will be. The Charter should deal with the present organisational arrangements. It would be misguided to try to mix the two activities. Regards, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

IAWG Charter Update text
by Andrew Hughes 06 Feb '25

06 Feb '25

Hello IAWG! It's time to review/renew our WG Charter. Yehoshua and I have refined the front sections of the charter and have started to adjust it in light of Kantara US seeing accreditation under ISO 17065. No major changes - just trying to set IAWG up for success particularly during the development of next-generation assessment criteria. The plan is to discuss this text this week and approve the updated Charter on February 13. thanks! andrew. *Purpose & Scope:* The Identity Assurance Work Group (IAWG) supports Kantara in developing and maintaining assessable identity assurance criteria for the Kantara US Identity Assurance Program and other relevant frameworks. IAWG ensures that criteria define measurable methods for compliance rather than restating requirements. The workgroup provides subject matter expertise to Kantara, advises the Assurance Review Board (ARB), and facilitates discussions on identity proofing, authentication, and assurance. IAWG's focus is on defining certification criteria that align with the specific functions organizations perform within identity proofing and authentication. The workgroup remains technology- and vendor-agnostic while emphasizing strategic and policy-oriented assurance practices. *RESPONSIBILITIES:* • Assist Kantara in developing and evolving identity assurance criteria that support certification of specific identity proofing and authentication functions. • Ensure that criteria are assessable and define how compliance must be demonstrated. • Provide expert input on identity assurance policies, standards, and interoperability with other assurance schemes. • Advise Kantara leadership and the ARB on assurance-related topics. • Engage with other Kantara groups to align identity assurance efforts with broader industry needs. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

8 12

DGSI draft open for public review
by Andrew Hughes 06 Feb '25

06 Feb '25

Hello IAWG! Do we want to prepare comments on this as a group? Deadline is April 11 2025. If we have time for it, it would be good to show support - DGSI is doing good standards work. https://dgc-cgn.org/standards/find-a-standard/standards-in-digital-trust/ca… CAN/DGSI 103-0, Digital Trust & Identity – Part 0 - Techniques – Code of > Practice has now been posted for Public Review on the DGC website. The > Public Review period will run from February 5th, 2025, to April 11th, 2025, > during which time any interested party, as well as Technical Committee > participants, may comment on the future National Standard of Canada by > visiting the DGC website. All comments submitted will be compiled and > dispositioned by the Technical Committee at a future meeting to be > scheduled following the closing of the public review period. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Meeting notes from 2025-02-06
by Andrew Hughes 06 Feb '25

06 Feb '25

You missed a great discussion today. Next week February 13 2025 we will continue vigorously discussing the charter update proposal - focused on the "purpose and scope" text. Expect another good one. Draft notes are here, *Please review and ask for corrections - I was taking notes live and want to ensure that I represented your positions accurately. The bulk of the notes are in the draft page linked inside these meeting notes.* https://kantara.atlassian.net/wiki/spaces/IAWG/pages/855441414/2025-02-06+I… andrew. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

IAWG Meeting today February 6 2025
by Andrew Hughes 06 Feb '25

06 Feb '25

Hello IAWG! Apologies for the late notification email - we are shifting role responsibilities. Agenda today will be a discussion about IAWG Charter updates and nominations for Chair, Vice-chair, Secretary. thanks andrew. Meetings at 12 pm Eastern Time Time zone converter: www.thetimenow.com/time-zone-converter.php Topic: IAWG Time: This is a recurring meeting. Join Zoom Meeting https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 One tap mobile +13126266799,,93167965850#,,,,*884696# US (Chicago) +16465588656,,93167965850#,,,,*884696# US (New York) *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0