March 2025 - WG-IDAssurance - mailman.kantarainitiative.org

An IAWG open/actionable list
by Jimmy Jung 31 Mar '25

31 Mar '25

Folks, In our last meeting and the emails that follow several of us made reference to those items that the IAWG should address under the current charter and under the current schema. Several folks suggested that they had a list in their head or in more tangible forms. My understanding remains that the IAWG retained the bulk of the old charter because the existing criteria continues to need maintenance and we do not have an understanding of the new schema and processes nor a charter that has been updated to reflect that new schema and processes - meanwhile CSPs continue to want to be assessed and certified. Below please find my best summary of the maintenance topics pertaining to the current process; which I assume will continue to operate until there is a transition to whatever comes next. It is also my understanding that the schedule for that transition may be soon; but it also may not. I would suggest that, at our next meeting, we create and prioritize a task list, as we have in the past. Please consider the list below suggestions. Although I consider it a much lesser priority, we have also, from time to time, been asked to comment on various other international or otherwise related documentation and schema. I believe we would be better positioned to do such things, if we had a list of pending issues and could track our priorities and the status of each item through to implementation. Hunting through my notes, I have: • What is our long-term plan for passkeys in 63-3? With regard to passkeys; the notice had been published but I do not believe we have identified our long-term approach, especially given that the current indication is that 63-4 will look the same, with the same un-assessable criteria. We had been looking at some draft criteria but had not identified an approach around the un-assessables. We have members that think passkeys are critical (starting with NIST). Also, since the notice was published it has been leveraged one or twice and those assessments have highlighted additional criteria which may need to be included. • OP_SAC criteria with conflicting numbers were identified OPB#0490 Receive acknowledgement of receipt of the credential before it is activated and its directory status record is published (and thereby the subscription becomes active or re-activated, depending upon the circumstances of issue). • OPB#0480 OPB#0490 Receive acknowledgement of receipt of the hardware token before it is activated and the corresponding certificate and its directory status record are published (and thereby the subscription becomes active or re-activated, depending upon the circumstances of issue). • OPB#0490 OPB#0500 Require activation of the credential within a time period specified in the Credential Policy. • OPB#0490 OPB#0500 Require activation of the credential within a time period specified in the Certificate Policy. • • 63A#0180 – additional breakdown to better reflect the ‘Implementation Resources’ document and to facilitate component proofing services which may provide specific capability for particular forms of evidence and their validation/applicant verification. I believe we discussed and agreed in principle that we could breakdown the strength of evidence criteria to support component systems. 63A#0180 The CSP SHALL collect from the Applicant / Service Consumer at least the following strength of evidence, as determined by the further requirements in Table 5-1: See comment in Guidance for 63A#0040 63A#0180 a) One piece of SUPERIOR evidence; OR 63A#0180 b) One piece of SUPERIOR or STRONG evidence IF the evidence’s issuing source, during its identity proofing event, confirmed the claimed identity by collecting two or more forms of SUPERIOR or STRONG evidence AND the CSP validates the evidence directly with the issuing source; OR This criterion encompasses the strength of identity evidence STRONG+ listed in NIST SP 800-63-3 Implementation Resources. 63A#0180 c) Two forms of evidence comprising of: PREV: Two pieces of STRONG evidence; OR 63A#0180 c) i) A first piece of STRONG evidence; AND 63A#0180 c) ii) A second piece of STRONG evidence. OR 63A#0180 d) Three forms of evidence comprising of: PREV: One piece of STRONG evidence plus two pieces of FAIR evidence. 63A#0180 d) i) One piece of STRONG evidence; AND 63A#0180 d) ii) A first piece of FAIR evidence; AND 63A#0180 d) iii) A second piece of FAIR evidence. • 63A# proposed new criteria to address the inclusion of ‘Comparable Alternatives’ per 63 rev.3 §5.4. Discussion started but not concluded. These criteria were developed for and successfully used in an assessment, accepted by the ARB accepted the criteria and the service was Approved. This change would formalize the criteria and make them available to all CSPs. It would also apply a consistent basis by which Comp.Alts could be assessed, rather than them being determined by individual assessors or even proposed/argued by CSPs. 4.4.1.2 (IAL2) Evidence Collection Requirements Y 63A#0190 The CSP SHALL document its justification, for each form of evidence it recognises and collects in fulfilling its CrP and these criteria, of how the strength of the evidence it collects satisfies the qualities identified in Table 5‑1 [see worksheet 63A_T5-1]. Assessor-introduced criterion Y 63A#0192 If the CSP has elected to apply a 'Comparable Alternative' means of recognising evidence in 63A#0190 it SHALL fulfill criteria 63A#0700 and 63A#0710. 4.4.1.3 (IAL2) Validation Requirements The CSP SHALL validate identity evidence with a process that can achieve the same strength as the evidence presented. For example, if two forms of STRONG identity evidence are presented, each piece of evidence will be validated at a strength of STRONG. Y 63A#0200 The CSP SHALL, at a minimum, validate identity evidence at the same strength as that at which the evidence was collected. Kantara-specific requirement Y 63A#0210 The CSP SHALL document its justification, for each form of evidence it recognises and collects in fulfilling its CrP and these criteria, of how the strength of validation of the evidence it collects satisfies the qualities identified in Table 5‑2 [see worksheet 63A_T5-2]. Assessor-introduced criterion Y 63A#0212 If the CSP has elected to apply a 'Comparable Alternative' means of recognising evidence in 63A#0210 it SHALL fulfill criteria 63A#0700 and 63A#0710. The following criteria have been composed to allow the selection and use of a 'Comparable Alternative' form of evidence iaw §5.4 of NIST SP 800-63 rev.3. 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: Agencies SHALL demonstrate comparability of any chosen alternative, to include any compensating controls, when the complete set of applicable SP 800-63 requirements is not implemented. Y Y 63A#0700 The CSP SHALL justify any 'Comparable Alternative' form of evidence selection and validation, at either IAL2 or IAL3, as necessary for the applicable IAL, by ensuring that: 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document both the justification for any departure from normative requirements and detail the compensating control(s) employed. Y Y 63A#0700 a) an analysis of the risk(s) addressed by the NIST-specified controls and the degree of residual risk its implementation would achieve is determined and documented; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 b) an analysis of the risk(s) that may be introduced through the use of the alternative controls is determined and documented; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 c) different risks that may be introduced through the use of the alternative controls have been taken into account; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 d) controls have been selected and implemented such that the same or better net identity-proofing risk management and treatment is achieved; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: Expecting that any such measures must be recognised and approved by the service provider's senior management. Y Y 63A#0700 e) top management's acceptance of the documented risk analysis and selected treatment is maintained and retained; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0710 For each comparable alternative applied the CSP SHALL also: 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: As the basis for the client agency to determine that these measures meet their requirements Y Y 63A#0710 a) make available to the Service Consumers the results of its determination of comparability, as required by 63#5.4.01 a) to e) inclusive; and 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: To facilitate the client agency's ability to correctly use the comparable alternative Y Y 63A#0710 b) document any requirements for application of the comparable alternative so as to ensure that comparability is achieved in a Service Consumer's use of the service. • Clarifying edits for 63A T5-2 63A-T5-2#strg b) The CSP can demonstrate that the evidence which it has collected has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). The CSP can demonstrate that the evidence which it has collectaccepted has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). 63A-T5-2#supr a) The CSP can demonstrate that the evidence which it has collected has been confirmed as genuine by trained personnel and the use of appropriate technologies, including the integrity of any physical and cryptographic security features; The CSP can demonstrate that the evidence which it has collectaccepted has been confirmed as genuine by trained personnel and the use of appropriate technologies, including the integrity of any physical and cryptographic security features; 63A-T5-2#supr b) The CSP can demonstrate that the evidence which it has collected has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). The CSP can demonstrate that the evidence which it has collectaccepted has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). • Clarifying edits for 63A T5-3 63A-T5-3#strg a) ii) biometric comparison of the applicant to the identity evidence. Biometric comparison performed remotely SHALL adhere to all criteria 63A#0620 to 63A#0680 inclusive. biometric comparison of the applicant to the strongest piece of identity evidence provided to support the claimed identity. Biometric comparison performed remotely SHALL adhere to all criteria 63A#0620 to 63A#0680 inclusive. • 63B#0120 – FIPS 140 “verifier" 63B#0120 is taken word for word from 800-63B and requires “verifiers to meet FIPS 140 Level 1 or higher.” However, “verifiers” generally refers to an organization, typically the CSP. FIPS 140 is Security Requirements for devices, specifically cryptography. It seems most likely that the intention was to require cryptographic authenticators that meet FIPS 140. Should clarity or guidance be added to this criteria? 63B#0120 Federal agencies SHALL only operate verifiers which have been validated as meeting FIPS 140 Level 1 or higher. • 63B#0510 – What comes after 100 The criteria say, “The Verifier SHALL implement a rate-limiting mechanism which protects against online guessing attacks and limits consecutive failed authentication attempts on a single account to no more than 100.” In 800-63-3 this is given as, “Unless otherwise specified in the description of a given authenticator, the verifier SHALL limit consecutive failed authentication attempts on a single account to no more than 100.” The literal translation of this would be that after 100 failed attempts we would turn off an account and never speak to them again. Another reading would be that we make them reidentify, or we allow them to use a different factor, as described in 63B#1810, or they can reset their password. Naturally, into this ambiguity, CSPs like to insert creative thinking, including delays of between 20 second and a month, progressive delays and other forms of recovery. I would argue most of these exceed the current language and many of these vastly exceed the intention and the spirit of the criteria. Should the criteria identify what happens after 100 or provide guidance? 63B#0510 The Verifier SHALL implement a rate-limiting mechanism which: 63B#0510 a) protects against online guessing attacks; 63B#0510 b) limits consecutive failed authentication attempts on a single account to no more than 100. 63B#1460 The CSP SHALL limit consecutive failed authentication attempts on a single account to no more than 100. OPF#0070 Limit the number of failed authentications attempts to no more than 100 in any 30-day period. * 63A#0680, zeroizing the biometric sample –The IAWG discussed but I don’t think we concluded if we should leave in a clearly wrong but workable criteria or correct it (probably by Withdrawing it as not applicable to the identity proofing process). 63A#0680 The CSP SHALL zeroize the biometric sample (including any associated biometric data) immediately after any training or research data has been derived. With regard to zeroizing the biometric sample (63A#0680); I believe the criteria is flawed by virtue of some poor wording from NIST and the fact that the criteria as actually from 63B and dropped into 63A. The poor wording gives us a loophole by virtue of its odd wording, which sort of makes the criteria harmless, although I believe the more rigorous approach would be to withdraw it, as we have other imported 63B criteria. * Validation at Strong SP 800-63 and Kantara require that “The CSP SHALL validate identity evidence with a process that can achieve the same strength as the evidence presented. For example, if two forms of STRONG identity evidence are presented, each piece of evidence will be validated at a strength of STRONG.(63 4.4.1.3; see also 63A#0200)” This is compared with verification which is only compared to the strongest piece of identity evidence. (63 5.3.1). Validating evidence at STRONG requires having “all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s).” AAMVA allows verification of DLs but there is no issuing, authoritative, or even credible source would validate a Permanent Resident Card, Native American Enhanced Tribal Card, “Enhanced ID cards,” U.S. Military ID, Permanent Resident Card or Native American Tribal Photo Identification Cards? Consequently, calling them SUPERIOR or STRONG isn’t really meaningful, if they cannot be validated that way. (There are some cool implementations that can read a passport and verify digital signatures, but for PIV, CAC, PIV-I (and TWIC?) you are going to need a card reader, so that mostly leaves out unsupervised. I think validating a digital signature is a fairly strong validation, even if it does not really COMPARE information with an issuing or authoritative source? Things really seemed odd to me, when we came to the conclusion that you would have to consider a US Navy CAC card a “FAIR” piece of evidence, because the DoD doesn’t validate CAC cards. ) For an unsupervised proofing, and working from NIST’s notional strength of evidence page, which TWO items can you compare with information held by an issuing or authoritative source? US Passport SUPERIOR Foreign e-Passport SUPERIOR Personal Identity Verification (PIV) card SUPERIOR Common Access card (CAC) SUPERIOR Personal Identity Verification Interoperable (PIV-I) card SUPERIOR Transportation Worker Identification Credential (TWIC) SUPERIOR Permanent Resident Card SUPERIOR Native American Enhanced Tribal Card SUPERIOR REAL ID cards STRONG+ Enhanced ID cards STRONG+ U.S. Uniformed Services Privilege and Identification Card (U.S. Military ID) STRONG+ Permanent Resident Card STRONG Native American Tribal Photo Identification Card STRONG Driver’s License or ID card (REAL ID non-compliant) STRONG Jimmy [cid:image001.jpg@01DB9DC2.0A456D60] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813

2 2

Input: IAWG.2025-03
by Richard G. WILSHER (＠Zygma Inc.) 27 Mar '25

27 Mar '25

Pfa proposed 'Comparable Alternative' criteria, as addressed by the referenced action. The background story is that the IAWG drafted and approved for publication these criteria approx. two years ago. Persons within the ARB strongly recommended that the criteria were not published since the entitlement for presenting a Comp.Alt lay with Fed agencies, and so the criteria were parked. My understanding (second-hand) is that there have been some Approval applications that have been presented to the ARB and Approved, though how the Comp.Alt was addressed was not consistent. I was then involved in an assessment for a client who, operating obo a Fed agency, was basically told to implement a Comp.Alt, so I dusted-off the criteria, inserted them into the SoCA/SoC and assessed against them. As I understand it the ARB were comfortable with those criteria being used and recognized that having them widely available would provide a consistent basis across all Approval scheme assessments, if these criteria were invoked. SO .. here they are, I think that the IAWG should review them again, given the time since they were first punted, and I'd be happy for them to be enhanced if that's what they need, but I'd then like to see them put through the publication process asap. I would consider them to be material and therefore requiring a 45-day public review. Clearly, if formalized within the 63A_SAC, some of the commentary (e.g. "Assessor introduced criterion") needs removal or modification. Pls note the date on this doc - that's how long this has been lingering without getting published. Let's get it done. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Reminder: IAWG call today noon Eastern
by Andrew Hughes 27 Mar '25

27 Mar '25

Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Meeting - Thursday March 27
by Yehoshua Silberstein 26 Mar '25

26 Mar '25

Hi IAWG, For tomorrow’s meeting, I want to take a step back and ensure we’re focused on the right priorities. Over the past few months, we’ve had important discussions about the future of the US Program and the evolving structure of Kantara’s work. At the same time, we have open items that need attention, such as ongoing SAC updates. To move forward productively, I’d like to center our discussions on: * Addressing any outstanding items from the action tracker to ensure continuity in our current framework. * Creating space for open discussion so all perspectives are heard. This is an opportunity to reset and ensure IAWG remains a valuable forum for all members. If you’ve been waiting for the right time to re-engage, I encourage you to join the discussion tomorrow. Looking forward to the conversation. Best, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

Formal request for Notice of an IAWG meeting, to be held 2025-03-27
by Richard G. WILSHER (＠Zygma Inc.) 23 Mar '25

23 Mar '25

Noting your lack of response Yehoshua, I must point out that your statement that “[the IAWG] will reconvene once we have the necessary updates” is a dereliction of your duty as the Chair of the IAWG, a role which you chose to take on. Your excuse for cancelling this week’s IAWG meeting completely ignores the fact that there are matters within direct scope of the OIAWG’s remit, which require addressing, and which you appeared to have acknowledged last week. Though I have posted these points before I reiterate them now, as the basis for an IAWG meeting on Thursday 2025-03-27. Regarding the SACs: 1) Comparable Alternative criteria were reintroduced into the discussion and I was of the view that they were to be included in a revised 63A_SAC; 2) Proofing strength combinations – we agreed that 63A#0180 was worthy of amendment to accommodate STRONG+ and greater break-down to individual pieces of evidence, to better support component proofing services; 3) editorials – quite a few have been noted along the way and ‘stored’ for publication, and a recent assessment I’ve been involved in has led to a number of additional minor editorial changes being identified (one actually was a criterion mis-numbering, which is a little above ‘minor editorial’); 4) definitive ‘passkey waiver’ criteria – the IAWG never concluded its discussion about which criteria ought to be subject to a Notice, and the published Notice was therefore produced prematurely. This is problematic since other criteria are (I believe) worthy of inclusion, which presents a problem if assessments are performed with such findings yet the Notice does not support them. These items 1-4 should have immediate priority since these MAY need wider review, depending on whether revisions are Material or Non-Material, and given the delays, perhaps Non-Material changes ought to be pushed through with Material changes to follow, allowing their formal adoption by CSPs. Regarding the TSL web pages: 5) The definitions for Full Service and Component Service are incorrect, i.e. they do not align to the KI Glossary; 6) The TSL split between services is incorrect – they are grouped as ‘Full’, ‘Classic’ and ‘Component’. This is completely wrong – the distinction between Full and Component is equally applicable to both ‘Classic’ and ’63 rev.3’ services. At least one of the present ‘Classic’ listed services is a Component Service; Items 5-6 should have high but not immediate priority. They are misleading and therefore do not project a consistent view of KI. And they’re easy to fix, and probably require no further IAWG input (other than encouragement?). And then … Posted list of Approval-scheme Assessors: 7) KI has been added as an Assessor under the existing Approval scheme. I consider this to be ethically challengeable and believe that this entry should be removed without delay. This may not be directly under the IAWG’s remit but ought to be of concern. Any discussion of ‘nice-to-haves’ in terms of potential longer-term revisions to criteria should not be addressed until the above existential points have been considered and resolutions determined, including the means for the IAWG to keep track of and ensure completion of those actions. If others have germane agenda items for consideration, by all means let them be added, but let’s ensure that we understand the priorities. In your role as Chairman of the IAWG, please respond to this email by end of this week with confirmation of an IAWG meeting next week covering at least the items I have listed above. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Richard G. WILSHER (@Zygma Inc.) [mailto:RGW@Zygma.biz] Sent: Wednesday, 19 March, 2025 18:21 To: 'yehoshua(a)proof.com' Cc: IA WG (wg-idassurance(a)kantarainitiative.org) Subject: RE: [WG-IDAssurance] Meeting Cancellation - March 20 Yehoshua, This not acceptable – as the Chairman of IAWG you should be doing all you can to direct the business of the IAWG iaw its Charter. Last week you expressly chose not to accept my request that we address existential IAWG business first and instead the meeting got hijacked (not for the first time, imo). That is failing to uphold the principles of the Charter, and you might recall we deliberately (and recently) left it largely unchanged specifically so that it had nothing to do with any development towards establishing an Accredited CB. I have documented genuine IAWG matters which have been overlooked for months, maybe some for six months by now. AH also professed to having a list. Furthermore, the meeting closed with an undertaking on the part of either yourself or AH to address ‘real’ (my choice of word) IAWG business this week. We should be holding a meeting this week to address those points which impinge upon current Approval-scheme assessments and which have nothing to do with future Certification scheme audits. Resolution of the open questions seems to me be straightforward and frankly, not your (nor AH’s) problem – you are both caught between a rock and a hard place. Those questions should be addressed by KC and CB in a separate process and in separate meetings. Please withdraw the e-mail below and post a meaningful agenda for the IAWG to meet this week. Thank you and good morning Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Yehoshua Silberstein [mailto:yehoshua@proof.com] Sent: Wednesday, 19 March, 2025 17:35 To: IAWG Subject: [WG-IDAssurance] Meeting Cancellation - March 20 Good afternoon, This week’s meeting is canceled as we continue working to address the open questions raised in the last meeting. We will reconvene once we have the necessary updates. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 <https://lh3.googleusercontent.com/7nPoP42JZWBh2Tlgr4Pk7-Xw-dNkaxwcdqDAvNQRy…> Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

4 4

Meeting Cancellation - March 20
by Yehoshua Silberstein 19 Mar '25

19 Mar '25

Good afternoon, This week’s meeting is canceled as we continue working to address the open questions raised in the last meeting. We will reconvene once we have the necessary updates. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

2 1

Reminder IAWG - Weekly Group Call March 13 2025
by Andrew Hughes 13 Mar '25

13 Mar '25

Reminder that IAWG will meet in about an hour. Agenda to include: - discussion about plans for 17065-Accredited assurance program - review outstanding SAC items IAWG - Weekly Group Call Thursday Mar 20, 2025 ⋅ 12:00 – 13:00 Eastern Time - New York Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

2 1

Update on Trust Mark Program Structure & Next Steps
by Yehoshua Silberstein 06 Mar '25

06 Mar '25

Good morning everyone, Following our initial discussions with Carol and Kay, we wanted to provide an update on the evolving structure of the trust mark program and the key areas requiring focused attention. NEW PROGRAM ORGANIZATION Kantara has determined that a Certification Board will be established to oversee the structure, policies, and governance of the certification process. This board will be a new addition to the US Program and will be responsible for defining and maintaining the assessment criteria used in evaluations, ensuring alignment with accreditation requirements while maintaining the integrity and independence of the program. Separately, the Assurance Review Board (ARB) will continue to be responsible for evaluating applications and making certification determinations. A Stakeholder Group will provide a forum for industry engagement, program feedback, and broader ecosystem needs. While IAWG may continue in this capacity, its role will evolve as new structures are established. SEPARATING REQUIREMENTS FROM ASSESSMENT CRITERIA In addition to these structural changes, a significant body of work will be the separation of requirements from assessment criteria, which will provide a structured foundation for evaluation. While current certifications align with NIST guidance, that framework was not designed as a structured set of certifiable requirements. For example, the NIST guidelines do not number individual requirements, making citation difficult and creating ambiguity when referencing specific provisions. Without clear identifiers, it becomes challenging to ensure consistency across implementations. Additionally, NIST does not explicitly assign responsibilities when multiple providers are involved in an identity proofing or authentication process. A provider may use one vendor for credential analysis, another for database checks, and a third for trusted referees. However, NIST does not clarify which requirements must be met by the primary provider versus their service providers, making compliance determinations unclear. Finally, much of the NIST language is written as guidance rather than strict requirements. While this flexibility is valuable in many contexts, certification requires well-defined, testable criteria to ensure consistent evaluations. To create a scalable and certifiable model, there is a need to define structured requirements, which the Certification Board will then use to develop assessment criteria. This distinction is critical to ensuring consistency, transparency, and adaptability in certification. ADDRESSING CURRENT WORK In response to concerns raised about the current work, IAWG will continue maintaining and managing the existing SAC. We recognize that there are outstanding items that must be addressed promptly, and we are committed to ensuring that necessary updates and clarifications are made as this transition progresses. NEXT STEPS We are working to define how best to organize the effort to develop requirements and are seeking input from those interested in contributing to this work. If you’d like to be involved, please let us know. To continue this discussion, I am calling the next meeting for Thursday, March 13. We will outline the approach, discuss opportunities for engagement, and address any outstanding questions. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

IAWG business
by Richard G. WILSHER (＠Zygma Inc.) 04 Mar '25

04 Mar '25

Yehoshua, Your message (below) appears to put the IAWG into stasis, as if it has no further purpose (or at least, hasn’t at the present). That cannot be so, however. The Approval scheme continues to function and needs to be supported with up-to-date criteria, notices and correct and accurate statements on the TSL page. We’ve been told that these matters were going to be addressed but they haven’t been, and the failure to resolve them is creating, and will further create, problems with ongoing Assessments and Approval renewals. I request that the IAWG has a meeting to address the following points, all of which are unfinished business from 2024 which the potential arrival of an Accredited CB appears to have pushed aside. My concerns are: Regarding the SACs: 1) Comp Alt criteria were reintroduced into the discussion and I was of the view that they were to be included in a revised 63A_SAC; 2) Proofing strength combos – we agreed that 63A#0180 was worthy of amendment to accommodate STRONG+ and greater break-down to individual pieces of evidence, to better support component proofing services; 3) editorials – quite a few have been noted along the way and ‘stored’ for publication, and a recent assessment I’ve been involved in has led to a number of additional minor editorial changes being identified (one actually was a criterion mis-numbering, which is a little above ‘minor editorial’); 4) definitive ‘passkey waiver’ criteria – the IAWG never concluded its discussion about which criteria ought to be subject to a Notice, and the published Notice was therefore produced prematurely. This is problematic since other criteria are (I believe) worthy of inclusion, which presents a problem if assessments are performed with such findings yet the Notice does not support them. I have previously offered to provide publishable revisions for the affected SACs but the meeting was advised that these would be dealt with by ‘staff’. Regarding the TSL web pages: 5) The definitions for Full Service and Component Service are incorrect, i.e. they do not align to the KI Glossary; 6) The TSL split between services is incorrect – they are grouped as ‘Full’, ‘Classic’ and ‘Component’. This is completely wrong – the distinction between Full and Component is equally applicable to both ‘Classic’ and ’63 rev.3’ services. At least one of the present ‘Classic’ listed services is a Component Service; The above problems have existed for months. More recently: 7) KI has been added as an Assessor under the existing Approval scheme. I consider this to be ethically challenged and believe that this entry should be removed. Hopefully catch everyone at a meeting this week to deal with last year’s business … then we can see whether we have any for 2025. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Yehoshua Silberstein [mailto:yehoshua@proof.com] Sent: Monday, February 24, 2025 18:52 To: IAWG Subject: [WG-IDAssurance] Election Results & Feb. 27 Meeting Cancelation Hi everyone, Following our recent elections, I’m honored to serve as the new Chair of the IAWG, with Andrew as Vice-Chair. We look forward to working with all of you in our new roles. In the meantime, we’re canceling this week’s IAWG meeting (and potentially next week’s) as we work with Carol and Kay to better understand and clarify the roles, responsibilities, and structure of the new program. Our goal is to gather the necessary details to help you understand how this will take shape, and we’ll follow up once we have more to share and confirm the next meeting date. Thanks, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 <https://lh3.googleusercontent.com/7nPoP42JZWBh2Tlgr4Pk7-Xw-dNkaxwcdqDAvNQRy…> Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0