- WG-IDAssurance - mailman.kantarainitiative.org

Action#2 follow-up, per mtg of 2025-05-08 - Revised passkey Notice
by Richard G. WILSHER (＠Zygma Inc.) 08 May '25

08 May '25

Per as voluntold today by JWJ, I attach the proposed final text of a revised passkey Notice for the IAWG's attention, accommodating points raised today. I leave it to our Chairman to decide any period for review and process for formally pushing this over the fence into staff's domain. When that happens I believe the required staff actions to be: i) Publish the new notice (as v1.0); ii) Flag Notice KI#2024-01 as being withdrawn; iii) Publish a revised 63B_SAC incorporating #0085 and any other changes which have been previously agreed for 63B; That is all. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Action#1 follow-up, per mtg of 2025-05-08 - draft Comp.Alt criteria
by Richard G. WILSHER (＠Zygma Inc.) 08 May '25

08 May '25

I attach the present set of draft Comp.Alt criteria which I have modified in an attempt to accommodate needs identified two weeks ago. This is what I will be happy to re-introduce and walk the meeting through next week. Im going to re-state the background here and ask that those attending net week review this in advance so that we can avoid having to spend time setting the context. I understand second-hand that the ARB has in the past been presented with and approved services which have Comp.Alt elements. A set of criteria very similar to those presently posited was approved by the IAWG some three (?) years ago but did not get to being published. Faced with a client who had a Comp.Alt requirement I determined to apply structure to their solution and resurrected the criteria and inserted them into the assessment which I performed. Feedback from the ARB suggested that the use of the criteria was appreciated, the service was approved. I therefore sought to reintroduce the criteria into the IAWG so as to have them reviewed again, with the hope that they would be formally published. My purpose is to reflect the key elements of 800-63 rev.3 §5.4 in a manner which states what the CSP has to do to demonstrate comparability and to ensure that users of their service are left in no doubt as to the fact that a Comp.Alt is available and how to incorporate it into a broader identity management application/system. Moreover, to give CSPs, Assessors and the ARB a stable basis for addressing the topic. I believe that Assessors need to ensure that the determination of comparability has been reasonably established but cannot make risk decisions for the CSP, nor for the consumers of its service. The situation is just another form of risk management, which remains each individual enterprises determination. If someone wants to produce a white paper, thats fine, but I dont see it helping the goal of having a means to consistently assess Comp.Alts. Neither do I think it is the IAWGs role to come up with a shopping list of Comp.Alt. possibilities let the market decide, and KI will assess. Until next week, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Weekly IAWG Call
by Yehoshua Silberstein 08 May '25

08 May '25

Good morning all, There will be an IAWG call this week. Looking forward to seeing you to continue the discussion on comparable alternative criteria. IAWG - Weekly Group Call Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ LOCATION https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 View map -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

2 2

Reminder: IAWG - Weekly Group Call
by Andrew Hughes 30 Apr '25

30 Apr '25

For May 1 2025, meeting at the regular time (12:00pm Eastern) Main agenda item: discuss comparable alternative topic. Please refer to email: https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantar… IAWG - Weekly Group Call Thursday May 1, 2025 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

1 0

Revised passkeys Notice
by Richard G. WILSHER (＠Zygma Inc.) 29 Apr '25

29 Apr '25

Pfa a draft revised Notice (actually, presented as a replacement Notice) addressing passkeys, accounting for reviewed consideration and the arguments presented in JWJ's email of 04-24. For discussion this week, assuming there is a meeting to be held. A couple of critical elements to be finalized, as commented. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

IAWG Group Call This Week
by Yehoshua Silberstein 25 Apr '25

25 Apr '25

Good evening everyone. There will be an IAWG call this week. Looking forward to seeing you to discuss comparable alternative criteria. IAWG - Weekly Group Call Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ LOCATION https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 View map -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

2 1

Comparable Alternative Criteria - Discussion Focus
by Yehoshua Silberstein 24 Apr '25

24 Apr '25

Good afternoon, Thank you to everyone who participated in the initial conversation about Richard's comparable alternative criteria proposal. Our conversation has highlighted several fundamental questions that we need to address to make this framework well-understood and work effectively, particularly given our program's model of a single SAC leading to monolithic certification. To focus our discussion next week, I want to highlight the key areas where we need clarity and resolution: * Rationale for Alternatives: What is the intended policy for using comparable alternatives? Are they for specific necessity (where a barrier exists), or permissible for any equally effective approach? How should the required justification criteria (63A#0700/0710) reflect this policy? * Process & Approval: How will comparable alternative justifications be formally evaluated and approved within our assessment process? Who makes the final decision? * Certification Scope: How will certifications effectively represent services that use a mix of standard criteria and approved comparable alternatives across different flows? What exactly does the program's approval and the resulting certification guarantee regarding the specific alternatives to service providers and agencies? * Defining & Assessing Comparability: How will assessors consistently and objectively evaluate if an alternative truly achieves "same or better" risk management? What specific evidence is required? How is the assessment impacted if the rationale for the alternative was a specific barrier? * Program Value & Clarity for Agencies: What is the distinct value proposition of a Kantara-certified comparable alternative specifically for agencies? How does our certification interact with an agency's own authority and process for determining acceptable controls? * Operational Impact: What are the expected impacts on assessment time, cost, and resources with the introduction of these criteria, especially considering the need to potentially evaluate the rationale for the alternative and how it fits within a single certification scope? These questions aim to address the foundational purpose of comparable alternatives within our program and resolve the complexities that arise in their evaluation, approval, and communication to agencies, helping us move towards a clear and functional framework. Please come prepared to discuss these points next week. Best, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

REMINDER: IAWG - Weekly Group Call April 17 2025
by Andrew Hughes 17 Apr '25

17 Apr '25

Yes, there is an IAWG meeting today - sorry for the late reminder. We will continue discussing the items on the action list IAWG - Weekly Group Call Thursday Apr 17, 2025 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

1 0

2025-04-10 meeting notes
by Andrew Hughes 10 Apr '25

10 Apr '25

https://kantara.atlassian.net/wiki/spaces/IAWG/pages/963248216/2025-04-10+I… Thanks for joining today's call - we think that we have nailed down the syncable authenticators "which criteria can be excluded" discussion. Discussion is complete at this point - you have a week to review and examine the proposal - on next week's call barring any major errors, we will close the item and make a recommendation to the Assurance Program to adopt. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Reminder - IAWG - Weekly Group Call April 10, 2025
by Andrew Hughes 10 Apr '25

10 Apr '25

Hi IAWG - main discussion topics for this week's call: - continue resolution of syncable authenticators topic (See email from Jimmy) - continue resolution of 'alternative criteria' topic (Richard) IAWG - Weekly Group Call Thursday Apr 10, 2025 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

1 1

Additional 63A_SAC non-material edit
by Richard G. WILSHER (＠Zygma Inc.) 10 Apr '25

10 Apr '25

I wish to submit the following change for inclusion in the forthcoming 63A re-issue: In the CO_SAC we amended (some while back) criteria which referred to 'Applicants' to be replaced with 'Applicant/Service Consumer' to clarify the necessary applicatikon of the affected criteria when the service being assessed is a component service (see guidance text provided for CO#0110). The following 63A_SAC criteria are in need of the same treatment but were overlooked at the time of changes to the CO_SAC. 63A#0060 The CSP SHALL provide mechanisms to redress Applicant/Service Consumer complaints or problems arising from their use of the identity proofing service. 63A#0062 The CSP SHALL document and publish its redress mechanisms in a manner which is easy for Applicants/Service Consumers to find and use. I think this is self-explanatory and will be unable to participate and support this proposed change at this week's meeting - I'm preferring not to be firing on all four at 03:00 local. Happy meeting, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Update to Notice KI#2024-01 – Accommodation of Passkeys
by Jimmy Jung 05 Apr '25

05 Apr '25

Below please find my inputs to the proposal to Update to Notice KI#2024-01 The ORIGINAL referenced 63B# criteria: • 0410, 0420, 0430, 0440, 0450, 0460; • 1150, 1160; • 1210, 1220, 1230, 1240; • 1270, 1280, 1290, 1300, 1310, 1320, 1330; • 1450, 1460, 1470, 1480, 1490, 1500, 1510, 1520, 1530, 1540, and 1550. I concur that the language should be reviewed to make clear that the use of the “In scope – Not applicable to Passkeys” caveat is specific only to criteria as it relates to the use of FIDO passkeys. I would also note that the notice includes the following: “Kantara Initiative is in the process of assessing the risks and defining such criteria that will provide the necessary confidence that compliance can be met. Until that is completed and communicated, …” I think we should consider if that is accurate and update accordingly. With regard to criteria, * STRIKE 0410, 0420, 0430, 0440, 0450, 0460 – strike these from the notice. They are memorized secret/password criteria and not applicable to Cryptographic Device Authenticators. They are referenced by the Cryptographic Device Authenticator criteria in 1290 and removed from applicability for passkeys when the notice strikes 1290. Referencing them in the notice only risks a CSP thinking they may be ignored accidentally. * ADD 1130, 1140, 1170– it is not clear why they were left out. These controls appear to be local to the user device and outside the assessment scope * KEEP 1150, 1160, 1210, 1220, 1230, 1240; - It should be noted that these are Single-Factor Cryptographic Software authenticator criteria. While we may assume that passkeys are multifactor; technically the authenticator does not indicate. * ADD 1250, 1260 – it is not clear why they were left out * KEEP 1270, 1280, 1290, 1300, 1310, 1320, 1330 * KEEP 1450, 1460 * STRIKE 1470, 1480, 1490, 1500, 1510, 1520, 1530, 1540, and 1550. - Strike these from the notice. They are biometric criteria and not applicable to Cryptographic Device Authenticators. They are referenced by the Cryptographic Device Authenticator criteria in 1310 and removed from applicability for passkeys when the notice strikes 1310. Referencing them in the notice only risks a CSP thinking they may be ignored accidentally. (If they are to be included (1505 may need to be added * ADD 1710 Throttling attempts for passkeys would be local to the device * I’m not sure if the use of the 5 dot points has some hidden meaning More specifically, WRT to the inclusion of 0410 – 0460; I suggest we consider how these would have been handled say two years ago, before passkeys were an issue. If you are not using passwords/Memorized secrets, or one time password devices, or multi-factor cryptographic hardware, you simply Mark those criteria as in scope not applicable. In the scenario where they are using passkeys but not passwords the caveats of the notice apply. In the scenario where they're using passwords but not pass keys the criteria is there to be addressed. The trickiest aspect is a system using both; I think it is best for the notice to not call out those things that are dismissed under the heading of the cryptographic software criteria. Let them make that calculation; rather than them assuming that these rules do not apply at all (or to their passwords) because they are using passkeys [cid:image001.jpg@01DBA4AA.C00B8E60] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813

1 0

Re: Reminder: IAWG - Weekly Group Call April 3 2025
by Andrew Hughes 01 Apr '25

01 Apr '25

On Tue, Apr 1, 2025 at 10:24 AM Andrew Hughes <andrewhughes3000(a)gmail.com> wrote: > IAWG - Weekly Group Call > > > > Main agenda items for this this week's IAWG Call: > > * Discuss clarifying the definition of "verifiers" in 63B#0120 to ensure > FIPS 140 requirements are correctly applied to cryptographic modules, not > entire organizations, and to resolve inconsistencies with 63B#0090 > > * Review proposal to revise Notice KI#2024-01 – Accommodation of Passkeys > to include the following additional criteria - 63B#0780, #0790, #0800, > #1630, #1640, and #1710. > > https://cdn.kantarainitiative.org/wp-content/uploads/2025/02/Notice-KI-2024… > > * Review proposed 'comparable alternative' criteria. > > IAWG - Weekly Group Call > Thursday Apr 3, 2025 ⋅ 09:00 – 10:00 (Pacific Time - Vancouver) > Kantara Initiative is inviting you to a scheduled Zoom meeting. > Join Zoom Meeting > https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 > > Meeting ID: 931 6796 5850 > Passcode: 884696 > > --- > > One tap mobile > +16465588656,,93167965850#,,,,*884696# US (New York) > +16469313860,,93167965850#,,,,*884696# US > > --- > > Dial by your location > • +1 646 558 8656 US (New York) > • +1 646 931 3860 US > • +1 301 715 8592 US (Washington DC) > • +1 305 224 1968 US > • +1 309 205 3325 US > • +1 312 626 6799 US (Chicago) > • +1 689 278 1000 US > • +1 719 359 4580 US > • +1 720 707 2699 US (Denver) > • +1 253 205 0468 US > • +1 253 215 8782 US (Tacoma) > • +1 346 248 7799 US (Houston) > • +1 360 209 5623 US > • +1 386 347 5053 US > • +1 507 473 4847 US > • +1 564 217 2000 US > • +1 669 444 9171 US > > Meeting ID: 931 6796 5850 > Passcode: 884696 > > Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ > > Location > https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 > View map > <https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09> > >

1 0

An IAWG open/actionable list
by Jimmy Jung 31 Mar '25

31 Mar '25

Folks, In our last meeting and the emails that follow several of us made reference to those items that the IAWG should address under the current charter and under the current schema. Several folks suggested that they had a list in their head or in more tangible forms. My understanding remains that the IAWG retained the bulk of the old charter because the existing criteria continues to need maintenance and we do not have an understanding of the new schema and processes nor a charter that has been updated to reflect that new schema and processes - meanwhile CSPs continue to want to be assessed and certified. Below please find my best summary of the maintenance topics pertaining to the current process; which I assume will continue to operate until there is a transition to whatever comes next. It is also my understanding that the schedule for that transition may be soon; but it also may not. I would suggest that, at our next meeting, we create and prioritize a task list, as we have in the past. Please consider the list below suggestions. Although I consider it a much lesser priority, we have also, from time to time, been asked to comment on various other international or otherwise related documentation and schema. I believe we would be better positioned to do such things, if we had a list of pending issues and could track our priorities and the status of each item through to implementation. Hunting through my notes, I have: • What is our long-term plan for passkeys in 63-3? With regard to passkeys; the notice had been published but I do not believe we have identified our long-term approach, especially given that the current indication is that 63-4 will look the same, with the same un-assessable criteria. We had been looking at some draft criteria but had not identified an approach around the un-assessables. We have members that think passkeys are critical (starting with NIST). Also, since the notice was published it has been leveraged one or twice and those assessments have highlighted additional criteria which may need to be included. • OP_SAC criteria with conflicting numbers were identified OPB#0490 Receive acknowledgement of receipt of the credential before it is activated and its directory status record is published (and thereby the subscription becomes active or re-activated, depending upon the circumstances of issue). • OPB#0480 OPB#0490 Receive acknowledgement of receipt of the hardware token before it is activated and the corresponding certificate and its directory status record are published (and thereby the subscription becomes active or re-activated, depending upon the circumstances of issue). • OPB#0490 OPB#0500 Require activation of the credential within a time period specified in the Credential Policy. • OPB#0490 OPB#0500 Require activation of the credential within a time period specified in the Certificate Policy. • • 63A#0180 – additional breakdown to better reflect the ‘Implementation Resources’ document and to facilitate component proofing services which may provide specific capability for particular forms of evidence and their validation/applicant verification. I believe we discussed and agreed in principle that we could breakdown the strength of evidence criteria to support component systems. 63A#0180 The CSP SHALL collect from the Applicant / Service Consumer at least the following strength of evidence, as determined by the further requirements in Table 5-1: See comment in Guidance for 63A#0040 63A#0180 a) One piece of SUPERIOR evidence; OR 63A#0180 b) One piece of SUPERIOR or STRONG evidence IF the evidence’s issuing source, during its identity proofing event, confirmed the claimed identity by collecting two or more forms of SUPERIOR or STRONG evidence AND the CSP validates the evidence directly with the issuing source; OR This criterion encompasses the strength of identity evidence STRONG+ listed in NIST SP 800-63-3 Implementation Resources. 63A#0180 c) Two forms of evidence comprising of: PREV: Two pieces of STRONG evidence; OR 63A#0180 c) i) A first piece of STRONG evidence; AND 63A#0180 c) ii) A second piece of STRONG evidence. OR 63A#0180 d) Three forms of evidence comprising of: PREV: One piece of STRONG evidence plus two pieces of FAIR evidence. 63A#0180 d) i) One piece of STRONG evidence; AND 63A#0180 d) ii) A first piece of FAIR evidence; AND 63A#0180 d) iii) A second piece of FAIR evidence. • 63A# proposed new criteria to address the inclusion of ‘Comparable Alternatives’ per 63 rev.3 §5.4. Discussion started but not concluded. These criteria were developed for and successfully used in an assessment, accepted by the ARB accepted the criteria and the service was Approved. This change would formalize the criteria and make them available to all CSPs. It would also apply a consistent basis by which Comp.Alts could be assessed, rather than them being determined by individual assessors or even proposed/argued by CSPs. 4.4.1.2 (IAL2) Evidence Collection Requirements Y 63A#0190 The CSP SHALL document its justification, for each form of evidence it recognises and collects in fulfilling its CrP and these criteria, of how the strength of the evidence it collects satisfies the qualities identified in Table 5‑1 [see worksheet 63A_T5-1]. Assessor-introduced criterion Y 63A#0192 If the CSP has elected to apply a 'Comparable Alternative' means of recognising evidence in 63A#0190 it SHALL fulfill criteria 63A#0700 and 63A#0710. 4.4.1.3 (IAL2) Validation Requirements The CSP SHALL validate identity evidence with a process that can achieve the same strength as the evidence presented. For example, if two forms of STRONG identity evidence are presented, each piece of evidence will be validated at a strength of STRONG. Y 63A#0200 The CSP SHALL, at a minimum, validate identity evidence at the same strength as that at which the evidence was collected. Kantara-specific requirement Y 63A#0210 The CSP SHALL document its justification, for each form of evidence it recognises and collects in fulfilling its CrP and these criteria, of how the strength of validation of the evidence it collects satisfies the qualities identified in Table 5‑2 [see worksheet 63A_T5-2]. Assessor-introduced criterion Y 63A#0212 If the CSP has elected to apply a 'Comparable Alternative' means of recognising evidence in 63A#0210 it SHALL fulfill criteria 63A#0700 and 63A#0710. The following criteria have been composed to allow the selection and use of a 'Comparable Alternative' form of evidence iaw §5.4 of NIST SP 800-63 rev.3. 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: Agencies SHALL demonstrate comparability of any chosen alternative, to include any compensating controls, when the complete set of applicable SP 800-63 requirements is not implemented. Y Y 63A#0700 The CSP SHALL justify any 'Comparable Alternative' form of evidence selection and validation, at either IAL2 or IAL3, as necessary for the applicable IAL, by ensuring that: 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document both the justification for any departure from normative requirements and detail the compensating control(s) employed. Y Y 63A#0700 a) an analysis of the risk(s) addressed by the NIST-specified controls and the degree of residual risk its implementation would achieve is determined and documented; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 b) an analysis of the risk(s) that may be introduced through the use of the alternative controls is determined and documented; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 c) different risks that may be introduced through the use of the alternative controls have been taken into account; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 d) controls have been selected and implemented such that the same or better net identity-proofing risk management and treatment is achieved; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: Expecting that any such measures must be recognised and approved by the service provider's senior management. Y Y 63A#0700 e) top management's acceptance of the documented risk analysis and selected treatment is maintained and retained; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0710 For each comparable alternative applied the CSP SHALL also: 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: As the basis for the client agency to determine that these measures meet their requirements Y Y 63A#0710 a) make available to the Service Consumers the results of its determination of comparability, as required by 63#5.4.01 a) to e) inclusive; and 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: To facilitate the client agency's ability to correctly use the comparable alternative Y Y 63A#0710 b) document any requirements for application of the comparable alternative so as to ensure that comparability is achieved in a Service Consumer's use of the service. • Clarifying edits for 63A T5-2 63A-T5-2#strg b) The CSP can demonstrate that the evidence which it has collected has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). The CSP can demonstrate that the evidence which it has collectaccepted has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). 63A-T5-2#supr a) The CSP can demonstrate that the evidence which it has collected has been confirmed as genuine by trained personnel and the use of appropriate technologies, including the integrity of any physical and cryptographic security features; The CSP can demonstrate that the evidence which it has collectaccepted has been confirmed as genuine by trained personnel and the use of appropriate technologies, including the integrity of any physical and cryptographic security features; 63A-T5-2#supr b) The CSP can demonstrate that the evidence which it has collected has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). The CSP can demonstrate that the evidence which it has collectaccepted has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). • Clarifying edits for 63A T5-3 63A-T5-3#strg a) ii) biometric comparison of the applicant to the identity evidence. Biometric comparison performed remotely SHALL adhere to all criteria 63A#0620 to 63A#0680 inclusive. biometric comparison of the applicant to the strongest piece of identity evidence provided to support the claimed identity. Biometric comparison performed remotely SHALL adhere to all criteria 63A#0620 to 63A#0680 inclusive. • 63B#0120 – FIPS 140 “verifier" 63B#0120 is taken word for word from 800-63B and requires “verifiers to meet FIPS 140 Level 1 or higher.” However, “verifiers” generally refers to an organization, typically the CSP. FIPS 140 is Security Requirements for devices, specifically cryptography. It seems most likely that the intention was to require cryptographic authenticators that meet FIPS 140. Should clarity or guidance be added to this criteria? 63B#0120 Federal agencies SHALL only operate verifiers which have been validated as meeting FIPS 140 Level 1 or higher. • 63B#0510 – What comes after 100 The criteria say, “The Verifier SHALL implement a rate-limiting mechanism which protects against online guessing attacks and limits consecutive failed authentication attempts on a single account to no more than 100.” In 800-63-3 this is given as, “Unless otherwise specified in the description of a given authenticator, the verifier SHALL limit consecutive failed authentication attempts on a single account to no more than 100.” The literal translation of this would be that after 100 failed attempts we would turn off an account and never speak to them again. Another reading would be that we make them reidentify, or we allow them to use a different factor, as described in 63B#1810, or they can reset their password. Naturally, into this ambiguity, CSPs like to insert creative thinking, including delays of between 20 second and a month, progressive delays and other forms of recovery. I would argue most of these exceed the current language and many of these vastly exceed the intention and the spirit of the criteria. Should the criteria identify what happens after 100 or provide guidance? 63B#0510 The Verifier SHALL implement a rate-limiting mechanism which: 63B#0510 a) protects against online guessing attacks; 63B#0510 b) limits consecutive failed authentication attempts on a single account to no more than 100. 63B#1460 The CSP SHALL limit consecutive failed authentication attempts on a single account to no more than 100. OPF#0070 Limit the number of failed authentications attempts to no more than 100 in any 30-day period. * 63A#0680, zeroizing the biometric sample –The IAWG discussed but I don’t think we concluded if we should leave in a clearly wrong but workable criteria or correct it (probably by Withdrawing it as not applicable to the identity proofing process). 63A#0680 The CSP SHALL zeroize the biometric sample (including any associated biometric data) immediately after any training or research data has been derived. With regard to zeroizing the biometric sample (63A#0680); I believe the criteria is flawed by virtue of some poor wording from NIST and the fact that the criteria as actually from 63B and dropped into 63A. The poor wording gives us a loophole by virtue of its odd wording, which sort of makes the criteria harmless, although I believe the more rigorous approach would be to withdraw it, as we have other imported 63B criteria. * Validation at Strong SP 800-63 and Kantara require that “The CSP SHALL validate identity evidence with a process that can achieve the same strength as the evidence presented. For example, if two forms of STRONG identity evidence are presented, each piece of evidence will be validated at a strength of STRONG.(63 4.4.1.3; see also 63A#0200)” This is compared with verification which is only compared to the strongest piece of identity evidence. (63 5.3.1). Validating evidence at STRONG requires having “all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s).” AAMVA allows verification of DLs but there is no issuing, authoritative, or even credible source would validate a Permanent Resident Card, Native American Enhanced Tribal Card, “Enhanced ID cards,” U.S. Military ID, Permanent Resident Card or Native American Tribal Photo Identification Cards? Consequently, calling them SUPERIOR or STRONG isn’t really meaningful, if they cannot be validated that way. (There are some cool implementations that can read a passport and verify digital signatures, but for PIV, CAC, PIV-I (and TWIC?) you are going to need a card reader, so that mostly leaves out unsupervised. I think validating a digital signature is a fairly strong validation, even if it does not really COMPARE information with an issuing or authoritative source? Things really seemed odd to me, when we came to the conclusion that you would have to consider a US Navy CAC card a “FAIR” piece of evidence, because the DoD doesn’t validate CAC cards. ) For an unsupervised proofing, and working from NIST’s notional strength of evidence page, which TWO items can you compare with information held by an issuing or authoritative source? US Passport SUPERIOR Foreign e-Passport SUPERIOR Personal Identity Verification (PIV) card SUPERIOR Common Access card (CAC) SUPERIOR Personal Identity Verification Interoperable (PIV-I) card SUPERIOR Transportation Worker Identification Credential (TWIC) SUPERIOR Permanent Resident Card SUPERIOR Native American Enhanced Tribal Card SUPERIOR REAL ID cards STRONG+ Enhanced ID cards STRONG+ U.S. Uniformed Services Privilege and Identification Card (U.S. Military ID) STRONG+ Permanent Resident Card STRONG Native American Tribal Photo Identification Card STRONG Driver’s License or ID card (REAL ID non-compliant) STRONG Jimmy [cid:image001.jpg@01DB9DC2.0A456D60] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813

2 2

Input: IAWG.2025-03
by Richard G. WILSHER (＠Zygma Inc.) 27 Mar '25

27 Mar '25

Pfa proposed 'Comparable Alternative' criteria, as addressed by the referenced action. The background story is that the IAWG drafted and approved for publication these criteria approx. two years ago. Persons within the ARB strongly recommended that the criteria were not published since the entitlement for presenting a Comp.Alt lay with Fed agencies, and so the criteria were parked. My understanding (second-hand) is that there have been some Approval applications that have been presented to the ARB and Approved, though how the Comp.Alt was addressed was not consistent. I was then involved in an assessment for a client who, operating obo a Fed agency, was basically told to implement a Comp.Alt, so I dusted-off the criteria, inserted them into the SoCA/SoC and assessed against them. As I understand it the ARB were comfortable with those criteria being used and recognized that having them widely available would provide a consistent basis across all Approval scheme assessments, if these criteria were invoked. SO .. here they are, I think that the IAWG should review them again, given the time since they were first punted, and I'd be happy for them to be enhanced if that's what they need, but I'd then like to see them put through the publication process asap. I would consider them to be material and therefore requiring a 45-day public review. Clearly, if formalized within the 63A_SAC, some of the commentary (e.g. "Assessor introduced criterion") needs removal or modification. Pls note the date on this doc - that's how long this has been lingering without getting published. Let's get it done. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Reminder: IAWG call today noon Eastern
by Andrew Hughes 27 Mar '25

27 Mar '25

Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Meeting - Thursday March 27
by Yehoshua Silberstein 26 Mar '25

26 Mar '25

Hi IAWG, For tomorrow’s meeting, I want to take a step back and ensure we’re focused on the right priorities. Over the past few months, we’ve had important discussions about the future of the US Program and the evolving structure of Kantara’s work. At the same time, we have open items that need attention, such as ongoing SAC updates. To move forward productively, I’d like to center our discussions on: * Addressing any outstanding items from the action tracker to ensure continuity in our current framework. * Creating space for open discussion so all perspectives are heard. This is an opportunity to reset and ensure IAWG remains a valuable forum for all members. If you’ve been waiting for the right time to re-engage, I encourage you to join the discussion tomorrow. Looking forward to the conversation. Best, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

Formal request for Notice of an IAWG meeting, to be held 2025-03-27
by Richard G. WILSHER (＠Zygma Inc.) 23 Mar '25

23 Mar '25

Noting your lack of response Yehoshua, I must point out that your statement that “[the IAWG] will reconvene once we have the necessary updates” is a dereliction of your duty as the Chair of the IAWG, a role which you chose to take on. Your excuse for cancelling this week’s IAWG meeting completely ignores the fact that there are matters within direct scope of the OIAWG’s remit, which require addressing, and which you appeared to have acknowledged last week. Though I have posted these points before I reiterate them now, as the basis for an IAWG meeting on Thursday 2025-03-27. Regarding the SACs: 1) Comparable Alternative criteria were reintroduced into the discussion and I was of the view that they were to be included in a revised 63A_SAC; 2) Proofing strength combinations – we agreed that 63A#0180 was worthy of amendment to accommodate STRONG+ and greater break-down to individual pieces of evidence, to better support component proofing services; 3) editorials – quite a few have been noted along the way and ‘stored’ for publication, and a recent assessment I’ve been involved in has led to a number of additional minor editorial changes being identified (one actually was a criterion mis-numbering, which is a little above ‘minor editorial’); 4) definitive ‘passkey waiver’ criteria – the IAWG never concluded its discussion about which criteria ought to be subject to a Notice, and the published Notice was therefore produced prematurely. This is problematic since other criteria are (I believe) worthy of inclusion, which presents a problem if assessments are performed with such findings yet the Notice does not support them. These items 1-4 should have immediate priority since these MAY need wider review, depending on whether revisions are Material or Non-Material, and given the delays, perhaps Non-Material changes ought to be pushed through with Material changes to follow, allowing their formal adoption by CSPs. Regarding the TSL web pages: 5) The definitions for Full Service and Component Service are incorrect, i.e. they do not align to the KI Glossary; 6) The TSL split between services is incorrect – they are grouped as ‘Full’, ‘Classic’ and ‘Component’. This is completely wrong – the distinction between Full and Component is equally applicable to both ‘Classic’ and ’63 rev.3’ services. At least one of the present ‘Classic’ listed services is a Component Service; Items 5-6 should have high but not immediate priority. They are misleading and therefore do not project a consistent view of KI. And they’re easy to fix, and probably require no further IAWG input (other than encouragement?). And then … Posted list of Approval-scheme Assessors: 7) KI has been added as an Assessor under the existing Approval scheme. I consider this to be ethically challengeable and believe that this entry should be removed without delay. This may not be directly under the IAWG’s remit but ought to be of concern. Any discussion of ‘nice-to-haves’ in terms of potential longer-term revisions to criteria should not be addressed until the above existential points have been considered and resolutions determined, including the means for the IAWG to keep track of and ensure completion of those actions. If others have germane agenda items for consideration, by all means let them be added, but let’s ensure that we understand the priorities. In your role as Chairman of the IAWG, please respond to this email by end of this week with confirmation of an IAWG meeting next week covering at least the items I have listed above. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Richard G. WILSHER (@Zygma Inc.) [mailto:RGW@Zygma.biz] Sent: Wednesday, 19 March, 2025 18:21 To: 'yehoshua(a)proof.com' Cc: IA WG (wg-idassurance(a)kantarainitiative.org) Subject: RE: [WG-IDAssurance] Meeting Cancellation - March 20 Yehoshua, This not acceptable – as the Chairman of IAWG you should be doing all you can to direct the business of the IAWG iaw its Charter. Last week you expressly chose not to accept my request that we address existential IAWG business first and instead the meeting got hijacked (not for the first time, imo). That is failing to uphold the principles of the Charter, and you might recall we deliberately (and recently) left it largely unchanged specifically so that it had nothing to do with any development towards establishing an Accredited CB. I have documented genuine IAWG matters which have been overlooked for months, maybe some for six months by now. AH also professed to having a list. Furthermore, the meeting closed with an undertaking on the part of either yourself or AH to address ‘real’ (my choice of word) IAWG business this week. We should be holding a meeting this week to address those points which impinge upon current Approval-scheme assessments and which have nothing to do with future Certification scheme audits. Resolution of the open questions seems to me be straightforward and frankly, not your (nor AH’s) problem – you are both caught between a rock and a hard place. Those questions should be addressed by KC and CB in a separate process and in separate meetings. Please withdraw the e-mail below and post a meaningful agenda for the IAWG to meet this week. Thank you and good morning Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Yehoshua Silberstein [mailto:yehoshua@proof.com] Sent: Wednesday, 19 March, 2025 17:35 To: IAWG Subject: [WG-IDAssurance] Meeting Cancellation - March 20 Good afternoon, This week’s meeting is canceled as we continue working to address the open questions raised in the last meeting. We will reconvene once we have the necessary updates. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 <https://lh3.googleusercontent.com/7nPoP42JZWBh2Tlgr4Pk7-Xw-dNkaxwcdqDAvNQRy…> Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

4 4

Meeting Cancellation - March 20
by Yehoshua Silberstein 19 Mar '25

19 Mar '25

Good afternoon, This week’s meeting is canceled as we continue working to address the open questions raised in the last meeting. We will reconvene once we have the necessary updates. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

2 1

Reminder IAWG - Weekly Group Call March 13 2025
by Andrew Hughes 13 Mar '25

13 Mar '25

Reminder that IAWG will meet in about an hour. Agenda to include: - discussion about plans for 17065-Accredited assurance program - review outstanding SAC items IAWG - Weekly Group Call Thursday Mar 20, 2025 ⋅ 12:00 – 13:00 Eastern Time - New York Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

2 1

Update on Trust Mark Program Structure & Next Steps
by Yehoshua Silberstein 06 Mar '25

06 Mar '25

Good morning everyone, Following our initial discussions with Carol and Kay, we wanted to provide an update on the evolving structure of the trust mark program and the key areas requiring focused attention. NEW PROGRAM ORGANIZATION Kantara has determined that a Certification Board will be established to oversee the structure, policies, and governance of the certification process. This board will be a new addition to the US Program and will be responsible for defining and maintaining the assessment criteria used in evaluations, ensuring alignment with accreditation requirements while maintaining the integrity and independence of the program. Separately, the Assurance Review Board (ARB) will continue to be responsible for evaluating applications and making certification determinations. A Stakeholder Group will provide a forum for industry engagement, program feedback, and broader ecosystem needs. While IAWG may continue in this capacity, its role will evolve as new structures are established. SEPARATING REQUIREMENTS FROM ASSESSMENT CRITERIA In addition to these structural changes, a significant body of work will be the separation of requirements from assessment criteria, which will provide a structured foundation for evaluation. While current certifications align with NIST guidance, that framework was not designed as a structured set of certifiable requirements. For example, the NIST guidelines do not number individual requirements, making citation difficult and creating ambiguity when referencing specific provisions. Without clear identifiers, it becomes challenging to ensure consistency across implementations. Additionally, NIST does not explicitly assign responsibilities when multiple providers are involved in an identity proofing or authentication process. A provider may use one vendor for credential analysis, another for database checks, and a third for trusted referees. However, NIST does not clarify which requirements must be met by the primary provider versus their service providers, making compliance determinations unclear. Finally, much of the NIST language is written as guidance rather than strict requirements. While this flexibility is valuable in many contexts, certification requires well-defined, testable criteria to ensure consistent evaluations. To create a scalable and certifiable model, there is a need to define structured requirements, which the Certification Board will then use to develop assessment criteria. This distinction is critical to ensuring consistency, transparency, and adaptability in certification. ADDRESSING CURRENT WORK In response to concerns raised about the current work, IAWG will continue maintaining and managing the existing SAC. We recognize that there are outstanding items that must be addressed promptly, and we are committed to ensuring that necessary updates and clarifications are made as this transition progresses. NEXT STEPS We are working to define how best to organize the effort to develop requirements and are seeking input from those interested in contributing to this work. If you’d like to be involved, please let us know. To continue this discussion, I am calling the next meeting for Thursday, March 13. We will outline the approach, discuss opportunities for engagement, and address any outstanding questions. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

IAWG business
by Richard G. WILSHER (＠Zygma Inc.) 03 Mar '25

03 Mar '25

Yehoshua, Your message (below) appears to put the IAWG into stasis, as if it has no further purpose (or at least, hasn’t at the present). That cannot be so, however. The Approval scheme continues to function and needs to be supported with up-to-date criteria, notices and correct and accurate statements on the TSL page. We’ve been told that these matters were going to be addressed but they haven’t been, and the failure to resolve them is creating, and will further create, problems with ongoing Assessments and Approval renewals. I request that the IAWG has a meeting to address the following points, all of which are unfinished business from 2024 which the potential arrival of an Accredited CB appears to have pushed aside. My concerns are: Regarding the SACs: 1) Comp Alt criteria were reintroduced into the discussion and I was of the view that they were to be included in a revised 63A_SAC; 2) Proofing strength combos – we agreed that 63A#0180 was worthy of amendment to accommodate STRONG+ and greater break-down to individual pieces of evidence, to better support component proofing services; 3) editorials – quite a few have been noted along the way and ‘stored’ for publication, and a recent assessment I’ve been involved in has led to a number of additional minor editorial changes being identified (one actually was a criterion mis-numbering, which is a little above ‘minor editorial’); 4) definitive ‘passkey waiver’ criteria – the IAWG never concluded its discussion about which criteria ought to be subject to a Notice, and the published Notice was therefore produced prematurely. This is problematic since other criteria are (I believe) worthy of inclusion, which presents a problem if assessments are performed with such findings yet the Notice does not support them. I have previously offered to provide publishable revisions for the affected SACs but the meeting was advised that these would be dealt with by ‘staff’. Regarding the TSL web pages: 5) The definitions for Full Service and Component Service are incorrect, i.e. they do not align to the KI Glossary; 6) The TSL split between services is incorrect – they are grouped as ‘Full’, ‘Classic’ and ‘Component’. This is completely wrong – the distinction between Full and Component is equally applicable to both ‘Classic’ and ’63 rev.3’ services. At least one of the present ‘Classic’ listed services is a Component Service; The above problems have existed for months. More recently: 7) KI has been added as an Assessor under the existing Approval scheme. I consider this to be ethically challenged and believe that this entry should be removed. Hopefully catch everyone at a meeting this week to deal with last year’s business … then we can see whether we have any for 2025. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Yehoshua Silberstein [mailto:yehoshua@proof.com] Sent: Monday, February 24, 2025 18:52 To: IAWG Subject: [WG-IDAssurance] Election Results & Feb. 27 Meeting Cancelation Hi everyone, Following our recent elections, I’m honored to serve as the new Chair of the IAWG, with Andrew as Vice-Chair. We look forward to working with all of you in our new roles. In the meantime, we’re canceling this week’s IAWG meeting (and potentially next week’s) as we work with Carol and Kay to better understand and clarify the roles, responsibilities, and structure of the new program. Our goal is to gather the necessary details to help you understand how this will take shape, and we’ll follow up once we have more to share and confirm the next meeting date. Thanks, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 <https://lh3.googleusercontent.com/7nPoP42JZWBh2Tlgr4Pk7-Xw-dNkaxwcdqDAvNQRy…> Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

Election Results & Feb. 27 Meeting Cancelation
by Yehoshua Silberstein 24 Feb '25

24 Feb '25

Hi everyone, Following our recent elections, I’m honored to serve as the new Chair of the IAWG, with Andrew as Vice-Chair. We look forward to working with all of you in our new roles. In the meantime, we’re canceling this week’s IAWG meeting (and potentially next week’s) as we work with Carol and Kay to better understand and clarify the roles, responsibilities, and structure of the new program. Our goal is to gather the necessary details to help you understand how this will take shape, and we’ll follow up once we have more to share and confirm the next meeting date. Thanks, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

Meeting notes from 2025-02-13 IAWG call
by Andrew Hughes 20 Feb '25

20 Feb '25

Hello IAWG! Here are the notes from today - please let me know of errors and omissions. Thanks! https://kantara.atlassian.net/wiki/spaces/IAWG/pages/872742914/2025-02-13+I… *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 1

IAWG Meeting agenda 2025-02-13
by Andrew Hughes 13 Feb '25

13 Feb '25

Hi IAWG Agenda for this week's call: - Regular standing items - Refinement on proposed Purpose/Scope text for the 2025 IAWG Charter - hope to complete on this call if possible - Leadership candidates/election completion - if we have quorum we can elect or seat leadership candidates by acclimation. Nomination period is still open. So far we have Yehoshua Silberstein for Chair and Andrew Hughes for Vice-Chair. We really could use an active Secretary to take notes, post stuff and maintain the action items log. See you on Thursday February 13, 2025 Noon Eastern Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

4 7