- WG-IDAssurance - mailman.kantarainitiative.org

Additional 63A_SAC non-material edit
by Richard G. WILSHER (＠Zygma Inc.) 10 Apr '25

10 Apr '25

I wish to submit the following change for inclusion in the forthcoming 63A re-issue: In the CO_SAC we amended (some while back) criteria which referred to 'Applicants' to be replaced with 'Applicant/Service Consumer' to clarify the necessary applicatikon of the affected criteria when the service being assessed is a component service (see guidance text provided for CO#0110). The following 63A_SAC criteria are in need of the same treatment but were overlooked at the time of changes to the CO_SAC. 63A#0060 The CSP SHALL provide mechanisms to redress Applicant/Service Consumer complaints or problems arising from their use of the identity proofing service. 63A#0062 The CSP SHALL document and publish its redress mechanisms in a manner which is easy for Applicants/Service Consumers to find and use. I think this is self-explanatory and will be unable to participate and support this proposed change at this week's meeting - I'm preferring not to be firing on all four at 03:00 local. Happy meeting, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Update to Notice KI#2024-01 – Accommodation of Passkeys
by Jimmy Jung 05 Apr '25

05 Apr '25

Below please find my inputs to the proposal to Update to Notice KI#2024-01 The ORIGINAL referenced 63B# criteria: • 0410, 0420, 0430, 0440, 0450, 0460; • 1150, 1160; • 1210, 1220, 1230, 1240; • 1270, 1280, 1290, 1300, 1310, 1320, 1330; • 1450, 1460, 1470, 1480, 1490, 1500, 1510, 1520, 1530, 1540, and 1550. I concur that the language should be reviewed to make clear that the use of the “In scope – Not applicable to Passkeys” caveat is specific only to criteria as it relates to the use of FIDO passkeys. I would also note that the notice includes the following: “Kantara Initiative is in the process of assessing the risks and defining such criteria that will provide the necessary confidence that compliance can be met. Until that is completed and communicated, …” I think we should consider if that is accurate and update accordingly. With regard to criteria, * STRIKE 0410, 0420, 0430, 0440, 0450, 0460 – strike these from the notice. They are memorized secret/password criteria and not applicable to Cryptographic Device Authenticators. They are referenced by the Cryptographic Device Authenticator criteria in 1290 and removed from applicability for passkeys when the notice strikes 1290. Referencing them in the notice only risks a CSP thinking they may be ignored accidentally. * ADD 1130, 1140, 1170– it is not clear why they were left out. These controls appear to be local to the user device and outside the assessment scope * KEEP 1150, 1160, 1210, 1220, 1230, 1240; - It should be noted that these are Single-Factor Cryptographic Software authenticator criteria. While we may assume that passkeys are multifactor; technically the authenticator does not indicate. * ADD 1250, 1260 – it is not clear why they were left out * KEEP 1270, 1280, 1290, 1300, 1310, 1320, 1330 * KEEP 1450, 1460 * STRIKE 1470, 1480, 1490, 1500, 1510, 1520, 1530, 1540, and 1550. - Strike these from the notice. They are biometric criteria and not applicable to Cryptographic Device Authenticators. They are referenced by the Cryptographic Device Authenticator criteria in 1310 and removed from applicability for passkeys when the notice strikes 1310. Referencing them in the notice only risks a CSP thinking they may be ignored accidentally. (If they are to be included (1505 may need to be added * ADD 1710 Throttling attempts for passkeys would be local to the device * I’m not sure if the use of the 5 dot points has some hidden meaning More specifically, WRT to the inclusion of 0410 – 0460; I suggest we consider how these would have been handled say two years ago, before passkeys were an issue. If you are not using passwords/Memorized secrets, or one time password devices, or multi-factor cryptographic hardware, you simply Mark those criteria as in scope not applicable. In the scenario where they are using passkeys but not passwords the caveats of the notice apply. In the scenario where they're using passwords but not pass keys the criteria is there to be addressed. The trickiest aspect is a system using both; I think it is best for the notice to not call out those things that are dismissed under the heading of the cryptographic software criteria. Let them make that calculation; rather than them assuming that these rules do not apply at all (or to their passwords) because they are using passkeys [cid:image001.jpg@01DBA4AA.C00B8E60] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813

1 0

Re: Reminder: IAWG - Weekly Group Call April 3 2025
by Andrew Hughes 01 Apr '25

01 Apr '25

On Tue, Apr 1, 2025 at 10:24 AM Andrew Hughes <andrewhughes3000(a)gmail.com> wrote: > IAWG - Weekly Group Call > > > > Main agenda items for this this week's IAWG Call: > > * Discuss clarifying the definition of "verifiers" in 63B#0120 to ensure > FIPS 140 requirements are correctly applied to cryptographic modules, not > entire organizations, and to resolve inconsistencies with 63B#0090 > > * Review proposal to revise Notice KI#2024-01 – Accommodation of Passkeys > to include the following additional criteria - 63B#0780, #0790, #0800, > #1630, #1640, and #1710. > > https://cdn.kantarainitiative.org/wp-content/uploads/2025/02/Notice-KI-2024… > > * Review proposed 'comparable alternative' criteria. > > IAWG - Weekly Group Call > Thursday Apr 3, 2025 ⋅ 09:00 – 10:00 (Pacific Time - Vancouver) > Kantara Initiative is inviting you to a scheduled Zoom meeting. > Join Zoom Meeting > https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 > > Meeting ID: 931 6796 5850 > Passcode: 884696 > > --- > > One tap mobile > +16465588656,,93167965850#,,,,*884696# US (New York) > +16469313860,,93167965850#,,,,*884696# US > > --- > > Dial by your location > • +1 646 558 8656 US (New York) > • +1 646 931 3860 US > • +1 301 715 8592 US (Washington DC) > • +1 305 224 1968 US > • +1 309 205 3325 US > • +1 312 626 6799 US (Chicago) > • +1 689 278 1000 US > • +1 719 359 4580 US > • +1 720 707 2699 US (Denver) > • +1 253 205 0468 US > • +1 253 215 8782 US (Tacoma) > • +1 346 248 7799 US (Houston) > • +1 360 209 5623 US > • +1 386 347 5053 US > • +1 507 473 4847 US > • +1 564 217 2000 US > • +1 669 444 9171 US > > Meeting ID: 931 6796 5850 > Passcode: 884696 > > Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ > > Location > https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 > View map > <https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09> > >

1 0

An IAWG open/actionable list
by Jimmy Jung 31 Mar '25

31 Mar '25

Folks, In our last meeting and the emails that follow several of us made reference to those items that the IAWG should address under the current charter and under the current schema. Several folks suggested that they had a list in their head or in more tangible forms. My understanding remains that the IAWG retained the bulk of the old charter because the existing criteria continues to need maintenance and we do not have an understanding of the new schema and processes nor a charter that has been updated to reflect that new schema and processes - meanwhile CSPs continue to want to be assessed and certified. Below please find my best summary of the maintenance topics pertaining to the current process; which I assume will continue to operate until there is a transition to whatever comes next. It is also my understanding that the schedule for that transition may be soon; but it also may not. I would suggest that, at our next meeting, we create and prioritize a task list, as we have in the past. Please consider the list below suggestions. Although I consider it a much lesser priority, we have also, from time to time, been asked to comment on various other international or otherwise related documentation and schema. I believe we would be better positioned to do such things, if we had a list of pending issues and could track our priorities and the status of each item through to implementation. Hunting through my notes, I have: • What is our long-term plan for passkeys in 63-3? With regard to passkeys; the notice had been published but I do not believe we have identified our long-term approach, especially given that the current indication is that 63-4 will look the same, with the same un-assessable criteria. We had been looking at some draft criteria but had not identified an approach around the un-assessables. We have members that think passkeys are critical (starting with NIST). Also, since the notice was published it has been leveraged one or twice and those assessments have highlighted additional criteria which may need to be included. • OP_SAC criteria with conflicting numbers were identified OPB#0490 Receive acknowledgement of receipt of the credential before it is activated and its directory status record is published (and thereby the subscription becomes active or re-activated, depending upon the circumstances of issue). • OPB#0480 OPB#0490 Receive acknowledgement of receipt of the hardware token before it is activated and the corresponding certificate and its directory status record are published (and thereby the subscription becomes active or re-activated, depending upon the circumstances of issue). • OPB#0490 OPB#0500 Require activation of the credential within a time period specified in the Credential Policy. • OPB#0490 OPB#0500 Require activation of the credential within a time period specified in the Certificate Policy. • • 63A#0180 – additional breakdown to better reflect the ‘Implementation Resources’ document and to facilitate component proofing services which may provide specific capability for particular forms of evidence and their validation/applicant verification. I believe we discussed and agreed in principle that we could breakdown the strength of evidence criteria to support component systems. 63A#0180 The CSP SHALL collect from the Applicant / Service Consumer at least the following strength of evidence, as determined by the further requirements in Table 5-1: See comment in Guidance for 63A#0040 63A#0180 a) One piece of SUPERIOR evidence; OR 63A#0180 b) One piece of SUPERIOR or STRONG evidence IF the evidence’s issuing source, during its identity proofing event, confirmed the claimed identity by collecting two or more forms of SUPERIOR or STRONG evidence AND the CSP validates the evidence directly with the issuing source; OR This criterion encompasses the strength of identity evidence STRONG+ listed in NIST SP 800-63-3 Implementation Resources. 63A#0180 c) Two forms of evidence comprising of: PREV: Two pieces of STRONG evidence; OR 63A#0180 c) i) A first piece of STRONG evidence; AND 63A#0180 c) ii) A second piece of STRONG evidence. OR 63A#0180 d) Three forms of evidence comprising of: PREV: One piece of STRONG evidence plus two pieces of FAIR evidence. 63A#0180 d) i) One piece of STRONG evidence; AND 63A#0180 d) ii) A first piece of FAIR evidence; AND 63A#0180 d) iii) A second piece of FAIR evidence. • 63A# proposed new criteria to address the inclusion of ‘Comparable Alternatives’ per 63 rev.3 §5.4. Discussion started but not concluded. These criteria were developed for and successfully used in an assessment, accepted by the ARB accepted the criteria and the service was Approved. This change would formalize the criteria and make them available to all CSPs. It would also apply a consistent basis by which Comp.Alts could be assessed, rather than them being determined by individual assessors or even proposed/argued by CSPs. 4.4.1.2 (IAL2) Evidence Collection Requirements Y 63A#0190 The CSP SHALL document its justification, for each form of evidence it recognises and collects in fulfilling its CrP and these criteria, of how the strength of the evidence it collects satisfies the qualities identified in Table 5‑1 [see worksheet 63A_T5-1]. Assessor-introduced criterion Y 63A#0192 If the CSP has elected to apply a 'Comparable Alternative' means of recognising evidence in 63A#0190 it SHALL fulfill criteria 63A#0700 and 63A#0710. 4.4.1.3 (IAL2) Validation Requirements The CSP SHALL validate identity evidence with a process that can achieve the same strength as the evidence presented. For example, if two forms of STRONG identity evidence are presented, each piece of evidence will be validated at a strength of STRONG. Y 63A#0200 The CSP SHALL, at a minimum, validate identity evidence at the same strength as that at which the evidence was collected. Kantara-specific requirement Y 63A#0210 The CSP SHALL document its justification, for each form of evidence it recognises and collects in fulfilling its CrP and these criteria, of how the strength of validation of the evidence it collects satisfies the qualities identified in Table 5‑2 [see worksheet 63A_T5-2]. Assessor-introduced criterion Y 63A#0212 If the CSP has elected to apply a 'Comparable Alternative' means of recognising evidence in 63A#0210 it SHALL fulfill criteria 63A#0700 and 63A#0710. The following criteria have been composed to allow the selection and use of a 'Comparable Alternative' form of evidence iaw §5.4 of NIST SP 800-63 rev.3. 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: Agencies SHALL demonstrate comparability of any chosen alternative, to include any compensating controls, when the complete set of applicable SP 800-63 requirements is not implemented. Y Y 63A#0700 The CSP SHALL justify any 'Comparable Alternative' form of evidence selection and validation, at either IAL2 or IAL3, as necessary for the applicable IAL, by ensuring that: 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document both the justification for any departure from normative requirements and detail the compensating control(s) employed. Y Y 63A#0700 a) an analysis of the risk(s) addressed by the NIST-specified controls and the degree of residual risk its implementation would achieve is determined and documented; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 b) an analysis of the risk(s) that may be introduced through the use of the alternative controls is determined and documented; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 c) different risks that may be introduced through the use of the alternative controls have been taken into account; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0700 d) controls have been selected and implemented such that the same or better net identity-proofing risk management and treatment is achieved; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: Expecting that any such measures must be recognised and approved by the service provider's senior management. Y Y 63A#0700 e) top management's acceptance of the documented risk analysis and selected treatment is maintained and retained; 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion from: The agency SHALL implement procedures to document (etc.) Y Y 63A#0710 For each comparable alternative applied the CSP SHALL also: 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: As the basis for the client agency to determine that these measures meet their requirements Y Y 63A#0710 a) make available to the Service Consumers the results of its determination of comparability, as required by 63#5.4.01 a) to e) inclusive; and 63 rev.3 5.4 Risk Acceptance and Compensating Controls Assessor-introduced criterion: To facilitate the client agency's ability to correctly use the comparable alternative Y Y 63A#0710 b) document any requirements for application of the comparable alternative so as to ensure that comparability is achieved in a Service Consumer's use of the service. • Clarifying edits for 63A T5-2 63A-T5-2#strg b) The CSP can demonstrate that the evidence which it has collected has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). The CSP can demonstrate that the evidence which it has collectaccepted has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). 63A-T5-2#supr a) The CSP can demonstrate that the evidence which it has collected has been confirmed as genuine by trained personnel and the use of appropriate technologies, including the integrity of any physical and cryptographic security features; The CSP can demonstrate that the evidence which it has collectaccepted has been confirmed as genuine by trained personnel and the use of appropriate technologies, including the integrity of any physical and cryptographic security features; 63A-T5-2#supr b) The CSP can demonstrate that the evidence which it has collected has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). The CSP can demonstrate that the evidence which it has collectaccepted has had all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s). • Clarifying edits for 63A T5-3 63A-T5-3#strg a) ii) biometric comparison of the applicant to the identity evidence. Biometric comparison performed remotely SHALL adhere to all criteria 63A#0620 to 63A#0680 inclusive. biometric comparison of the applicant to the strongest piece of identity evidence provided to support the claimed identity. Biometric comparison performed remotely SHALL adhere to all criteria 63A#0620 to 63A#0680 inclusive. • 63B#0120 – FIPS 140 “verifier" 63B#0120 is taken word for word from 800-63B and requires “verifiers to meet FIPS 140 Level 1 or higher.” However, “verifiers” generally refers to an organization, typically the CSP. FIPS 140 is Security Requirements for devices, specifically cryptography. It seems most likely that the intention was to require cryptographic authenticators that meet FIPS 140. Should clarity or guidance be added to this criteria? 63B#0120 Federal agencies SHALL only operate verifiers which have been validated as meeting FIPS 140 Level 1 or higher. • 63B#0510 – What comes after 100 The criteria say, “The Verifier SHALL implement a rate-limiting mechanism which protects against online guessing attacks and limits consecutive failed authentication attempts on a single account to no more than 100.” In 800-63-3 this is given as, “Unless otherwise specified in the description of a given authenticator, the verifier SHALL limit consecutive failed authentication attempts on a single account to no more than 100.” The literal translation of this would be that after 100 failed attempts we would turn off an account and never speak to them again. Another reading would be that we make them reidentify, or we allow them to use a different factor, as described in 63B#1810, or they can reset their password. Naturally, into this ambiguity, CSPs like to insert creative thinking, including delays of between 20 second and a month, progressive delays and other forms of recovery. I would argue most of these exceed the current language and many of these vastly exceed the intention and the spirit of the criteria. Should the criteria identify what happens after 100 or provide guidance? 63B#0510 The Verifier SHALL implement a rate-limiting mechanism which: 63B#0510 a) protects against online guessing attacks; 63B#0510 b) limits consecutive failed authentication attempts on a single account to no more than 100. 63B#1460 The CSP SHALL limit consecutive failed authentication attempts on a single account to no more than 100. OPF#0070 Limit the number of failed authentications attempts to no more than 100 in any 30-day period. * 63A#0680, zeroizing the biometric sample –The IAWG discussed but I don’t think we concluded if we should leave in a clearly wrong but workable criteria or correct it (probably by Withdrawing it as not applicable to the identity proofing process). 63A#0680 The CSP SHALL zeroize the biometric sample (including any associated biometric data) immediately after any training or research data has been derived. With regard to zeroizing the biometric sample (63A#0680); I believe the criteria is flawed by virtue of some poor wording from NIST and the fact that the criteria as actually from 63B and dropped into 63A. The poor wording gives us a loophole by virtue of its odd wording, which sort of makes the criteria harmless, although I believe the more rigorous approach would be to withdraw it, as we have other imported 63B criteria. * Validation at Strong SP 800-63 and Kantara require that “The CSP SHALL validate identity evidence with a process that can achieve the same strength as the evidence presented. For example, if two forms of STRONG identity evidence are presented, each piece of evidence will be validated at a strength of STRONG.(63 4.4.1.3; see also 63A#0200)” This is compared with verification which is only compared to the strongest piece of identity evidence. (63 5.3.1). Validating evidence at STRONG requires having “all personal details and evidence details confirmed as valid by comparison with information held or published by the issuing source or authoritative source(s).” AAMVA allows verification of DLs but there is no issuing, authoritative, or even credible source would validate a Permanent Resident Card, Native American Enhanced Tribal Card, “Enhanced ID cards,” U.S. Military ID, Permanent Resident Card or Native American Tribal Photo Identification Cards? Consequently, calling them SUPERIOR or STRONG isn’t really meaningful, if they cannot be validated that way. (There are some cool implementations that can read a passport and verify digital signatures, but for PIV, CAC, PIV-I (and TWIC?) you are going to need a card reader, so that mostly leaves out unsupervised. I think validating a digital signature is a fairly strong validation, even if it does not really COMPARE information with an issuing or authoritative source? Things really seemed odd to me, when we came to the conclusion that you would have to consider a US Navy CAC card a “FAIR” piece of evidence, because the DoD doesn’t validate CAC cards. ) For an unsupervised proofing, and working from NIST’s notional strength of evidence page, which TWO items can you compare with information held by an issuing or authoritative source? US Passport SUPERIOR Foreign e-Passport SUPERIOR Personal Identity Verification (PIV) card SUPERIOR Common Access card (CAC) SUPERIOR Personal Identity Verification Interoperable (PIV-I) card SUPERIOR Transportation Worker Identification Credential (TWIC) SUPERIOR Permanent Resident Card SUPERIOR Native American Enhanced Tribal Card SUPERIOR REAL ID cards STRONG+ Enhanced ID cards STRONG+ U.S. Uniformed Services Privilege and Identification Card (U.S. Military ID) STRONG+ Permanent Resident Card STRONG Native American Tribal Photo Identification Card STRONG Driver’s License or ID card (REAL ID non-compliant) STRONG Jimmy [cid:image001.jpg@01DB9DC2.0A456D60] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813

2 2

Input: IAWG.2025-03
by Richard G. WILSHER (＠Zygma Inc.) 27 Mar '25

27 Mar '25

Pfa proposed 'Comparable Alternative' criteria, as addressed by the referenced action. The background story is that the IAWG drafted and approved for publication these criteria approx. two years ago. Persons within the ARB strongly recommended that the criteria were not published since the entitlement for presenting a Comp.Alt lay with Fed agencies, and so the criteria were parked. My understanding (second-hand) is that there have been some Approval applications that have been presented to the ARB and Approved, though how the Comp.Alt was addressed was not consistent. I was then involved in an assessment for a client who, operating obo a Fed agency, was basically told to implement a Comp.Alt, so I dusted-off the criteria, inserted them into the SoCA/SoC and assessed against them. As I understand it the ARB were comfortable with those criteria being used and recognized that having them widely available would provide a consistent basis across all Approval scheme assessments, if these criteria were invoked. SO .. here they are, I think that the IAWG should review them again, given the time since they were first punted, and I'd be happy for them to be enhanced if that's what they need, but I'd then like to see them put through the publication process asap. I would consider them to be material and therefore requiring a 45-day public review. Clearly, if formalized within the 63A_SAC, some of the commentary (e.g. "Assessor introduced criterion") needs removal or modification. Pls note the date on this doc - that's how long this has been lingering without getting published. Let's get it done. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Reminder: IAWG call today noon Eastern
by Andrew Hughes 27 Mar '25

27 Mar '25

Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Meeting - Thursday March 27
by Yehoshua Silberstein 26 Mar '25

26 Mar '25

Hi IAWG, For tomorrow’s meeting, I want to take a step back and ensure we’re focused on the right priorities. Over the past few months, we’ve had important discussions about the future of the US Program and the evolving structure of Kantara’s work. At the same time, we have open items that need attention, such as ongoing SAC updates. To move forward productively, I’d like to center our discussions on: * Addressing any outstanding items from the action tracker to ensure continuity in our current framework. * Creating space for open discussion so all perspectives are heard. This is an opportunity to reset and ensure IAWG remains a valuable forum for all members. If you’ve been waiting for the right time to re-engage, I encourage you to join the discussion tomorrow. Looking forward to the conversation. Best, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

Formal request for Notice of an IAWG meeting, to be held 2025-03-27
by Richard G. WILSHER (＠Zygma Inc.) 23 Mar '25

23 Mar '25

Noting your lack of response Yehoshua, I must point out that your statement that “[the IAWG] will reconvene once we have the necessary updates” is a dereliction of your duty as the Chair of the IAWG, a role which you chose to take on. Your excuse for cancelling this week’s IAWG meeting completely ignores the fact that there are matters within direct scope of the OIAWG’s remit, which require addressing, and which you appeared to have acknowledged last week. Though I have posted these points before I reiterate them now, as the basis for an IAWG meeting on Thursday 2025-03-27. Regarding the SACs: 1) Comparable Alternative criteria were reintroduced into the discussion and I was of the view that they were to be included in a revised 63A_SAC; 2) Proofing strength combinations – we agreed that 63A#0180 was worthy of amendment to accommodate STRONG+ and greater break-down to individual pieces of evidence, to better support component proofing services; 3) editorials – quite a few have been noted along the way and ‘stored’ for publication, and a recent assessment I’ve been involved in has led to a number of additional minor editorial changes being identified (one actually was a criterion mis-numbering, which is a little above ‘minor editorial’); 4) definitive ‘passkey waiver’ criteria – the IAWG never concluded its discussion about which criteria ought to be subject to a Notice, and the published Notice was therefore produced prematurely. This is problematic since other criteria are (I believe) worthy of inclusion, which presents a problem if assessments are performed with such findings yet the Notice does not support them. These items 1-4 should have immediate priority since these MAY need wider review, depending on whether revisions are Material or Non-Material, and given the delays, perhaps Non-Material changes ought to be pushed through with Material changes to follow, allowing their formal adoption by CSPs. Regarding the TSL web pages: 5) The definitions for Full Service and Component Service are incorrect, i.e. they do not align to the KI Glossary; 6) The TSL split between services is incorrect – they are grouped as ‘Full’, ‘Classic’ and ‘Component’. This is completely wrong – the distinction between Full and Component is equally applicable to both ‘Classic’ and ’63 rev.3’ services. At least one of the present ‘Classic’ listed services is a Component Service; Items 5-6 should have high but not immediate priority. They are misleading and therefore do not project a consistent view of KI. And they’re easy to fix, and probably require no further IAWG input (other than encouragement?). And then … Posted list of Approval-scheme Assessors: 7) KI has been added as an Assessor under the existing Approval scheme. I consider this to be ethically challengeable and believe that this entry should be removed without delay. This may not be directly under the IAWG’s remit but ought to be of concern. Any discussion of ‘nice-to-haves’ in terms of potential longer-term revisions to criteria should not be addressed until the above existential points have been considered and resolutions determined, including the means for the IAWG to keep track of and ensure completion of those actions. If others have germane agenda items for consideration, by all means let them be added, but let’s ensure that we understand the priorities. In your role as Chairman of the IAWG, please respond to this email by end of this week with confirmation of an IAWG meeting next week covering at least the items I have listed above. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Richard G. WILSHER (@Zygma Inc.) [mailto:RGW@Zygma.biz] Sent: Wednesday, 19 March, 2025 18:21 To: 'yehoshua(a)proof.com' Cc: IA WG (wg-idassurance(a)kantarainitiative.org) Subject: RE: [WG-IDAssurance] Meeting Cancellation - March 20 Yehoshua, This not acceptable – as the Chairman of IAWG you should be doing all you can to direct the business of the IAWG iaw its Charter. Last week you expressly chose not to accept my request that we address existential IAWG business first and instead the meeting got hijacked (not for the first time, imo). That is failing to uphold the principles of the Charter, and you might recall we deliberately (and recently) left it largely unchanged specifically so that it had nothing to do with any development towards establishing an Accredited CB. I have documented genuine IAWG matters which have been overlooked for months, maybe some for six months by now. AH also professed to having a list. Furthermore, the meeting closed with an undertaking on the part of either yourself or AH to address ‘real’ (my choice of word) IAWG business this week. We should be holding a meeting this week to address those points which impinge upon current Approval-scheme assessments and which have nothing to do with future Certification scheme audits. Resolution of the open questions seems to me be straightforward and frankly, not your (nor AH’s) problem – you are both caught between a rock and a hard place. Those questions should be addressed by KC and CB in a separate process and in separate meetings. Please withdraw the e-mail below and post a meaningful agenda for the IAWG to meet this week. Thank you and good morning Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Yehoshua Silberstein [mailto:yehoshua@proof.com] Sent: Wednesday, 19 March, 2025 17:35 To: IAWG Subject: [WG-IDAssurance] Meeting Cancellation - March 20 Good afternoon, This week’s meeting is canceled as we continue working to address the open questions raised in the last meeting. We will reconvene once we have the necessary updates. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 <https://lh3.googleusercontent.com/7nPoP42JZWBh2Tlgr4Pk7-Xw-dNkaxwcdqDAvNQRy…> Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

4 4

Meeting Cancellation - March 20
by Yehoshua Silberstein 19 Mar '25

19 Mar '25

Good afternoon, This week’s meeting is canceled as we continue working to address the open questions raised in the last meeting. We will reconvene once we have the necessary updates. Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

2 1

Reminder IAWG - Weekly Group Call March 13 2025
by Andrew Hughes 13 Mar '25

13 Mar '25

Reminder that IAWG will meet in about an hour. Agenda to include: - discussion about plans for 17065-Accredited assurance program - review outstanding SAC items IAWG - Weekly Group Call Thursday Mar 20, 2025 ⋅ 12:00 – 13:00 Eastern Time - New York Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

2 1