
I attach the present set of draft Comp.Alt criteria which I have modified in an attempt to accommodate needs identified two weeks ago. This is what I will be happy to re-introduce and walk the meeting through next week. Im going to re-state the background here and ask that those attending net week review this in advance so that we can avoid having to spend time setting the context. I understand second-hand that the ARB has in the past been presented with and approved services which have Comp.Alt elements. A set of criteria very similar to those presently posited was approved by the IAWG some three (?) years ago but did not get to being published. Faced with a client who had a Comp.Alt requirement I determined to apply structure to their solution and resurrected the criteria and inserted them into the assessment which I performed. Feedback from the ARB suggested that the use of the criteria was appreciated, the service was approved. I therefore sought to reintroduce the criteria into the IAWG so as to have them reviewed again, with the hope that they would be formally published. My purpose is to reflect the key elements of 800-63 rev.3 §5.4 in a manner which states what the CSP has to do to demonstrate comparability and to ensure that users of their service are left in no doubt as to the fact that a Comp.Alt is available and how to incorporate it into a broader identity management application/system. Moreover, to give CSPs, Assessors and the ARB a stable basis for addressing the topic. I believe that Assessors need to ensure that the determination of comparability has been reasonably established but cannot make risk decisions for the CSP, nor for the consumers of its service. The situation is just another form of risk management, which remains each individual enterprises determination. If someone wants to produce a white paper, thats fine, but I dont see it helping the goal of having a means to consistently assess Comp.Alts. Neither do I think it is the IAWGs role to come up with a shopping list of Comp.Alt. possibilities let the market decide, and KI will assess. Until next week, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942