...
Ken noted that in the absence of Richard Wilsher we would not likely be able to finalize the text for comparable alternatives, but asked the WG for any reaction to Jimmy Jung's email sent to the list today. Referencing the draft language for KI criterion 63A#0177, part (f), Jimmy proposed that "we might rather 'inform service's clients/consumers' than just 'make available to the service's clients/consumers' " JJ's more; RQ says "make available" is good language. MK: though he was asking for more. ; RQ: meant inform and make available. MS: how? RQ: mechanism – maybe included in our notice of the review.? MK: wonder if KI needs to send a separate communication on this point. "Make available" should be enough. KD: shouldn't make it hard or obscure. If we "inform", that makes a record. ?? What about component services? KD: the CSP is the client. Language: in (f) " the results of the CSP's determination of comparability of an alternative control. After some discussion, Ken suggested the following language:
(f) "Inform, directly or through a direct link, services clients" 63(a) 177 ref "or uses comp alt via a component service>
For Component services: CSP is using the CSP. "or uses a component that does"
KD: if a CSP makes a subst change they must inform the ARB. Component switch would be a significant change. MK: I would not consider that subst, necessarily.
RQ: we want to foster competition in the market.
KD: close off. 2 changes to be sent to Richardthe service's clients . . ."
A questions was raised as to how the (CSP) service's (RP) clients would be made aware of the use of an alternative control if the CSP's service incorporated a component service that used an alternative control. Ken proposed that the main text of the criterion 63A#0177 be revised as follows:
"63A#0177 "If the CSP implements, or incorporates a component service that implements, comparable alternatives . . ."
The WG briefly discussed whether, if a CSP were to replace one component service in its offering with another (Kantara-certified) service, that would require recertification of the CSP's service. Ken stated the view that any change to a certified service would have to be notified to Kantara, and the ARB would determine if the change would require recertification or perhaps some lesser level of review. He thinks that replacement of a component service with one that incorporated a comparable alternative control would be considered a significant change in the CSP's service.
Ken closed the discussion of this item noting that he would bring the revisions discussed today to Richard W's attention so that any issues he might identify with the language could be resolved at the next IAWG meeting.
Finalize proposed text (if any) regarding use of "presentation attack detection" (PAD.)
...